Trojaner-Board - Windows Vista - search.fbdownloader in google chrome

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows Vista - search.fbdownloader in google chrome (https://www.trojaner-board.de/153998-windows-vista-search-fbdownloader-google-chrome.html)

Windows Vista - search.fbdownloader in google chrome

Hallo,
beim Start von Chrome öffnet immer eine zweite Registerkarte mit search.fbdownloader.

defogger.disable.log
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:44 on 17/05/2014 (Dirk)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Dirk (administrator) on JOKER on 17-05-2014 11:49:41
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)
HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe
HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - No File
DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab
DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)
Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File
CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File
CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]
S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:43 - 2014-05-17 11:49 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-17 10:45 - 2014-05-17 11:49 - 00000000 ____D () C:\FRST
2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 12:10 - 2014-05-17 11:23 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

==================== One Month Modified Files and Folders =======

2014-05-17 11:49 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:49 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk
2014-05-17 11:36 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job
2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat
2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001
2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-17 11:32 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-17 11:32 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-17 11:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-17 11:28 - 2009-09-09 20:59 - 01077859 _____ () C:\Windows\WindowsUpdate.log
2014-05-17 11:25 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-05-17 11:23 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-17 11:22 - 2008-01-21 05:26 - 00302430 _____ () C:\Windows\PFRO.log
2014-05-17 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-17 11:21 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner
2014-05-17 11:21 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-17 11:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-17 11:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job
2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager
2014-05-17 10:26 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser
2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job
2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3
2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB
2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA
2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core
2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball
2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java

Some content of TEMP:
====================
C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe
C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll
C:\Users\Dirk\AppData\Local\Temp\avgnt.exe
C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE
C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe
C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe
C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll
C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe
C:\Users\Dirk\AppData\Local\Temp\ose00000.exe
C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe
C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe
C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe
C:\Users\Dirk\AppData\Local\Temp\tbWise.dll
C:\Users\Dirk\AppData\Local\Temp\unwise.exe
C:\Users\Dirk\AppData\Local\Temp\Update.exe
C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe
C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe
C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll
C:\Users\Jutta\AppData\Local\Temp\avgnt.exe
C:\Users\Lisa\AppData\Local\Temp\avgnt.exe
C:\Users\Nils\AppData\Local\Temp\avgnt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-05-17 11:37

==================== End Of Log ============================

Addition.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Dirk (administrator) on JOKER on 17-05-2014 11:49:41
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)
HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe
HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - No File
DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab
DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)
Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File
CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File
CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]
S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:43 - 2014-05-17 11:49 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-17 10:45 - 2014-05-17 11:49 - 00000000 ____D () C:\FRST
2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 12:10 - 2014-05-17 11:23 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

==================== One Month Modified Files and Folders =======

2014-05-17 11:49 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:49 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk
2014-05-17 11:36 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job
2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat
2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001
2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-17 11:32 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-17 11:32 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-17 11:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-17 11:28 - 2009-09-09 20:59 - 01077859 _____ () C:\Windows\WindowsUpdate.log
2014-05-17 11:25 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-05-17 11:23 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-17 11:22 - 2008-01-21 05:26 - 00302430 _____ () C:\Windows\PFRO.log
2014-05-17 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-17 11:21 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner
2014-05-17 11:21 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-17 11:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-17 11:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job
2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager
2014-05-17 10:26 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser
2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job
2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3
2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB
2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA
2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core
2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball
2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java

Some content of TEMP:
====================
C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe
C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll
C:\Users\Dirk\AppData\Local\Temp\avgnt.exe
C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE
C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe
C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe
C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll
C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe
C:\Users\Dirk\AppData\Local\Temp\ose00000.exe
C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe
C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe
C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe
C:\Users\Dirk\AppData\Local\Temp\tbWise.dll
C:\Users\Dirk\AppData\Local\Temp\unwise.exe
C:\Users\Dirk\AppData\Local\Temp\Update.exe
C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe
C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe
C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll
C:\Users\Jutta\AppData\Local\Temp\avgnt.exe
C:\Users\Lisa\AppData\Local\Temp\avgnt.exe
C:\Users\Nils\AppData\Local\Temp\avgnt.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-05-17 11:37

==================== End Of Log ============================

gmer.txt

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-17 14:23:02
Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31500541AS rev.CC34 1397,27GB
Running: Gmer-19357.exe; Driver: C:\Users\Dirk\AppData\Local\Temp\kgldypow.sys

---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!EnableWindow 0000000074e40827 5 bytes JMP 00000001602d9ed4
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamA 0000000074e5081c 5 bytes JMP 0000000160429151
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW 0000000074e52483 5 bytes JMP 00000001604291b6
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA 0000000074e54b7c 5 bytes JMP 00000001604290d8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW 0000000074e69b0b 5 bytes JMP 000000016042905f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000074e75fb7 5 bytes JMP 00000001602318b3
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA 0000000074e76397 5 bytes JMP 000000016042921b
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExA 0000000074e8d3ad 5 bytes JMP 0000000160428ffb
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExW 0000000074e8d3d1 5 bytes JMP 0000000160428f97
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect 00000000754c70a6 5 bytes JMP 00000001604293d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW 000000007458881c 5 bytes JMP 0000000160429280
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet 0000000074588834 5 bytes JMP 0000000160429328
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW 00000000753aed29 5 bytes JMP 00000001604295c8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!recv 000000007630343a 6 bytes JMP 71a60f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSASend 0000000076304496 6 bytes JMP 71a30f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!send 000000007630659b 6 bytes JMP 71a90f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult 0000000076308143 6 bytes JMP 71a00f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSARecv 0000000076308400 6 bytes JMP 71ac0f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A 0000000077014572 6 bytes JMP 0000000160299805
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W 000000007701457d 6 bytes JMP 00000001602f8082
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\kernel32.dll!CreateThread 0000000076508352 5 bytes JMP 00000001602975db
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CallNextHookEx 0000000074e37bb3 5 bytes JMP 00000001602f801f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetKeyState 0000000074e38c38 5 bytes JMP 000000016027dd9b
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetAsyncKeyState 0000000074e3f2ca 5 bytes JMP 000000016027dec5
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000074e4010d 5 bytes JMP 000000016031ed28
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000074e403d2 5 bytes JMP 00000001602d25cc
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EnableWindow 0000000074e40827 5 bytes JMP 00000001602d9ed4
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000074e417ea 5 bytes JMP 000000016030040f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetKeyboardState 0000000074e4263b 5 bytes JMP 000000016042a565
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExA 0000000074e4280d 5 bytes JMP 00000001602a3627
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW 0000000074e478d1 5 bytes JMP 0000000160429590
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessageW 0000000074e4805d 5 bytes JMP 0000000160429c9e
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EndDialog 0000000074e487af 5 bytes JMP 0000000160429f4a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamA 0000000074e4f8f3 5 bytes JMP 0000000160429558
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamA 0000000074e5081c 5 bytes JMP 0000000160429151
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW 0000000074e52483 5 bytes JMP 00000001604291b6
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA 0000000074e54b7c 5 bytes JMP 00000001604290d8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamA 0000000074e59b1b 5 bytes JMP 00000001604294e8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessage 0000000074e59c47 5 bytes JMP 0000000160429c76
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamW 0000000074e5bd5b 5 bytes JMP 0000000160429520
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW 0000000074e69b0b 5 bytes JMP 000000016042905f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetCursorPos 0000000074e72a58 5 bytes JMP 000000016042a5e6
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000074e75fb7 5 bytes JMP 00000001602318b3
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA 0000000074e76397 5 bytes JMP 000000016042921b
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExA 0000000074e8d3ad 5 bytes JMP 0000000160428ffb
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExW 0000000074e8d3d1 5 bytes JMP 0000000160428f97
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!keybd_event 0000000074e8d782 5 bytes JMP 000000016042a4ca
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SendInput 0000000074e95af6 5 bytes JMP 000000016042a50d
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 0000000075541e80 5 bytes JMP 00000001604299a8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 0000000075463df0 5 bytes JMP 0000000160429b1e
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 0000000075463e40 5 bytes JMP 0000000160429aa0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 000000007546462b 5 bytes JMP 0000000160429a12
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000754674bc 5 bytes JMP 0000000160429abe
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect 00000000754c70a6 5 bytes JMP 00000001604293d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW 000000007458881c 5 bytes JMP 0000000160429280
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet 0000000074588834 5 bytes JMP 0000000160429328
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgW 00000000753830cf 5 bytes JMP 000000016042966c
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgA 00000000753834de 5 bytes JMP 0000000160429738
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW 00000000753aed29 5 bytes JMP 00000001604295c8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!recv 000000007630343a 6 bytes JMP 71a60f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSASend 0000000076304496 6 bytes JMP 71a30f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!send 000000007630659b 6 bytes JMP 71a90f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult 0000000076308143 6 bytes JMP 71a00f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSARecv 0000000076308400 6 bytes JMP 71ac0f5a

---- User IAT/EAT - GMER 2.1 ----

IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord] [7fef7f5741c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet] [7fef7f55f10] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession] [7fef7f55674] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession] [7fef7f55e2c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload] [7fef7f57f48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion] [7fef7f56a38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId] [7fef7f56ee8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId] [7fef7f57b58] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId] [7fef7f57ea0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId] [7fef7f578b0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession] [7fef7f54fb4] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId] [7fef7f55d38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString] [7fef7f57584] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

---- Kernel code sections - GMER 2.1 ----

INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
---- Processes - GMER 2.1 ----

Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E2F02B9D-85EB-4BDD-9FE7-1DDB8D9D795A}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [308] (Microsoft Malware Protection Engine/Microsoft Corporation)(2014-05-17 06:59:46) 000007fefa190000
Library \\?\C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\trufos.dll (*** suspicious ***) @ C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [1020] (Trufos API/BitDefender S.R.L.)(2013-07-17 15:10:52) 000007fef5f80000
Library C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv01_64.key (*** suspicious ***) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [2620] (Individualized Black Box DLL/Microsoft Corporation)(2014-02-02 16:56:14) 000000000ac00000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [4748] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Hardcopy\hardcopy.exe [4944] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 00000000021f0000
Process C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:58) 00000000009f0000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000000750000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [3604] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [4804] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [5616] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000

---- EOF - GMER 2.1 ----

Vielen Dank vorab für eure Hilfe

hi,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Addition.txt von FRST fehlt noch.

îch werde zukünftig auf das richtige Einfügen achten.
Addition.txt ist aber dabei.

ich schreibe das nit zum Spass. DU hast zweimal die FRST.txt gepostet anstatt der Addition.txt :)

defogger_disable.log

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 11:44 on 17/05/2014 (Dirk)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

frst.txt

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014

Ran by Dirk (administrator) on JOKER on 17-05-2014 11:49:41

Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe

(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe

(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\ehome\ehsched.exe

(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(The Eraser Project) C:\Program Files\Eraser\Eraser.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe

(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe

(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe

(Microsoft Corporation) C:\Windows\System32\mobsync.exe

(Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe

(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe

(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)

HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()

HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)

HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)

HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe

HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK

ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)

Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk

ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} -  No File

DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab

DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab

Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} -  No File

Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)

Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]

FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]

FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com"

CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File

CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File

CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File

CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File

CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File

CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File

CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]

CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)

S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)

R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)

R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()

R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)

R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)

S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)

S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)

S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)

R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)

R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)

R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)

R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]

S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable

2014-05-17 11:43 - 2014-05-17 11:49 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-05-17 10:45 - 2014-05-17 11:49 - 00000000 ____D () C:\FRST

2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-05-14 12:10 - 2014-05-17 11:23 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus

2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft

2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft

2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft

2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe

2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk

2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk

2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
 

==================== One Month Modified Files and Folders =======
 

2014-05-17 11:49 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

2014-05-17 11:49 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable

2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk

2014-05-17 11:36 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job

2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat

2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001

2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

2014-05-17 11:32 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection

2014-05-17 11:32 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-17 11:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-17 11:28 - 2009-09-09 20:59 - 01077859 _____ () C:\Windows\WindowsUpdate.log

2014-05-17 11:25 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-05-17 11:23 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2014-05-17 11:22 - 2008-01-21 05:26 - 00302430 _____ () C:\Windows\PFRO.log

2014-05-17 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-17 11:21 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner

2014-05-17 11:21 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-05-17 11:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-17 11:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job

2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager

2014-05-17 10:26 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser

2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2014-05-14 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job

2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus

2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft

2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus

2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft

2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft

2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe

2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft

2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3

2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB

2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB

2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk

2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk

2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA

2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core

2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball

2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java
 

Some content of TEMP:

====================

C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe

C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll

C:\Users\Dirk\AppData\Local\Temp\avgnt.exe

C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe

C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE

C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe

C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll

C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe

C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe

C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll

C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll

C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe

C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe

C:\Users\Dirk\AppData\Local\Temp\ose00000.exe

C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe

C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe

C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe

C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe

C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe

C:\Users\Dirk\AppData\Local\Temp\tbWise.dll

C:\Users\Dirk\AppData\Local\Temp\unwise.exe

C:\Users\Dirk\AppData\Local\Temp\Update.exe

C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe

C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe

C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe

C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll

C:\Users\Jutta\AppData\Local\Temp\avgnt.exe

C:\Users\Lisa\AppData\Local\Temp\avgnt.exe

C:\Users\Nils\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-17 11:37
 

==================== End Of Log ============================

--- --- ---

--- --- ---

addition.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014

Ran by Dirk at 2014-05-17 11:50:09

Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}

AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

1&1 Upload-Manager (HKLM-x32\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)

64 Bit HP CIO Components Installer (Version: 3.2.1 - Hewlett-Packard) Hidden

7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)

Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)

AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden

AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden

Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)

Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden

ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net)

AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version:  - )

AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version:  - )

AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version:  - AVM Berlin)

BufferChm (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

C309a (x32 Version: 120.0.202.000 - Hewlett-Packard) Hidden

calibre 64bit (HKLM\...\{1BC00DD4-173E-4325-BDB7-48A076DFC1EF}) (Version: 1.29.0 - Kovid Goyal)

Camera Support Core Library (x32 Version: 7.2.0.4 - Canon) Hidden

Camera Window DS (x32 Version: 5.1 - Canon) Hidden

Camera Window DVC (x32 Version: 5.1 - Canon) Hidden

Camera Window MC (x32 Version: 5.1 - Canon) Hidden

Canon Camera Support Core Library (HKLM-x32\...\InstallShield_{5662C158-CA24-4228-BF6C-596FADA08682}) (Version: 7.2.0.4 - Canon)

Canon Camera WIA Driver (x32 Version: 5.6 - Canon) Hidden

Canon Camera Window DS for ZoomBrowser EX (HKLM-x32\...\InstallShield_{7B847C9D-6758-45E6-B598-3BD8F43EAE9E}) (Version: 5.1 - Canon)

Canon Camera Window DVC for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A70D14C6-FF2C-4B8E-A643-7E74EC607614}) (Version: 5.1 - Canon)

Canon Camera Window for ZoomBrowser EX (HKLM-x32\...\InstallShield_{E73534D5-CC93-4C63-9072-5A9734255C74}) (Version: 5.1 - Canon)

Canon EOS Kiss_N REBEL_XT 350D WIA-Treiber (HKLM-x32\...\InstallShield_{33CF7CDF-9805-4500-9CC7-D19D52AD63C4}) (Version: 5.6 - Canon)

Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\InstallShield_{954BF446-BBC9-42CC-87A6-EBF0D55CA19A}) (Version: 1.3.4 - Canon Inc.)

Canon PhotoRecord (HKLM-x32\...\{862983D7-FA08-493E-A9ED-6B7859E069D3}) (Version: 02.02.01000 - Cisra)

Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A0F34E4E-25F0-4B68-AE8F-EF0C15CB1FED}) (Version: 2.0 - Canon)

Canon RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{28291BD5-92D2-4685-82DC-CCA925C53CCA}) (Version: 1.1 - Canon)

Canon Utilities Digital Photo Professional 3.4 (HKLM-x32\...\DPP) (Version: 3.4.1.1 - )

Canon Utilities EOS Capture 1.3 (HKLM-x32\...\InstallShield_{16480125-0428-4097-9A2A-74464004D169}) (Version: 1.3 - Canon)

Canon Utilities PhotoStitch 3.1 (HKLM-x32\...\InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}) (Version: 3.1.14 - Canon)

Canon ZoomBrowser EX (HKLM-x32\...\{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}) (Version: 5.00.0000 - Canon)

CyberLink PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.3.5711.0 - CyberLink Corp.)

Destination Component (x32 Version: 110.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 3.0.0.0 - devolo AG)

dLAN Cockpit (HKLM-x32\...\Cockpit.92121A72F826FA9D0BD3A830E7F04987B31AFB22.1) (Version: 3 (23.12.2010) - devolo AG)

dLAN Cockpit (x32 Version: 3.23.12 - devolo AG) Hidden

DocProc (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

DVDFab 8.0.7.3 (29/01/2011) (HKLM-x32\...\DVDFab 8_is1) (Version:  - Fengtao Software Inc.)

EASEUS Data Recovery Wizard Free Edition 5.5.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Free Edition 5.5.1_is1) (Version:  - EASEUS)

ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.20140114 - Landesfinanzdirektion Thüringen)

ElsterFormular 2007/2008 (HKLM-x32\...\{5BA43E5C-66FD-48D2-AB40-B807D457EF83}) (Version: 9.6.2.0 NE - Steuerverwaltung des Bundes und der Länder)

ElsterFormular 2008/2009 (HKLM-x32\...\{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}) (Version: 10.3.2.0 - Steuerverwaltung des Bundes und der Länder)

EOS Capture 1.3 (x32 Version: 1.3 - Canon) Hidden

Eraser 5.8.7 (HKLM\...\{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1) (Version: Eraser 5.8.7 - The Eraser Project)

fassurun 2013.11.07.203951 (HKLM\...\fassurun) (Version: 2013.11.07.203951 - fassurun) <==== ATTENTION

Fax (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Free Download Manager 3.9.2 (HKLM-x32\...\Free Download Manager_is1) (Version:  - FreeDownloadManager.ORG)

FRITZ!DSL64 (HKLM\...\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}) (Version: 2.04.03 - AVM Berlin)

Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)

Google Chrome Frame (HKLM-x32\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)

Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden

GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

Hardcopy (C:\Program Files (x86)\Hardcopy) (HKLM-x32\...\Hardcopy(C__Program Files (x86)_Hardcopy)) (Version: 17.0.18 - www.hardcopy.de)

Hauppauge MCE XP/Vista Software Encoder (2.0.27022) (HKLM-x32\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.27022 - Hauppauge Computer Works, Inc.)

HP Customer Participation Program 12.0 (HKLM\...\HPExtendedCapabilities) (Version: 12.0 - HP)

HP Imaging Device Functions 12.0 (HKLM\...\HP Imaging Device Functions) (Version: 12.0 - HP)

HP Photosmart C309a All-In-One Driver Software 12.0 Rel .5 (HKLM\...\{2D250E57-9890-44a6-B08F-5C02C991EF24}) (Version: 12.0 - HP)

HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)

HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)

HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Update (HKLM-x32\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)

HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden

HPPhotoGadget (x32 Version: 120.0.150.000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

HPSSupply (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden

ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.2.0 - LIGHTNING UK!)

Internet Library (x32 Version: 1.3.4 - Canon Inc.) Hidden

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)

J2SE Runtime Environment 5.0 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

KeePass Password Safe 2.10 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version:  - Dominik Reichl)

Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

MarketResearch (x32 Version: 120.0.226.000 - Hewlett-Packard) Hidden

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Core Components (x64) ENU  (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden

MSVCSetup (x32 Version: 1.00.0000 - HP) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Nero 9 Essentials (HKLM-x32\...\{801189ff-e34f-423a-9f10-b423502b163f}) (Version:  - Nero AG)

Nero BurnRights (x32 Version: 3.4.10.100 - Nero AG) Hidden

Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden

Nero CoverDesigner (x32 Version: 4.4.9.202 - Nero AG) Hidden

Nero CoverDesigner Help (x32 Version: 4.4.6.100 - Nero AG) Hidden

Nero DiscSpeed (x32 Version: 5.4.10.100 - Nero AG) Hidden

Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden

Nero DriveSpeed (x32 Version: 4.4.10.100 - Nero AG) Hidden

Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden

Nero InfoTool (x32 Version: 6.4.10.100 - Nero AG) Hidden

Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden

Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden

Nero StartSmart (x32 Version: 9.4.11.201 - Nero AG) Hidden

Nero StartSmart Help (x32 Version: 9.4.1.100 - Nero AG) Hidden

Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Network64 (Version: 120.0.194.000 - Hewlett-Packard) Hidden

NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden

OCR Software by I.R.I.S. 12.0 (HKLM\...\HPOCR) (Version: 12.0 - HP)

OpenOffice.org 3.1 (HKLM-x32\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)

Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)

PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)

PDF Editor 2 (HKLM-x32\...\PDF Editor 2) (Version:  - )

PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)

pdfforge Toolbar v4.6 (HKLM-x32\...\{E6098043-1183-4580-89EF-423CBF807188}) (Version: 4.6 - Spigot, Inc.) <==== ATTENTION

Phase 5 HTML-Editor (HKLM-x32\...\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}) (Version: 5.6.2 - Systemberatung Schommer)

PhotoStitch (x32 Version: 3.1.14 - Canon) Hidden

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)

ProgDVB x64 (HKLM\...\ProgDVB) (Version: 6.9x - Prog)

PS_AIO_05_C309_Software_Min (x32 Version: 120.0.206.000 - Hewlett-Packard) Hidden

PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden

RAW Image Task 2.0 (x32 Version: 2.0 - Canon) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5874 - Realtek Semiconductor Corp.)

RemoteCapture Task 1.1 (x32 Version: 1.1 - Canon) Hidden

Scan (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 12 - HP)

SIS-Handball 3.9 (HKLM-x32\...\SIS-Handball) (Version: 3.9 - GateCom GmbH)

Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden

SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden

Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)

St. Louis Rams Toolbar (HKLM-x32\...\St. Louis Rams Toolbar) (Version: 1.514 - )

Status (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 4.0.0.0 - Stellar Information Systems Ltd)

SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)

SystemDiagnostics (HKLM-x32\...\{80B0B731-5FAE-475D-8844-20F46373780D}) (Version: 3.02.0010 - Fujitsu Technology Solutions)

teXXas (HKLM-x32\...\{F3DCD04C-BE9C-408C-BC8C-B77AF972DBC2}) (Version: 1 - metaspinner net GmbH)

TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Toolbox (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

TrayApp (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)

WebReg (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden

Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Live OneCare safety scanner (HKLM-x32\...\Windows Live OneCare safety scanner) (Version:  - Microsoft Corporation)

Windows Live OneCare safety scanner (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)

Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

XP Codec Pack (HKLM-x32\...\XP Codec Pack) (Version:  - )
 

==================== Restore Points  =========================
 

16-03-2014 11:47:26 Installed calibre 64bit

21-03-2014 18:10:12 Installed calibre 64bit

16-04-2014 15:01:22 Windows Update

27-04-2014 09:58:17 Installed Java 7 Update 55

27-04-2014 10:05:33 Removed Java 7 Update 55

27-04-2014 10:17:56 Installed Java 7 Update 55

12-05-2014 15:12:38 Windows Update

12-05-2014 18:07:07 OpenOffice.org 3.1 wird entfernt

12-05-2014 18:13:37 AA11

14-05-2014 10:04:25 AA11

14-05-2014 11:40:48 Windows Update

14-05-2014 12:43:05 Windows Update
 

==================== Hosts content: ==========================
 

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

::1             localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {01503B02-7AF4-4ED7-9E3F-97049297213F} - System32\Tasks\{B7B91C77-1E48-44BE-8E9F-FC08EE02125A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages

Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)

Task: {5E551E2D-6024-438A-B6BB-4BD2C63E230F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)

Task: {600D1CE0-FC0C-464E-AC3B-FA5F135D3915} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

Task: {6A3BC972-B370-45E3-AD15-370CFD3EE8F9} - System32\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F} => C:\Program Files\V-bates\PrefHelper.exe

Task: {7A936888-6D24-4B69-9A45-EAEA6C3F1EFF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)

Task: {7BA40AA9-D6BC-4D03-A0C0-398717389FC7} - System32\Tasks\{F7A8E834-BD3C-4504-885B-1E637D64FEC7} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)

Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI

Task: {8CFE1E32-B04E-456C-989C-1AA1556BE805} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)

Task: {B384F716-A243-4440-91D6-34FA3643F784} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)

Task: {BF328AF9-E972-4814-BA2B-8955BE07E803} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)

Task: {E3891FA7-79D4-4A37-A8CC-B7D9ADEDDCEC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)

Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job => C:\Program Files\V-bates\PrefHelper.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2009-11-19 19:34 - 2006-02-23 13:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll

2009-11-19 19:34 - 2006-02-22 12:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll

2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe

2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll

2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 04114264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe

2014-01-23 16:29 - 2014-01-23 16:29 - 00500088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_locale-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00361824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\HtmlFramework.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00066904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\DllStorage.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00788848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTrayDefaultSkin.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00139608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\Localization.dll

2009-10-03 10:51 - 2008-12-02 14:21 - 00041984 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_ex.exe

2009-10-03 10:51 - 2009-06-10 06:19 - 00057856 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_x64.dll

2012-12-21 19:33 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2009-10-03 10:51 - 2009-09-25 16:50 - 00445440 _____ () C:\Program Files (x86)\Hardcopy\HcDllS.dll

2009-10-03 10:51 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files (x86)\Hardcopy\hardcopy_02.dll

2009-10-03 10:51 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_Win32.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:A8665DF4
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\startupfolder: C:^Users^Dirk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: BDRegion => "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"

MSCONFIG\startupreg: Google EULA Launcher => c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA

MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup

MSCONFIG\startupreg: NokiaMusic FastStart => "C:\Program Files (x86)\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart

MSCONFIG\startupreg: NokiaOviSuite2 => C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray

MSCONFIG\startupreg: RemoteControl => "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized

MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

MSCONFIG\startupreg: WMPNSCFG => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Photosmart C309a series

Description: Photosmart C309a series

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (05/17/2014 11:24:13 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (05/17/2014 10:29:42 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (05/17/2014 11:24:13 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: i8042prt
 

Error: (05/17/2014 11:24:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Util fassurun%%3
 

Error: (05/17/2014 10:31:34 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {7F6316B4-4D69-4765-B0A3-B2598F2FA80A}
 

Error: (05/17/2014 10:30:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Windows Mobile-basierte Geräteverbindung%%1053
 

Error: (05/17/2014 10:30:14 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: 30000Windows Mobile-basierte Geräteverbindung
 

Error: (05/17/2014 10:30:14 AM) (Source: DCOM) (EventID: 10005) (User: )

Description: 1053RapiMgr{ED081F25-6A77-4C89-B689-C6E15C582EC1}
 

Error: (05/17/2014 10:29:44 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: i8042prt
 

Error: (05/17/2014 10:29:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Util fassurun%%3
 
 

Microsoft Office Sessions:

=========================

Error: (05/01/2014 07:39:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 36965 seconds with 180 seconds of active time.  This session ended with a crash.
 

Error: (03/12/2014 07:08:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (02/03/2014 07:02:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2689 seconds with 600 seconds of active time.  This session ended with a crash.
 

Error: (02/16/2013 02:55:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/22/2012 09:18:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/09/2012 10:54:19 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/09/2012 10:54:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/09/2012 00:55:39 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/06/2012 11:28:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 43 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (05/31/2012 08:02:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-12 20:15:20.405

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-12 20:15:20.018

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-12 20:15:19.625

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-12 20:15:19.223

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-12 20:15:18.794

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-12 20:15:18.416

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-12 20:15:18.049

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-12 20:15:17.668

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-01-18 13:11:06.987

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-01-18 13:11:06.648

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 49%

Total physical RAM: 4094.32 MB

Available physical RAM: 2047.72 MB

Total Pagefile: 8395.91 MB

Available Pagefile: 6076.74 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (SYSTEM) (Fixed) (Total:164.75 GB) (Free:30.54 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive e: (DATA) (Fixed) (Total:1220.5 GB) (Free:761.28 GB) NTFS

Drive y: (Two-Face) (Removable) (Total:14.89 GB) (Free:13.49 GB) exFAT
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1397 GB) (Disk ID: FCD6DD83)

Partition 1: (Not Active) - (Size=12 GB) - (Type=27)

Partition 2: (Active) - (Size=165 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=-888516751360) - (Type=07 NTFS)
 

========================================================

Disk: 5 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: 98720C68)

Partition 1: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

gmer.txt

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-05-17 14:23:02

Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31500541AS rev.CC34 1397,27GB

Running: Gmer-19357.exe; Driver: C:\Users\Dirk\AppData\Local\Temp\kgldypow.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!EnableWindow                                                                                                                                                                   0000000074e40827 5 bytes JMP 00000001602d9ed4

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamA                                                                                                                                                                0000000074e5081c 5 bytes JMP 0000000160429151

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW                                                                                                                                                        0000000074e52483 5 bytes JMP 00000001604291b6

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA                                                                                                                                                            0000000074e54b7c 5 bytes JMP 00000001604290d8

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW                                                                                                                                                            0000000074e69b0b 5 bytes JMP 000000016042905f

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamW                                                                                                                                                                0000000074e75fb7 5 bytes JMP 00000001602318b3

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA                                                                                                                                                        0000000074e76397 5 bytes JMP 000000016042921b

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExA                                                                                                                                                                  0000000074e8d3ad 5 bytes JMP 0000000160428ffb

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExW                                                                                                                                                                  0000000074e8d3d1 5 bytes JMP 0000000160428f97

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect                                                                                                                                               00000000754c70a6 5 bytes JMP 00000001604293d0

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW                                                                     000000007458881c 5 bytes JMP 0000000160429280

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet                                                                      0000000074588834 5 bytes JMP 0000000160429328

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW                                                                                                                                                                00000000753aed29 5 bytes JMP 00000001604295c8

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!recv                                                                                                                                                                           000000007630343a 6 bytes JMP 71a60f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSASend                                                                                                                                                                        0000000076304496 6 bytes JMP 71a30f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!send                                                                                                                                                                           000000007630659b 6 bytes JMP 71a90f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                                                                                                                                                         0000000076308143 6 bytes JMP 71a00f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                                                                                                                                        0000000076308400 6 bytes JMP 71ac0f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A                                                                                                                                                            0000000077014572 6 bytes JMP 0000000160299805

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W                                                                                                                                                            000000007701457d 6 bytes JMP 00000001602f8082

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\kernel32.dll!CreateThread                                                                                                                                                                 0000000076508352 5 bytes JMP 00000001602975db

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CallNextHookEx                                                                                                                                                                 0000000074e37bb3 5 bytes JMP 00000001602f801f

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetKeyState                                                                                                                                                                    0000000074e38c38 5 bytes JMP 000000016027dd9b

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetAsyncKeyState                                                                                                                                                               0000000074e3f2ca 5 bytes JMP 000000016027dec5

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                                                                                                            0000000074e4010d 5 bytes JMP 000000016031ed28

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                                                                                                              0000000074e403d2 5 bytes JMP 00000001602d25cc

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EnableWindow                                                                                                                                                                   0000000074e40827 5 bytes JMP 00000001602d9ed4

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                                                                                0000000074e417ea 5 bytes JMP 000000016030040f

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetKeyboardState                                                                                                                                                               0000000074e4263b 5 bytes JMP 000000016042a565

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                                                                                                                0000000074e4280d 5 bytes JMP 00000001602a3627

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW                                                                                                                                                     0000000074e478d1 5 bytes JMP 0000000160429590

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessageW                                                                                                                                                               0000000074e4805d 5 bytes JMP 0000000160429c9e

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EndDialog                                                                                                                                                                      0000000074e487af 5 bytes JMP 0000000160429f4a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamA                                                                                                                                                     0000000074e4f8f3 5 bytes JMP 0000000160429558

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamA                                                                                                                                                                0000000074e5081c 5 bytes JMP 0000000160429151

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW                                                                                                                                                        0000000074e52483 5 bytes JMP 00000001604291b6

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA                                                                                                                                                            0000000074e54b7c 5 bytes JMP 00000001604290d8

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamA                                                                                                                                                             0000000074e59b1b 5 bytes JMP 00000001604294e8

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessage                                                                                                                                                                0000000074e59c47 5 bytes JMP 0000000160429c76

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamW                                                                                                                                                             0000000074e5bd5b 5 bytes JMP 0000000160429520

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW                                                                                                                                                            0000000074e69b0b 5 bytes JMP 000000016042905f

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetCursorPos                                                                                                                                                                   0000000074e72a58 5 bytes JMP 000000016042a5e6

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamW                                                                                                                                                                0000000074e75fb7 5 bytes JMP 00000001602318b3

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA                                                                                                                                                        0000000074e76397 5 bytes JMP 000000016042921b

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExA                                                                                                                                                                  0000000074e8d3ad 5 bytes JMP 0000000160428ffb

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExW                                                                                                                                                                  0000000074e8d3d1 5 bytes JMP 0000000160428f97

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                                    0000000074e8d782 5 bytes JMP 000000016042a4ca

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                                      0000000074e95af6 5 bytes JMP 000000016042a50d

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\ole32.dll!OleLoadFromStream                                                                                                                                                               0000000075541e80 5 bytes JMP 00000001604299a8

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantClear                                                                                                                                                                 0000000075463df0 5 bytes JMP 0000000160429b1e

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString                                                                                                                                                                0000000075463e40 5 bytes JMP 0000000160429aa0

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen                                                                                                                                                        000000007546462b 5 bytes JMP 0000000160429a12

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType                                                                                                                                                            00000000754674bc 5 bytes JMP 0000000160429abe

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect                                                                                                                                               00000000754c70a6 5 bytes JMP 00000001604293d0

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW                                                                     000000007458881c 5 bytes JMP 0000000160429280

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet                                                                      0000000074588834 5 bytes JMP 0000000160429328

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgW                                                                                                                                                                    00000000753830cf 5 bytes JMP 000000016042966c

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgA                                                                                                                                                                    00000000753834de 5 bytes JMP 0000000160429738

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW                                                                                                                                                                00000000753aed29 5 bytes JMP 00000001604295c8

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!recv                                                                                                                                                                           000000007630343a 6 bytes JMP 71a60f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSASend                                                                                                                                                                        0000000076304496 6 bytes JMP 71a30f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!send                                                                                                                                                                           000000007630659b 6 bytes JMP 71a90f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                                                                                                                                                         0000000076308143 6 bytes JMP 71a00f5a

.text     C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                                                                                                                                        0000000076308400 6 bytes JMP 71ac0f5a
 

---- User IAT/EAT - GMER 2.1 ----
 

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord]                                                                                   [7fef7f5741c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet]                                                                                                [7fef7f55f10] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession]                                                                                         [7fef7f55674] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession]                                                                                       [7fef7f55e2c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload]                                                                                        [7fef7f57f48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion]                                                                                      [7fef7f56a38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId]                                                                                       [7fef7f56ee8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId]                                                                               [7fef7f57b58] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId]                                                                                        [7fef7f57ea0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId]                                                                                [7fef7f578b0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession]                                                                                         [7fef7f54fb4] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId]                                                                                           [7fef7f55d38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString]                                                                                  [7fef7f57584] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
 

---- Kernel code sections - GMER 2.1 ----
 

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                                                                                                                                                          suspicious modification

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                                                                                                                                                          suspicious modification

---- Processes - GMER 2.1 ----
 

Library   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E2F02B9D-85EB-4BDD-9FE7-1DDB8D9D795A}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [308] (Microsoft Malware Protection Engine/Microsoft Corporation)(2014-05-17 06:59:46)            000007fefa190000

Library   \\?\C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\trufos.dll (*** suspicious ***) @ C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [1020] (Trufos API/BitDefender S.R.L.)(2013-07-17 15:10:52)  000007fef5f80000

Library   C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv01_64.key (*** suspicious ***) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [2620] (Individualized Black Box DLL/Microsoft Corporation)(2014-02-02 16:56:14)                                                      000000000ac00000

Library   C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [4748] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52)                                           0000000010000000

Library   C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Hardcopy\hardcopy.exe [4944] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52)                                                       00000000021f0000

Process   C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:58)                                          00000000009f0000

Library   C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52)                                          0000000000750000

Library   C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [3604] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52)                                              0000000010000000

Library   C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [4804] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52)                                              0000000010000000

Library   C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [5616] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52)                              0000000010000000
 

---- EOF - GMER 2.1 ----

So, hoffe, jetzt passt es ...

Adware & Co. deinstallieren

Lade Dir bitte von hier http://deeprybka.trojaner-board.de/b...ninstaller.pngRevo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:
http://deeprybka.trojaner-board.de/b.../revo/add1.png
diesen Zusatz haben:
http://deeprybka.trojaner-board.de/b...e/revo/att.PNG
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
http://deeprybka.trojaner-board.de/b.../uninstall.PNG http://deeprybka.trojaner-board.de/b...o/moderat2.PNG
Reste löschen:
Klicke auf http://deeprybka.trojaner-board.de/b.../selectall.PNG dann auf http://deeprybka.trojaner-board.de/b...evo/delete.PNG und dann auf http://deeprybka.trojaner-board.de/b...evo/weiter.PNG.

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo,
hier die logs:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 22.05.2014

Suchlauf-Zeit: 19:41:48

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.05.22.08

Rootkit Datenbank: v2014.05.21.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows Vista Service Pack 2

CPU: x64

Dateisystem: NTFS

Benutzer: Dirk
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 391051

Verstrichene Zeit: 32 Min, 8 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Warnen

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 6

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709], 

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709], 

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709], 

PUP.Optional.FreeCauseTB.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FREECAUSE\Toolbars, Keine Aktion durch Benutzer, [e18f59fb6615082eb6f65347c43e15eb], 

PUP.Optional.FreeCauseTB.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FREECAUSE\Toolbars, Keine Aktion durch Benutzer, [afc1a1b343383ff7a3090f8b17ebfb05], 

PUP.Optional.FreeCauseTB.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FREECAUSE\Toolbars, Keine Aktion durch Benutzer, [f17fafa53249b2846448831722e0c040], 
 

Registrierungswerte: 6

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{043C5167-00BB-4324-AF7E-62013FAEDACF}, å?§Ð¼Â»ä?¤çº¯Å¢ê¸¿ì¿?, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709]

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{043C5167-00BB-4324-AF7E-62013FAEDACF}, å?§Ð¼Â»ä?¤çº¯Å¢ê¸¿ì¿?, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709]

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{043C5167-00BB-4324-AF7E-62013FAEDACF}, å?§Ð¼Â»ä?¤çº¯Å¢ê¸¿ì¿?, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709]

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [7ef284d0e4975ed8fcb9c7628a78fa06], 

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [5818fe563b40b4825d58ec3d6e945ba5], 

PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [7cf497bdadce171fcbea0b1e30d2da26], 
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 0

(No malicious items detected)
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Code:

# AdwCleaner v3.210 - Bericht erstellt am 22/05/2014 um 20:57:48

# Aktualisiert 19/05/2014 von Xplode

# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)

# Benutzername : Dirk - JOKER

# Gestartet von : C:\Users\Dirk\Desktop\Beseitigung von FBDownloader\adwcleaner_3.210.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
 

***** [ Browser ] *****
 

-\\ Internet Explorer v9.0.8112.16545
 
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht [Search Provider] : hxxp://wisersearch.com/search.php?channel=de&q={searchTerms}

Gelöscht [Search Provider] : hxxp://lavasoft.blekko.com/ws/?source=f439e2c0&tbp=rbox&toolbarid=adawaretb&u=F573A8927EB76E2851AE0D511F4E36C0&q={searchTerms}

Gelöscht [Startup_urls] : hxxp://wisersearch.com/?channel=de
 

*************************
 

AdwCleaner[R0].txt - [11152 octets] - [11/01/2014 11:32:14]

AdwCleaner[R1].txt - [1310 octets] - [11/01/2014 13:42:46]

AdwCleaner[R2].txt - [1162 octets] - [11/01/2014 16:11:01]

AdwCleaner[R3].txt - [1243 octets] - [11/01/2014 22:58:08]

AdwCleaner[R4].txt - [1363 octets] - [12/01/2014 12:14:55]

AdwCleaner[R5].txt - [1334 octets] - [12/01/2014 13:10:52]

AdwCleaner[R6].txt - [2196 octets] - [18/01/2014 11:11:17]

AdwCleaner[R7].txt - [1575 octets] - [18/01/2014 16:08:38]

AdwCleaner[R8].txt - [2805 octets] - [17/05/2014 11:04:35]

AdwCleaner[R9].txt - [2160 octets] - [22/05/2014 20:42:54]

AdwCleaner[S0].txt - [10522 octets] - [11/01/2014 11:34:43]

AdwCleaner[S1].txt - [1371 octets] - [11/01/2014 13:46:58]

AdwCleaner[S2].txt - [1224 octets] - [11/01/2014 16:12:43]

AdwCleaner[S3].txt - [1305 octets] - [11/01/2014 22:59:59]

AdwCleaner[S4].txt - [1396 octets] - [12/01/2014 13:13:10]

AdwCleaner[S5].txt - [2267 octets] - [18/01/2014 11:14:00]

AdwCleaner[S6].txt - [3118 octets] - [17/05/2014 11:21:10]

AdwCleaner[S7].txt - [2081 octets] - [22/05/2014 20:57:48]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [2141 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows (TM) Vista Home Premium x64

Ran by Dirk on 22.05.2014 at 21:13:50,06

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 22.05.2014 at 21:24:50,85

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014

Ran by Dirk (administrator) on JOKER on 22-05-2014 21:27:17

Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe

(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe

(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(The Eraser Project) C:\Program Files\Eraser\Eraser.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe

(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe

(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Windows\ehome\ehsched.exe

(Microsoft Corporation) C:\Windows\System32\mobsync.exe

() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe

(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)

HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()

HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)

HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)

HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe

HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK

ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)

Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk

ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} -  No File

DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab

DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab

Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} -  No File

Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)

Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]

FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]

FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR StartupUrls: "https://www.google.de/",

                        "hxxp://www.google.com"

CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File

CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File

CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File

CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File

CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File

CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File

CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]

CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)

S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)

R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)

R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()

R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)

R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)

S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)

S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)

S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)

R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)

R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)

R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)

R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]

S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt

2014-05-22 21:01 - 2014-05-22 21:01 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

2014-05-22 19:40 - 2014-05-22 20:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-05-22 19:39 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk

2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable

2014-05-17 11:43 - 2014-05-22 21:27 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-05-17 10:45 - 2014-05-22 21:27 - 00000000 ____D () C:\FRST

2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-05-14 12:10 - 2014-05-22 20:59 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus

2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft

2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft

2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft

2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe

2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk

2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk

2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
 

==================== One Month Modified Files and Folders =======
 

2014-05-22 21:27 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

2014-05-22 21:27 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST

2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt

2014-05-22 21:09 - 2009-09-09 20:59 - 01154858 _____ () C:\Windows\WindowsUpdate.log

2014-05-22 21:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-22 21:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job

2014-05-22 21:06 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job

2014-05-22 21:02 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-05-22 21:01 - 2014-05-22 21:01 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

2014-05-22 21:01 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection

2014-05-22 21:01 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-22 21:01 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat

2014-05-22 21:01 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001

2014-05-22 20:59 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2014-05-22 20:59 - 2008-01-21 05:26 - 00302744 _____ () C:\Windows\PFRO.log

2014-05-22 20:59 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-22 20:59 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-22 20:59 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-22 20:58 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-05-22 20:57 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner

2014-05-22 20:38 - 2014-05-22 19:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-05-22 20:32 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser

2014-05-22 20:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-01-12 12:23 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Malwarebytes

2014-05-22 19:39 - 2014-01-12 12:22 - 00000947 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-05-22 19:39 - 2014-01-12 12:22 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk

2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-05-19 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job

2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp

2014-05-17 14:40 - 2013-04-17 19:55 - 00000000 ____D () C:\Windows\Minidump

2014-05-17 14:40 - 2013-04-17 19:54 - 636590701 _____ () C:\Windows\MEMORY.DMP

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable

2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk

2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager

2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus

2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft

2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus

2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft

2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft

2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe

2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft

2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3

2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB

2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB

2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk

2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk

2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA

2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core

2014-05-12 07:26 - 2014-05-22 19:39 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-05-12 07:26 - 2014-05-22 19:39 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-05-12 07:25 - 2014-01-12 12:22 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball

2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java
 

Some content of TEMP:

====================

C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe

C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll

C:\Users\Dirk\AppData\Local\Temp\avgnt.exe

C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe

C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE

C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe

C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll

C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe

C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe

C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll

C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll

C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe

C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe

C:\Users\Dirk\AppData\Local\Temp\ose00000.exe

C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe

C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe

C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe

C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe

C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe

C:\Users\Dirk\AppData\Local\Temp\tbWise.dll

C:\Users\Dirk\AppData\Local\Temp\unwise.exe

C:\Users\Dirk\AppData\Local\Temp\Update.exe

C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe

C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe

C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe

C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll

C:\Users\Jutta\AppData\Local\Temp\avgnt.exe

C:\Users\Lisa\AppData\Local\Temp\avgnt.exe

C:\Users\Nils\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-22 21:07
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Hab das Addition log auch noch mal dabei

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014

Ran by Dirk at 2014-05-22 21:27:55

Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}

AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

1&1 Upload-Manager (HKLM-x32\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)

64 Bit HP CIO Components Installer (Version: 3.2.1 - Hewlett-Packard) Hidden

7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)

Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)

AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden

AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden

Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)

Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden

ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net)

AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version:  - )

AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version:  - )

AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version:  - AVM Berlin)

BufferChm (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

C309a (x32 Version: 120.0.202.000 - Hewlett-Packard) Hidden

calibre 64bit (HKLM\...\{1BC00DD4-173E-4325-BDB7-48A076DFC1EF}) (Version: 1.29.0 - Kovid Goyal)

Camera Support Core Library (x32 Version: 7.2.0.4 - Canon) Hidden

Camera Window DS (x32 Version: 5.1 - Canon) Hidden

Camera Window DVC (x32 Version: 5.1 - Canon) Hidden

Camera Window MC (x32 Version: 5.1 - Canon) Hidden

Canon Camera Support Core Library (HKLM-x32\...\InstallShield_{5662C158-CA24-4228-BF6C-596FADA08682}) (Version: 7.2.0.4 - Canon)

Canon Camera WIA Driver (x32 Version: 5.6 - Canon) Hidden

Canon Camera Window DS for ZoomBrowser EX (HKLM-x32\...\InstallShield_{7B847C9D-6758-45E6-B598-3BD8F43EAE9E}) (Version: 5.1 - Canon)

Canon Camera Window DVC for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A70D14C6-FF2C-4B8E-A643-7E74EC607614}) (Version: 5.1 - Canon)

Canon Camera Window for ZoomBrowser EX (HKLM-x32\...\InstallShield_{E73534D5-CC93-4C63-9072-5A9734255C74}) (Version: 5.1 - Canon)

Canon EOS Kiss_N REBEL_XT 350D WIA-Treiber (HKLM-x32\...\InstallShield_{33CF7CDF-9805-4500-9CC7-D19D52AD63C4}) (Version: 5.6 - Canon)

Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\InstallShield_{954BF446-BBC9-42CC-87A6-EBF0D55CA19A}) (Version: 1.3.4 - Canon Inc.)

Canon PhotoRecord (HKLM-x32\...\{862983D7-FA08-493E-A9ED-6B7859E069D3}) (Version: 02.02.01000 - Cisra)

Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A0F34E4E-25F0-4B68-AE8F-EF0C15CB1FED}) (Version: 2.0 - Canon)

Canon RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{28291BD5-92D2-4685-82DC-CCA925C53CCA}) (Version: 1.1 - Canon)

Canon Utilities Digital Photo Professional 3.4 (HKLM-x32\...\DPP) (Version: 3.4.1.1 - )

Canon Utilities EOS Capture 1.3 (HKLM-x32\...\InstallShield_{16480125-0428-4097-9A2A-74464004D169}) (Version: 1.3 - Canon)

Canon Utilities PhotoStitch 3.1 (HKLM-x32\...\InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}) (Version: 3.1.14 - Canon)

Canon ZoomBrowser EX (HKLM-x32\...\{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}) (Version: 5.00.0000 - Canon)

CyberLink PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.3.5711.0 - CyberLink Corp.)

Destination Component (x32 Version: 110.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 3.0.0.0 - devolo AG)

dLAN Cockpit (HKLM-x32\...\Cockpit.92121A72F826FA9D0BD3A830E7F04987B31AFB22.1) (Version: 3 (23.12.2010) - devolo AG)

dLAN Cockpit (x32 Version: 3.23.12 - devolo AG) Hidden

DocProc (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

DVDFab 8.0.7.3 (29/01/2011) (HKLM-x32\...\DVDFab 8_is1) (Version:  - Fengtao Software Inc.)

EASEUS Data Recovery Wizard Free Edition 5.5.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Free Edition 5.5.1_is1) (Version:  - EASEUS)

ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.20140114 - Landesfinanzdirektion Thüringen)

ElsterFormular 2007/2008 (HKLM-x32\...\{5BA43E5C-66FD-48D2-AB40-B807D457EF83}) (Version: 9.6.2.0 NE - Steuerverwaltung des Bundes und der Länder)

ElsterFormular 2008/2009 (HKLM-x32\...\{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}) (Version: 10.3.2.0 - Steuerverwaltung des Bundes und der Länder)

EOS Capture 1.3 (x32 Version: 1.3 - Canon) Hidden

Eraser 5.8.7 (HKLM\...\{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1) (Version: Eraser 5.8.7 - The Eraser Project)

fassurun 2013.11.07.203951 (HKLM\...\fassurun) (Version: 2013.11.07.203951 - fassurun) <==== ATTENTION

Fax (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Free Download Manager 3.9.2 (HKLM-x32\...\Free Download Manager_is1) (Version:  - FreeDownloadManager.ORG)

FRITZ!DSL64 (HKLM\...\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}) (Version: 2.04.03 - AVM Berlin)

Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)

Google Chrome Frame (HKLM-x32\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)

Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden

GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

Hardcopy (C:\Program Files (x86)\Hardcopy) (HKLM-x32\...\Hardcopy(C__Program Files (x86)_Hardcopy)) (Version: 17.0.18 - www.hardcopy.de)

Hauppauge MCE XP/Vista Software Encoder (2.0.27022) (HKLM-x32\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.27022 - Hauppauge Computer Works, Inc.)

HP Customer Participation Program 12.0 (HKLM\...\HPExtendedCapabilities) (Version: 12.0 - HP)

HP Imaging Device Functions 12.0 (HKLM\...\HP Imaging Device Functions) (Version: 12.0 - HP)

HP Photosmart C309a All-In-One Driver Software 12.0 Rel .5 (HKLM\...\{2D250E57-9890-44a6-B08F-5C02C991EF24}) (Version: 12.0 - HP)

HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)

HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)

HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Update (HKLM-x32\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)

HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden

HPPhotoGadget (x32 Version: 120.0.150.000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

HPSSupply (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden

ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.2.0 - LIGHTNING UK!)

Internet Library (x32 Version: 1.3.4 - Canon Inc.) Hidden

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)

J2SE Runtime Environment 5.0 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

KeePass Password Safe 2.10 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version:  - Dominik Reichl)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

MarketResearch (x32 Version: 120.0.226.000 - Hewlett-Packard) Hidden

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Core Components (x64) ENU  (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden

MSVCSetup (x32 Version: 1.00.0000 - HP) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Nero 9 Essentials (HKLM-x32\...\{801189ff-e34f-423a-9f10-b423502b163f}) (Version:  - Nero AG)

Nero BurnRights (x32 Version: 3.4.10.100 - Nero AG) Hidden

Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden

Nero CoverDesigner (x32 Version: 4.4.9.202 - Nero AG) Hidden

Nero CoverDesigner Help (x32 Version: 4.4.6.100 - Nero AG) Hidden

Nero DiscSpeed (x32 Version: 5.4.10.100 - Nero AG) Hidden

Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden

Nero DriveSpeed (x32 Version: 4.4.10.100 - Nero AG) Hidden

Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden

Nero InfoTool (x32 Version: 6.4.10.100 - Nero AG) Hidden

Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden

Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden

Nero StartSmart (x32 Version: 9.4.11.201 - Nero AG) Hidden

Nero StartSmart Help (x32 Version: 9.4.1.100 - Nero AG) Hidden

Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Network64 (Version: 120.0.194.000 - Hewlett-Packard) Hidden

NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden

OCR Software by I.R.I.S. 12.0 (HKLM\...\HPOCR) (Version: 12.0 - HP)

OpenOffice.org 3.1 (HKLM-x32\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)

Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)

PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)

PDF Editor 2 (HKLM-x32\...\PDF Editor 2) (Version:  - )

PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)

Phase 5 HTML-Editor (HKLM-x32\...\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}) (Version: 5.6.2 - Systemberatung Schommer)

PhotoStitch (x32 Version: 3.1.14 - Canon) Hidden

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)

ProgDVB x64 (HKLM\...\ProgDVB) (Version: 6.9x - Prog)

PS_AIO_05_C309_Software_Min (x32 Version: 120.0.206.000 - Hewlett-Packard) Hidden

PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden

RAW Image Task 2.0 (x32 Version: 2.0 - Canon) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5874 - Realtek Semiconductor Corp.)

RemoteCapture Task 1.1 (x32 Version: 1.1 - Canon) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Scan (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 12 - HP)

SIS-Handball 3.9 (HKLM-x32\...\SIS-Handball) (Version: 3.9 - GateCom GmbH)

Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden

SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden

Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)

St. Louis Rams Toolbar (HKLM-x32\...\St. Louis Rams Toolbar) (Version: 1.514 - )

Status (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 4.0.0.0 - Stellar Information Systems Ltd)

SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)

SystemDiagnostics (HKLM-x32\...\{80B0B731-5FAE-475D-8844-20F46373780D}) (Version: 3.02.0010 - Fujitsu Technology Solutions)

teXXas (HKLM-x32\...\{F3DCD04C-BE9C-408C-BC8C-B77AF972DBC2}) (Version: 1 - metaspinner net GmbH)

TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Toolbox (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

TrayApp (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)

WebReg (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden

Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Live OneCare safety scanner (HKLM-x32\...\Windows Live OneCare safety scanner) (Version:  - Microsoft Corporation)

Windows Live OneCare safety scanner (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)

Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

XP Codec Pack (HKLM-x32\...\XP Codec Pack) (Version:  - )
 

==================== Restore Points  =========================
 

16-04-2014 15:01:22 Windows Update

27-04-2014 09:58:17 Installed Java 7 Update 55

27-04-2014 10:05:33 Removed Java 7 Update 55

27-04-2014 10:17:56 Installed Java 7 Update 55

12-05-2014 15:12:38 Windows Update

12-05-2014 18:07:07 OpenOffice.org 3.1 wird entfernt

12-05-2014 18:13:37 AA11

14-05-2014 10:04:25 AA11

14-05-2014 11:40:48 Windows Update

14-05-2014 12:43:05 Windows Update

20-05-2014 20:37:28 Windows Update

22-05-2014 17:30:17 Revo Uninstaller's restore point - pdfforge Toolbar v4.6

22-05-2014 17:31:06 Removed pdfforge Toolbar v4.6.
 

==================== Hosts content: ==========================
 

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

::1             localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {01503B02-7AF4-4ED7-9E3F-97049297213F} - System32\Tasks\{B7B91C77-1E48-44BE-8E9F-FC08EE02125A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages

Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)

Task: {5E551E2D-6024-438A-B6BB-4BD2C63E230F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)

Task: {6A3BC972-B370-45E3-AD15-370CFD3EE8F9} - System32\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F} => C:\Program Files\V-bates\PrefHelper.exe

Task: {7A936888-6D24-4B69-9A45-EAEA6C3F1EFF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)

Task: {7BA40AA9-D6BC-4D03-A0C0-398717389FC7} - System32\Tasks\{F7A8E834-BD3C-4504-885B-1E637D64FEC7} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)

Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI

Task: {8CFE1E32-B04E-456C-989C-1AA1556BE805} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)

Task: {B384F716-A243-4440-91D6-34FA3643F784} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)

Task: {BF328AF9-E972-4814-BA2B-8955BE07E803} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)

Task: {E3891FA7-79D4-4A37-A8CC-B7D9ADEDDCEC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)

Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job => C:\Program Files\V-bates\PrefHelper.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2009-11-19 19:34 - 2006-02-23 13:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll

2009-11-19 19:34 - 2006-02-22 12:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll

2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe

2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll

2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll

2009-10-03 10:51 - 2008-12-02 14:21 - 00041984 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_ex.exe

2009-10-03 10:51 - 2009-06-10 06:19 - 00057856 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_x64.dll

2012-12-21 19:33 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2009-10-03 10:51 - 2009-09-25 16:50 - 00445440 _____ () C:\Program Files (x86)\Hardcopy\HcDllS.dll

2009-10-03 10:51 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files (x86)\Hardcopy\hardcopy_02.dll

2009-10-03 10:51 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_Win32.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:A8665DF4
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\startupfolder: C:^Users^Dirk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: BDRegion => "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"

MSCONFIG\startupreg: Google EULA Launcher => c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA

MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup

MSCONFIG\startupreg: NokiaMusic FastStart => "C:\Program Files (x86)\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart

MSCONFIG\startupreg: NokiaOviSuite2 => C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray

MSCONFIG\startupreg: RemoteControl => "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized

MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

MSCONFIG\startupreg: WMPNSCFG => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
 

==================== Faulty Device Manager Devices =============
 

Name: NVIDIA nForce 10/100/1000 Mbps Ethernet 

Description: NVIDIA nForce 10/100/1000 Mbps Ethernet 

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: NVIDIA

Service: NVENETFD

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: Photosmart C309a series

Description: Photosmart C309a series

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================

Error: (05/01/2014 07:39:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 36965 seconds with 180 seconds of active time.  This session ended with a crash.
 

Error: (03/12/2014 07:08:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (02/03/2014 07:02:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2689 seconds with 600 seconds of active time.  This session ended with a crash.
 

Error: (02/16/2013 02:55:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/22/2012 09:18:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/09/2012 10:54:19 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/09/2012 10:54:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/09/2012 00:55:39 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/06/2012 11:28:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 43 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (05/31/2012 08:02:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-22 21:27:48.128

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:47.715

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:47.311

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:46.895

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:46.486

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:46.075

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:45.663

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:45.250

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:44.725

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-22 21:27:44.317

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 43%

Total physical RAM: 4094.32 MB

Available physical RAM: 2305.5 MB

Total Pagefile: 8399.91 MB

Available Pagefile: 6332.27 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (SYSTEM) (Fixed) (Total:164.75 GB) (Free:34.43 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive e: (DATA) (Fixed) (Total:1220.5 GB) (Free:761.28 GB) NTFS

Drive y: (Two-Face) (Removable) (Total:14.89 GB) (Free:13.49 GB) exFAT
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1397 GB) (Disk ID: FCD6DD83)

Partition 1: (Not Active) - (Size=12 GB) - (Type=27)

Partition 2: (Active) - (Size=165 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=-888516751360) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: 98720C68)

Partition 1: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

hier ist noch ein eintrag mit attention, "fassurun", hab ich mit dem removal tool nicht löschen können.

Gruß Dirk

den entfernen wir gleich.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=bed5156fbeb1874eb627723532df5211

# engine=18384

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-05-23 07:29:57

# local_time=2014-05-23 09:29:57 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1799 16775165 100 96 13797 266296687 6543 0

# compatibility_mode=5892 16776637 100 100 13285 238397303 0 0

# scanned=355098

# found=35

# cleaned=0

# scan_time=12444

sh=14C1DC5CB0CF73A42866AEA0A07B0A754C84F6B9 ft=1 fh=7b8fdf4e16867ebd vn="Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\adawaretb\adawareDx.dll.vir"

sh=632FB41B95FBFF1B14048B2DC0512520DD794583 ft=1 fh=7b1f3132515a2652 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\adawaretb\adawaretb.dll.vir"

sh=6E6B9D9B42A510193E815990C05C757BBC9DE99E ft=1 fh=601943b04511081d vn="Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\adawaretb\dtUser.exe.vir"

sh=DF68D276645E6BD84FA1D5CA6F40301F4F74722A ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\hjeglkhenpckoocpnajnnmcehdkcemnm.crx.vir"

sh=C785BFADB201A3E9648BC85FDCD939C959525611 ft=1 fh=eb223665b336f871 vn="Variante von Win32/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\updatefassurun.exe.vir"

sh=C785BFADB201A3E9648BC85FDCD939C959525611 ft=1 fh=eb223665b336f871 vn="Variante von Win32/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\utilfassurun.exe.vir"

sh=161262BB820AFE2533C600A7D62616F259B89560 ft=1 fh=0714f9176f7719c4 vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\plugins\fassurun.FFUpdate.dll.vir"

sh=8014B8407EF69A368F9403F2D31FA9D66EC0107E ft=1 fh=e315604a317ff947 vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\plugins\fassurun.GCUpdate.dll.vir"

sh=AC59A8E3441B140B4EDA699DEECD781130A704BA ft=1 fh=4bab001eeadbadbc vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\plugins\fassurun.IEUpdate.dll.vir"

sh=4D6BE2A62DD529B6AED8BFC52283C19C0BA71CC1 ft=0 fh=0000000000000000 vn="Win32/PriceGong.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceGong\2.6.8\PriceGong.crx.vir"

sh=AC628759BA6C1F21190629C83CD034BA8BD0285F ft=1 fh=07dc08932a0af165 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceGong\2.6.8\PriceGongIE.dll.vir"

sh=51215C0B894CD4C471AAF522A22EBC00EFB4EBB2 ft=1 fh=0b9d3f2ed4c32b46 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceGong\2.6.8\FF\plugins\npPriceGong_FF.dll.vir"

sh=EA29B6E13129E7213242887BA3D3D81288340303 ft=0 fh=0000000000000000 vn="Win32/PriceGong.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.8_0\pg_background.html.vir"

sh=A1A811D016B52FD3004279CA2EAD58C72B21810A ft=0 fh=0000000000000000 vn="Win32/PriceGong.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.8_0\options\pg_options.html.vir"

sh=48375BB73C670D53620DB2B71E20A6587513D0F3 ft=1 fh=ae8125eb1faea8b5 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.8_0\plugins\npPriceGong_CH.dll.vir"

sh=52BA0F358C884C3D69A9258112DB6FFB1BB3AB18 ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjeglkhenpckoocpnajnnmcehdkcemnm\1.0.0_0\background.js.vir"

sh=83DD0B158F6E6EB53E7824856C671496666FB85C ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjeglkhenpckoocpnajnnmcehdkcemnm\1.0.0_0\content.js.vir"

sh=B5DCA84A35051ABF54282C7CDD058C5B536235D2 ft=1 fh=8d61cd15590d757b vn="Variante von Win32/Toolbar.SearchSuite.L evtl. unerwünschte Anwendung" ac=I fn="C:\Downloads\Software\iMeshSetup-r1482-w-bc.exe"

sh=BCF43267B4416C6DDEFAAD5AE0A63E3F682C5BB0 ft=1 fh=905be375e5c80006 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Downloads\Software\PDFCreator-1_6_2_setup.exe"

sh=77C41FE9D15ADB18C5C91F95FB68F2FB5D80D9B5 ft=1 fh=1dd1b49013d59105 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe"

sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\AppData\Local\Temp\tbWise.dll"

sh=48FD60E5A677BD39B13E0188075E83137005259E ft=1 fh=ff79543ffacc5f95 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\Downloads\PDFCreator-1_2_1_setup.exe"

sh=6CF8A9F031B45F70BE3E66E7ACC7449CDA15FA34 ft=1 fh=2de4b6f517306153 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\Downloads\PDFCreator-1_2_3_setup.exe"

sh=A23519E8073FDB68C377074CFC41DEF71AD03D44 ft=1 fh=ca61199ae536065a vn="Win32/StartPage.OPH Trojaner" ac=I fn="C:\Users\Dirk\Downloads\vlc-2.0.4-win32.exe"

sh=27803401390A1E8A1B467DA4397B3F8720B9C875 ft=1 fh=9507ca016fcdd5db vn="Win32/StartPage.OPH Trojaner" ac=I fn="C:\Users\Dirk\Downloads\vlc-2.0.4-win64.exe"

sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[1]"

sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[2]"

sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[1]"

sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[2]"

sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[1]"

sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[2]"

sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[1]"

sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[2]"

sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Temp\INJ003\ExtensionUpdate.exe"

sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Temp\INJ004\ExtensionUpdate.exe"

Code:

 Results of screen317's Security Check version 0.99.83  

 Windows Vista Service Pack 2 x64 (UAC is enabled)  

 Internet Explorer 9  

 Internet Explorer 8  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop        

Ad-Aware Antivirus   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Java 7 Update 55  

 Adobe Flash Player         13.0.0.214  

 Adobe Reader 9 Adobe Reader out of Date! 

 Adobe Reader 10.1.10 Adobe Reader out of Date!  

 Google Chrome 34.0.1847.131  

 Google Chrome 34.0.1847.137  

 Google Chrome Plugins...  
 ````````Process Check: objlist.exe by Laurent````````  

 Windows Defender MSASCui.exe 

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5354.0\AdAwareService.exe 

 Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5354.0\AdAwareTray.exe 

 Windows Defender MSASCui.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  % 
 ````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014

Ran by Dirk (administrator) on JOKER on 23-05-2014 22:27:40

Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe

(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe

(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(The Eraser Project) C:\Program Files\Eraser\Eraser.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE

(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe

(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Microsoft Corporation) C:\Windows\ehome\ehsched.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe

(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe

(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe

(Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe

(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)

HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()

HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)

HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)

HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe

HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK

ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)

Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk

ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} -  No File

DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab

DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab

Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} -  No File

Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)

Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]

FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]

FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com"

CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File

CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File

CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File

CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File

CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File

CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File

CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]

CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)

R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)

S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)

R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)

R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()

R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)

R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)

S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)

S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)

S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)

R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)

R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)

R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)

R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]

S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-05-23 17:33 - 2014-05-23 17:33 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt

2014-05-22 19:40 - 2014-05-22 20:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-05-22 19:39 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk

2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable

2014-05-17 11:43 - 2014-05-23 22:27 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-05-17 10:45 - 2014-05-23 22:27 - 00000000 ____D () C:\FRST

2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-05-14 12:10 - 2014-05-23 17:32 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus

2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft

2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft

2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft

2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe

2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk

2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk

2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
 

==================== One Month Modified Files and Folders =======
 

2014-05-23 22:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-05-23 22:27 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

2014-05-23 22:27 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST

2014-05-23 22:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-05-23 22:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job

2014-05-23 22:07 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job

2014-05-23 21:30 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-23 21:30 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-23 19:16 - 2009-09-09 20:59 - 01181924 _____ () C:\Windows\WindowsUpdate.log

2014-05-23 17:57 - 2008-01-21 13:10 - 01576088 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-05-23 17:57 - 2008-01-21 13:09 - 00677534 _____ () C:\Windows\system32\perfh007.dat

2014-05-23 17:57 - 2008-01-21 13:09 - 00147046 _____ () C:\Windows\system32\perfc007.dat

2014-05-23 17:35 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-05-23 17:33 - 2014-05-23 17:33 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD

2014-05-23 17:33 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection

2014-05-23 17:33 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-05-23 17:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat

2014-05-23 17:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001

2014-05-23 17:32 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2014-05-23 17:32 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-05-22 21:47 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser

2014-05-22 21:47 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt

2014-05-22 20:59 - 2008-01-21 05:26 - 00302744 _____ () C:\Windows\PFRO.log

2014-05-22 20:57 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner

2014-05-22 20:38 - 2014-05-22 19:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-05-22 19:39 - 2014-01-12 12:23 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Malwarebytes

2014-05-22 19:39 - 2014-01-12 12:22 - 00000947 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-05-22 19:39 - 2014-01-12 12:22 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk

2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-05-19 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job

2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp

2014-05-17 14:40 - 2013-04-17 19:55 - 00000000 ____D () C:\Windows\Minidump

2014-05-17 14:40 - 2013-04-17 19:54 - 636590701 _____ () C:\Windows\MEMORY.DMP

2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable

2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk

2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager

2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT

2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus

2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft

2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus

2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft

2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft

2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe

2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft

2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3

2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB

2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB

2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk

2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk

2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA

2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core

2014-05-12 07:26 - 2014-05-22 19:39 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-05-12 07:26 - 2014-05-22 19:39 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-05-12 07:25 - 2014-01-12 12:22 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball

2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle

2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log

2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java
 

Some content of TEMP:

====================

C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe

C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll

C:\Users\Dirk\AppData\Local\Temp\avgnt.exe

C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe

C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE

C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe

C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe

C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll

C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe

C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe

C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe

C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll

C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll

C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe

C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe

C:\Users\Dirk\AppData\Local\Temp\ose00000.exe

C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe

C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe

C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe

C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe

C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe

C:\Users\Dirk\AppData\Local\Temp\tbWise.dll

C:\Users\Dirk\AppData\Local\Temp\unwise.exe

C:\Users\Dirk\AppData\Local\Temp\Update.exe

C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe

C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe

C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe

C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll

C:\Users\Jutta\AppData\Local\Temp\avgnt.exe

C:\Users\Lisa\AppData\Local\Temp\avgnt.exe

C:\Users\Nils\AppData\Local\Temp\avgnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-05-23 17:48
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014

Ran by Dirk at 2014-05-23 22:28:42

Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}

AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
 

==================== Installed Programs ======================
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

1&1 Upload-Manager (HKLM-x32\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)

64 Bit HP CIO Components Installer (Version: 3.2.1 - Hewlett-Packard) Hidden

7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)

Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)

AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden

AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden

Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0 - Adobe Systems Incorporated)

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)

Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)

Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden

ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net)

AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)

AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version:  - )

AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version:  - )

AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version:  - AVM Berlin)

BufferChm (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

C309a (x32 Version: 120.0.202.000 - Hewlett-Packard) Hidden

calibre 64bit (HKLM\...\{1BC00DD4-173E-4325-BDB7-48A076DFC1EF}) (Version: 1.29.0 - Kovid Goyal)

Camera Support Core Library (x32 Version: 7.2.0.4 - Canon) Hidden

Camera Window DS (x32 Version: 5.1 - Canon) Hidden

Camera Window DVC (x32 Version: 5.1 - Canon) Hidden

Camera Window MC (x32 Version: 5.1 - Canon) Hidden

Canon Camera Support Core Library (HKLM-x32\...\InstallShield_{5662C158-CA24-4228-BF6C-596FADA08682}) (Version: 7.2.0.4 - Canon)

Canon Camera WIA Driver (x32 Version: 5.6 - Canon) Hidden

Canon Camera Window DS for ZoomBrowser EX (HKLM-x32\...\InstallShield_{7B847C9D-6758-45E6-B598-3BD8F43EAE9E}) (Version: 5.1 - Canon)

Canon Camera Window DVC for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A70D14C6-FF2C-4B8E-A643-7E74EC607614}) (Version: 5.1 - Canon)

Canon Camera Window for ZoomBrowser EX (HKLM-x32\...\InstallShield_{E73534D5-CC93-4C63-9072-5A9734255C74}) (Version: 5.1 - Canon)

Canon EOS Kiss_N REBEL_XT 350D WIA-Treiber (HKLM-x32\...\InstallShield_{33CF7CDF-9805-4500-9CC7-D19D52AD63C4}) (Version: 5.6 - Canon)

Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\InstallShield_{954BF446-BBC9-42CC-87A6-EBF0D55CA19A}) (Version: 1.3.4 - Canon Inc.)

Canon PhotoRecord (HKLM-x32\...\{862983D7-FA08-493E-A9ED-6B7859E069D3}) (Version: 02.02.01000 - Cisra)

Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A0F34E4E-25F0-4B68-AE8F-EF0C15CB1FED}) (Version: 2.0 - Canon)

Canon RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{28291BD5-92D2-4685-82DC-CCA925C53CCA}) (Version: 1.1 - Canon)

Canon Utilities Digital Photo Professional 3.4 (HKLM-x32\...\DPP) (Version: 3.4.1.1 - )

Canon Utilities EOS Capture 1.3 (HKLM-x32\...\InstallShield_{16480125-0428-4097-9A2A-74464004D169}) (Version: 1.3 - Canon)

Canon Utilities PhotoStitch 3.1 (HKLM-x32\...\InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}) (Version: 3.1.14 - Canon)

Canon ZoomBrowser EX (HKLM-x32\...\{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}) (Version: 5.00.0000 - Canon)

CyberLink PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.3.5711.0 - CyberLink Corp.)

Destination Component (x32 Version: 110.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 3.0.0.0 - devolo AG)

dLAN Cockpit (HKLM-x32\...\Cockpit.92121A72F826FA9D0BD3A830E7F04987B31AFB22.1) (Version: 3 (23.12.2010) - devolo AG)

dLAN Cockpit (x32 Version: 3.23.12 - devolo AG) Hidden

DocProc (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

DVDFab 8.0.7.3 (29/01/2011) (HKLM-x32\...\DVDFab 8_is1) (Version:  - Fengtao Software Inc.)

EASEUS Data Recovery Wizard Free Edition 5.5.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Free Edition 5.5.1_is1) (Version:  - EASEUS)

ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.20140114 - Landesfinanzdirektion Thüringen)

ElsterFormular 2007/2008 (HKLM-x32\...\{5BA43E5C-66FD-48D2-AB40-B807D457EF83}) (Version: 9.6.2.0 NE - Steuerverwaltung des Bundes und der Länder)

ElsterFormular 2008/2009 (HKLM-x32\...\{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}) (Version: 10.3.2.0 - Steuerverwaltung des Bundes und der Länder)

EOS Capture 1.3 (x32 Version: 1.3 - Canon) Hidden

Eraser 5.8.7 (HKLM\...\{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1) (Version: Eraser 5.8.7 - The Eraser Project)

fassurun 2013.11.07.203951 (HKLM\...\fassurun) (Version: 2013.11.07.203951 - fassurun) <==== ATTENTION

Fax (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Free Download Manager 3.9.2 (HKLM-x32\...\Free Download Manager_is1) (Version:  - FreeDownloadManager.ORG)

FRITZ!DSL64 (HKLM\...\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}) (Version: 2.04.03 - AVM Berlin)

Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)

Google Chrome Frame (HKLM-x32\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)

Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden

GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

Hardcopy (C:\Program Files (x86)\Hardcopy) (HKLM-x32\...\Hardcopy(C__Program Files (x86)_Hardcopy)) (Version: 17.0.18 - www.hardcopy.de)

Hauppauge MCE XP/Vista Software Encoder (2.0.27022) (HKLM-x32\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.27022 - Hauppauge Computer Works, Inc.)

HP Customer Participation Program 12.0 (HKLM\...\HPExtendedCapabilities) (Version: 12.0 - HP)

HP Imaging Device Functions 12.0 (HKLM\...\HP Imaging Device Functions) (Version: 12.0 - HP)

HP Photosmart C309a All-In-One Driver Software 12.0 Rel .5 (HKLM\...\{2D250E57-9890-44a6-B08F-5C02C991EF24}) (Version: 12.0 - HP)

HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)

HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)

HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Update (HKLM-x32\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)

HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden

HPPhotoGadget (x32 Version: 120.0.150.000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden

HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden

HPSSupply (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden

ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.2.0 - LIGHTNING UK!)

Internet Library (x32 Version: 1.3.4 - Canon Inc.) Hidden

IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)

J2SE Runtime Environment 5.0 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden

KeePass Password Safe 2.10 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version:  - Dominik Reichl)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

MarketResearch (x32 Version: 120.0.226.000 - Hewlett-Packard) Hidden

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Core Components (x64) ENU  (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden

MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden

MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden

MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden

MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden

MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden

MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden

MSVCSetup (x32 Version: 1.00.0000 - HP) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Nero 9 Essentials (HKLM-x32\...\{801189ff-e34f-423a-9f10-b423502b163f}) (Version:  - Nero AG)

Nero BurnRights (x32 Version: 3.4.10.100 - Nero AG) Hidden

Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden

Nero CoverDesigner (x32 Version: 4.4.9.202 - Nero AG) Hidden

Nero CoverDesigner Help (x32 Version: 4.4.6.100 - Nero AG) Hidden

Nero DiscSpeed (x32 Version: 5.4.10.100 - Nero AG) Hidden

Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden

Nero DriveSpeed (x32 Version: 4.4.10.100 - Nero AG) Hidden

Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden

Nero InfoTool (x32 Version: 6.4.10.100 - Nero AG) Hidden

Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden

Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden

Nero StartSmart (x32 Version: 9.4.11.201 - Nero AG) Hidden

Nero StartSmart Help (x32 Version: 9.4.1.100 - Nero AG) Hidden

Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Network64 (Version: 120.0.194.000 - Hewlett-Packard) Hidden

NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)

NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden

OCR Software by I.R.I.S. 12.0 (HKLM\...\HPOCR) (Version: 12.0 - HP)

OpenOffice.org 3.1 (HKLM-x32\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)

Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)

PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)

PDF Editor 2 (HKLM-x32\...\PDF Editor 2) (Version:  - )

PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)

Phase 5 HTML-Editor (HKLM-x32\...\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}) (Version: 5.6.2 - Systemberatung Schommer)

PhotoStitch (x32 Version: 3.1.14 - Canon) Hidden

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)

ProgDVB x64 (HKLM\...\ProgDVB) (Version: 6.9x - Prog)

PS_AIO_05_C309_Software_Min (x32 Version: 120.0.206.000 - Hewlett-Packard) Hidden

PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden

RAW Image Task 2.0 (x32 Version: 2.0 - Canon) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5874 - Realtek Semiconductor Corp.)

RemoteCapture Task 1.1 (x32 Version: 1.1 - Canon) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Scan (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 12 - HP)

SIS-Handball 3.9 (HKLM-x32\...\SIS-Handball) (Version: 3.9 - GateCom GmbH)

Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden

SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden

Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)

St. Louis Rams Toolbar (HKLM-x32\...\St. Louis Rams Toolbar) (Version: 1.514 - )

Status (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 4.0.0.0 - Stellar Information Systems Ltd)

SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)

SystemDiagnostics (HKLM-x32\...\{80B0B731-5FAE-475D-8844-20F46373780D}) (Version: 3.02.0010 - Fujitsu Technology Solutions)

teXXas (HKLM-x32\...\{F3DCD04C-BE9C-408C-BC8C-B77AF972DBC2}) (Version: 1 - metaspinner net GmbH)

TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Toolbox (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

TrayApp (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)

WebReg (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden

Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Live OneCare safety scanner (HKLM-x32\...\Windows Live OneCare safety scanner) (Version:  - Microsoft Corporation)

Windows Live OneCare safety scanner (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)

Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

XP Codec Pack (HKLM-x32\...\XP Codec Pack) (Version:  - )
 

==================== Restore Points  =========================
 

16-04-2014 15:01:22 Windows Update

27-04-2014 09:58:17 Installed Java 7 Update 55

27-04-2014 10:05:33 Removed Java 7 Update 55

27-04-2014 10:17:56 Installed Java 7 Update 55

12-05-2014 15:12:38 Windows Update

12-05-2014 18:07:07 OpenOffice.org 3.1 wird entfernt

12-05-2014 18:13:37 AA11

14-05-2014 10:04:25 AA11

14-05-2014 11:40:48 Windows Update

14-05-2014 12:43:05 Windows Update

20-05-2014 20:37:28 Windows Update

22-05-2014 17:30:17 Revo Uninstaller's restore point - pdfforge Toolbar v4.6

22-05-2014 17:31:06 Removed pdfforge Toolbar v4.6.
 

==================== Hosts content: ==========================
 

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

::1             localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {01503B02-7AF4-4ED7-9E3F-97049297213F} - System32\Tasks\{B7B91C77-1E48-44BE-8E9F-FC08EE02125A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages

Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)

Task: {2AADFD7A-5B44-4E29-BEB4-46715EFFAD16} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)

Task: {5E551E2D-6024-438A-B6BB-4BD2C63E230F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)

Task: {6A3BC972-B370-45E3-AD15-370CFD3EE8F9} - System32\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F} => C:\Program Files\V-bates\PrefHelper.exe

Task: {7A936888-6D24-4B69-9A45-EAEA6C3F1EFF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)

Task: {7BA40AA9-D6BC-4D03-A0C0-398717389FC7} - System32\Tasks\{F7A8E834-BD3C-4504-885B-1E637D64FEC7} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)

Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI

Task: {8CFE1E32-B04E-456C-989C-1AA1556BE805} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)

Task: {B384F716-A243-4440-91D6-34FA3643F784} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)

Task: {BF328AF9-E972-4814-BA2B-8955BE07E803} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)

Task: {E3891FA7-79D4-4A37-A8CC-B7D9ADEDDCEC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)

Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job => C:\Program Files\V-bates\PrefHelper.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2009-11-19 19:34 - 2006-02-23 13:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll

2009-11-19 19:34 - 2006-02-22 12:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll

2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe

2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll

2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll

2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 02141040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareShellExtension.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 04114264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe

2014-01-23 16:29 - 2014-01-23 16:29 - 00500088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_locale-vc100-mt-1_55.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00361824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\HtmlFramework.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00066904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\DllStorage.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00788848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTrayDefaultSkin.dll

2014-01-23 16:29 - 2014-01-23 16:29 - 00139608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\Localization.dll

2009-10-03 10:51 - 2008-12-02 14:21 - 00041984 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_ex.exe

2009-10-03 10:51 - 2009-06-10 06:19 - 00057856 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_x64.dll

2012-12-21 19:33 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2009-10-03 10:51 - 2009-09-25 16:50 - 00445440 _____ () C:\Program Files (x86)\Hardcopy\HcDllS.dll

2009-10-03 10:51 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files (x86)\Hardcopy\hardcopy_02.dll

2009-10-03 10:51 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_Win32.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:A8665DF4
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== Disabled items from MSCONFIG ==============
 

MSCONFIG\startupfolder: C:^Users^Dirk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: BDRegion => "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"

MSCONFIG\startupreg: Google EULA Launcher => c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA

MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup

MSCONFIG\startupreg: NokiaMusic FastStart => "C:\Program Files (x86)\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart

MSCONFIG\startupreg: NokiaOviSuite2 => C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray

MSCONFIG\startupreg: RemoteControl => "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized

MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

MSCONFIG\startupreg: WMPNSCFG => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Photosmart C309a series

Description: Photosmart C309a series

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (05/23/2014 10:16:24 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.

Die widersprüchlichen Komponenten sind:

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
 

Error: (05/23/2014 05:58:56 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.

Die widersprüchlichen Komponenten sind:

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
 

Error: (05/23/2014 05:58:50 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.

Die widersprüchlichen Komponenten sind:

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
 

Error: (05/23/2014 05:58:49 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.

Die widersprüchlichen Komponenten sind:

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
 

Error: (05/23/2014 05:58:46 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.

Die widersprüchlichen Komponenten sind:

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
 

Error: (05/23/2014 05:34:06 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (05/23/2014 05:35:13 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {7F6316B4-4D69-4765-B0A3-B2598F2FA80A}
 

Error: (05/23/2014 05:34:09 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: i8042prt
 

Error: (05/23/2014 05:34:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Util fassurun%%3
 
 

Microsoft Office Sessions:

=========================

Error: (05/01/2014 07:39:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 36965 seconds with 180 seconds of active time.  This session ended with a crash.
 

Error: (03/12/2014 07:08:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (02/03/2014 07:02:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2689 seconds with 600 seconds of active time.  This session ended with a crash.
 

Error: (02/16/2013 02:55:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/22/2012 09:18:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/09/2012 10:54:19 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (12/09/2012 10:54:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/09/2012 00:55:39 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/06/2012 11:28:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 43 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (05/31/2012 08:02:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-23 22:28:32.102

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:31.722

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:31.206

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:30.832

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:30.449

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:30.082

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:29.697

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:29.339

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:28.727

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2014-05-23 22:28:28.372

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 65%

Total physical RAM: 4094.32 MB

Available physical RAM: 1393.09 MB

Total Pagefile: 8403.91 MB

Available Pagefile: 5684.73 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (SYSTEM) (Fixed) (Total:164.75 GB) (Free:33.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive e: (DATA) (Fixed) (Total:1220.5 GB) (Free:761.28 GB) NTFS

Drive f: (Fiona) (Fixed) (Total:114.44 GB) (Free:43.34 GB) NTFS

Drive y: (Two-Face) (Removable) (Total:14.89 GB) (Free:13.49 GB) exFAT
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1397 GB) (Disk ID: FCD6DD83)

Partition 1: (Not Active) - (Size=12 GB) - (Type=27)

Partition 2: (Active) - (Size=165 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=-888516751360) - (Type=07 NTFS)
 

========================================================

Disk: 5 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: 98720C68)

Partition 1: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
 

========================================================

Disk: 6 (Size: 114 GB) (Disk ID: 8B4E8E83)

Partition 1: (Not Active) - (Size=114 GB) - (Type=07 NTFS)

Partition 2: (Active) - (Size=55 MB) - (Type=83)
 

==================== End Of Log ============================

Fassurun ist noch im Addition Log, fbdownloader noch in Chrome ...

Adobe updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)

Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

:regfind fassurun
Klicke nun auf den Button Look, um den Scan zu starten.
Der Suchlauf kann einige Zeit dauern.
Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Adobe Reader ist aktuell

Hab Chrome de- und wiederinstalliert, nach Anmeldung an Google Konto war fbdownloader wieder da. Nach Browser zurück setzen ist er jetzt weg.
Hierfür schon mal vielen Dank.

Code:

SystemLook 30.07.11 by jpshortstuff

Log created at 22:32 on 24/05/2014 by Dirk

Administrator - Elevation successful
 

========== regfind ==========
 

Searching for "fassurun"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]

@="IfassurunBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]

@="fassurunIEClientLib"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\0\win32]

@="C:\Program Files (x86)\fassurun\fassurunbho.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\HELPDIR]

@="C:\Program Files (x86)\fassurun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]

@="IfassurunBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]

@="fassurunIEClientLib"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\0\win32]

@="C:\Program Files (x86)\fassurun\fassurunbho.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\HELPDIR]

@="C:\Program Files (x86)\fassurun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"DisplayName"="fassurun 2013.11.07.203951"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"UninstallString"="C:\Program Files (x86)\fassurun\fassurununinstall.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"QuietUninstallString"="C:\Program Files (x86)\fassurun\fassurununinstall.exe /S"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"InstallLocation"="C:\Program Files (x86)\fassurun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"DisplayIcon"="C:\Program Files (x86)\fassurun\fassurun.ico"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"Publisher"="fassurun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"HelpLink"="mailto:support@fassurun.co"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"URLUpdateInfo"="hxxp://fassurun.co"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

"URLInfoAbout"="hxxp://fassurun.co/support"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]

@="IfassurunBHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]

@="fassurunIEClientLib"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\0\win32]

@="C:\Program Files (x86)\fassurun\fassurunbho.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\HELPDIR]

@="C:\Program Files (x86)\fassurun"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Update fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Util fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]

"ImagePath"=""C:\Program Files (x86)\fassurun\bin\utilfassurun.exe""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]

"DisplayName"="Util fassurun"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Update fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Util fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]

"ImagePath"=""C:\Program Files (x86)\fassurun\bin\utilfassurun.exe""

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]

"DisplayName"="Util fassurun"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Util fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]

"ImagePath"=""C:\Program Files (x86)\fassurun\bin\utilfassurun.exe""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]

"DisplayName"="Util fassurun"

[HKEY_USERS\S-1-5-21-3839580519-3571548420-1780697189-1000\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]
 

-= EOF =-

Kopiere den Text in der Codebox in deinen Editor (z.B. Notepad) und speichere es unter dem Namen regfix.reg (bei Dateityp bitte "alle Dateien" wählen)

Code:

Windows Registry Editor Version 5.00
 

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Update fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Util fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Update fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Util fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Util fassurun]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]

[-HKEY_USERS\S-1-5-21-3839580519-3571548420-1780697189-1000\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]

Starte die regfix.reg duch Doppelklick.

Hallo,

Probleme sind gelöst.
Herzlichen Dank für deine Zeit.

Viele Grüße und nen schönen Vatertag,
Dirk

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo,

noch mal vielen Dank.

Gruß Dirk