Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Rechner neu aufgesetzt, jetzt viele Spam pop ups und neu Mozilla "Werbe-tabs" ohne eigenes Zutun (https://www.trojaner-board.de/154501-rechner-neu-aufgesetzt-viele-spam-pop-ups-neu-mozilla-werbe-tabs-ohne-eigenes-zutun.html)

magu1961 28.05.2014 20:46
Rechner neu aufgesetzt, jetzt viele Spam pop ups und neu Mozilla "Werbe-tabs" ohne eigenes Zutun
 
Habe Minitower mit Win 7 32bit neu installiert. Von Backup up Laufwerk alle Daten anschließend wieder zurück kopiert (war vielleicht ein Fehler).

Nach 2 Tagen seltsames Verhalten:
- beim Starten von Mozilla Firefox ist Google als Startseite defniert, diese kommt aber nie, sondern alle möglichen anderen Seiten wie zB "hxxp://www.lpmxp22.com" es ist immer ein Werbefenster für PC Bereinigungssoftware enthalten.

- es öffnen sich Fenster bzw. Anwendungen, die ich weder installiert noch gestartet habe, zB ein Fenster das meinen PC scanne will oder ich soll tune up utility gleich kaufen

- auf jedem Tab in Mozilla sind Werbungen eingeblendet, die niemals auf dieser homepage sein können. Bsp: Habe an einer Kundenumfrage von Seat teilgenommen, am Bildschirmrand waren blinkede Werbungen von PC-Bereinigungssoftware eingeblendet. Wenn ich mit der Maus über diesen Bereich drüber fahre OHNE zu klicken, wird der Link in diesem Tab aktiviert und damit die Kundenumfrage unterbrochen. Das würde ein utomobilhersteller nie machen. Also muss an meinem PC was faul sein.

Habe entsprechend der Anleitung mit defogger die emulatoren disabled und die FRST.txt und addition.txt mit angehängt. Bitte um Hilfe und weitere Info.
Bin allerdings die nächsten Tage evtl. unterwegs und kann nicht sofort reagieren.

Vielen Dank
Marco
:dankeschoen:

schrauber 29.05.2014 05:31
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

magu1961 29.05.2014 10:24
FRST.txt:
=========
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by Marco (administrator) on MARCO-PC on 28-05-2014 21:17:06
Running from C:\Users\Marco\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
() C:\Program Files\webget\updatewebget.exe
() C:\Program Files\webget\bin\utilwebget.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
() C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe
(PC Utilities Software Limited) C:\Program Files\Optimizer Pro\OptProSmartScan.exe
(PC Utilities Software Limited) C:\Program Files\Optimizer Pro\OptProReminder.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe
(Nero AG) C:\Program Files\Nero\Update\NASvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM\...\Run: [PMBVolumeWatcher] => C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [599328 2010-03-24] (Sony Corporation)
HKU\S-1-5-21-4000187890-1113432505-3674514099-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4000187890-1113432505-3674514099-1000\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4000187890-1113432505-3674514099-1000\...\Run: [Optimizer Pro] => C:\Program Files\Optimizer Pro\OptProLauncher.exe [135112 2014-05-09] (PC Utilities Software Limited)
AppInit_DLLs: C:\PROGRA~1\SupTab\SEARCH~1.DLL => C:\Program Files\SupTab\SearchProtect32.dll [91248 2014-05-08] (Skytech Co., Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Speedial Search
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3D8BA8F8D259CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = QONE8
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = QONE8
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Speedial Search
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe QONE8
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=
SearchScopes: HKLM - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://www.qone8.com/web/?type=ds&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=
SearchScopes: HKCU - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://www.qone8.com/web/?type=ds&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=
BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Avira Savings Advisor BHO - {A18A516C-AA41-46A9-92DB-60208917E442} - C:\Program Files\avira\Internet Explorer\avira32.dll ()
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: webget - {dc264a72-fa75-4948-b881-ea8eff8e5dd2} - C:\Program Files\webget\webgetbho.dll (webget)
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: Speedial
FF SelectedSearchEngine: Speedial
FF Homepage: googel.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @Nero.com/KM - C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF user.js: detected! => C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\user.js
FF SearchPlugin: C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\searchplugins\Speedial.xml
FF SearchPlugin: C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\searchplugins\trovi-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\qone8.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\2020Player@2020Technologies.com [2014-04-17]
FF Extension: United States English Spellchecker - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\en-US@dictionaries.addons.mozilla.org [2014-04-17]
FF Extension: Conduit Engine  - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\engine@conduit.com [2014-04-17]
FF Extension: Quick Start - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\quick_start@gmail.com [2014-05-21]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\toolbar@ask.com [2014-04-17]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2014-04-17]
FF Extension: Google Toolbar for Firefox - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-04-17]
FF Extension: FreeOnlineRadioPlayerRecorder  - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\{f999a48b-1950-4d81-9971-79018f807b4b} [2014-05-25]
FF Extension: Speedial - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} [2014-05-27]
FF Extension: webget - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\{55685567-4840-4a91-962b-49a412e9485a}.xpi [2014-05-27]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2014-04-17]
FF Extension: LinkExtend - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\Extensions\{cf47767d-5f3a-4e32-9fce-5d79565c9702}.xpi [2014-04-17]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-04-17]
FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com
FF Extension: Quick Start - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com [2014-05-21]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 ca82e1a5; C:\Program Files\Optimizer Pro\OptProCrashSvc.dll [186496 2014-05-27] ()
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [762192 2013-07-18] (Nero AG)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Update webget; C:\Program Files\webget\updatewebget.exe [317720 2014-05-28] ()
R2 Util webget; C:\Program Files\webget\bin\utilwebget.exe [317720 2014-05-28] ()
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [549008 2014-05-12] (Cherished Technololgy LIMITED)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
R1 {55685567-4840-4a91-962b-49a412e9485a}Gw; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw.sys [52920 2014-05-27] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-28 21:17 - 2014-05-28 21:17 - 00015811 _____ () C:\Users\Marco\Desktop\FRST.txt
2014-05-28 21:16 - 2014-05-28 21:17 - 00000000 ____D () C:\FRST
2014-05-28 21:16 - 2014-05-28 21:16 - 01056256 _____ (Farbar) C:\Users\Marco\Desktop\FRST.exe
2014-05-28 21:14 - 2014-05-28 21:14 - 00000472 _____ () C:\Users\Marco\Desktop\defogger_disable.log
2014-05-28 21:14 - 2014-05-28 21:14 - 00000000 _____ () C:\Users\Marco\defogger_reenable
2014-05-28 21:13 - 2014-05-28 21:13 - 00050477 _____ () C:\Users\Marco\Desktop\Defogger.exe
2014-05-28 18:47 - 2014-05-28 18:47 - 00257616 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-28 09:20 - 2014-05-27 16:14 - 00052920 _____ (StdLib) C:\Windows\system32\Drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw.sys
2014-05-28 09:11 - 2014-05-28 09:11 - 00000047 _____ () C:\Users\Marco\AppData\Roaming\WB.CFG
2014-05-27 22:33 - 2014-05-27 22:33 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Nero
2014-05-27 22:31 - 2014-05-27 22:31 - 00002889 _____ () C:\Users\Public\Desktop\Nero 2014.lnk
2014-05-27 22:27 - 2014-05-27 22:33 - 00000000 ____D () C:\ProgramData\Nero
2014-05-27 22:27 - 2014-05-27 22:31 - 00000000 ____D () C:\Program Files\Nero
2014-05-27 22:27 - 2014-05-27 22:31 - 00000000 ____D () C:\Program Files\Common Files\Nero
2014-05-27 22:27 - 2014-05-27 22:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2014-05-27 22:23 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-05-27 22:17 - 2014-05-27 22:17 - 284895400 _____ (Nero AG) C:\Users\Marco\Downloads\81291-673291-nero.exe
2014-05-27 22:17 - 2014-05-27 22:17 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\0V1L2Z2Z1T1I1L1T
2014-05-27 22:16 - 2014-05-27 22:16 - 00000000 ____D () C:\Users\Marco\Documents\Optimizer Pro
2014-05-27 22:16 - 2014-05-27 22:16 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Optimizer Pro
2014-05-27 22:11 - 2014-05-28 21:11 - 00000292 _____ () C:\Windows\Tasks\Speedial.job
2014-05-27 22:11 - 2014-05-28 08:50 - 00000000 ____D () C:\Program Files\webget
2014-05-27 22:11 - 2014-05-27 22:11 - 00001028 _____ () C:\Users\Marco\Desktop\Optimizer Pro.lnk
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Speedial
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\Program Files\Speedial
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\Program Files\Optimizer Pro
2014-05-18 08:56 - 2014-05-28 20:43 - 00000952 _____ () C:\Windows\setupact.log
2014-05-18 08:56 - 2014-05-18 08:56 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-15 16:53 - 2014-05-28 21:04 - 00189032 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 19:01 - 2014-05-27 18:50 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\FileAdvisor
2014-05-14 18:50 - 2014-05-27 18:50 - 00000000 ____D () C:\Program Files\File Type Advisor
2014-05-14 18:50 - 2014-05-14 19:01 - 00001112 _____ () C:\Users\Marco\Desktop\My Music Tools.lnk
2014-05-14 18:50 - 2014-05-14 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter
2014-05-14 18:50 - 2014-05-14 19:01 - 00000000 ____D () C:\Program Files\Free M4a to MP3 Converter
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\SupTab
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\qone8
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\ProgramData\WPM
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Type Advisor
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\Program Files\SupTab
2014-05-14 09:05 - 2014-05-14 09:05 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 09:02 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 09:02 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 09:02 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 08:47 - 2014-05-09 09:06 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 08:47 - 2014-05-09 09:04 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 08:47 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 08:47 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 08:47 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 08:47 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 08:47 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 08:47 - 2014-04-12 04:11 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 08:47 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 08:47 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-05-14 08:47 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 08:47 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 08:47 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 08:47 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 08:46 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-12 21:40 - 2014-05-13 05:03 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\becker
2014-05-12 21:40 - 2014-05-12 21:40 - 00001120 _____ () C:\Users\Marco\Desktop\Content Manager 2.lnk
2014-05-12 21:40 - 2014-05-12 21:40 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Becker
2014-05-12 21:40 - 2014-05-12 21:40 - 00000000 ____D () C:\Program Files\Becker
2014-05-11 17:10 - 2014-05-11 17:10 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-06 19:27 - 2014-05-14 18:23 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 18:55 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-06 18:55 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-06 18:55 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-06 18:55 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-06 18:55 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-06 18:55 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-06 18:55 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-06 18:55 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-06 18:55 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-06 18:55 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-06 18:55 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-06 18:55 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-06 18:55 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-06 18:55 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-06 18:55 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-06 18:55 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-06 18:55 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-06 18:55 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-06 18:55 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-06 18:55 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-06 18:55 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-06 18:55 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-06 18:55 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-06 18:55 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-05 06:52 - 2014-05-28 20:59 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-05 06:52 - 2014-05-28 20:59 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-05 06:52 - 2014-05-28 20:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-05 06:52 - 2014-05-05 06:52 - 00000000 ____D () C:\Windows\system32\Macromed
2014-05-05 06:52 - 2014-05-05 06:52 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Macromedia
2014-05-05 06:52 - 2014-05-05 06:52 - 00000000 ____D () C:\Users\Marco\AppData\Local\Macromedia
2014-05-04 20:36 - 2014-05-04 20:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-05-03 18:34 - 2014-05-04 20:03 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

==================== One Month Modified Files and Folders =======

2014-05-28 21:17 - 2014-05-28 21:17 - 00015811 _____ () C:\Users\Marco\Desktop\FRST.txt
2014-05-28 21:17 - 2014-05-28 21:16 - 00000000 ____D () C:\FRST
2014-05-28 21:16 - 2014-05-28 21:16 - 01056256 _____ (Farbar) C:\Users\Marco\Desktop\FRST.exe
2014-05-28 21:14 - 2014-05-28 21:14 - 00000472 _____ () C:\Users\Marco\Desktop\defogger_disable.log
2014-05-28 21:14 - 2014-05-28 21:14 - 00000000 _____ () C:\Users\Marco\defogger_reenable
2014-05-28 21:14 - 2014-04-17 01:31 - 00000000 ____D () C:\Users\Marco
2014-05-28 21:13 - 2014-05-28 21:13 - 00050477 _____ () C:\Users\Marco\Desktop\Defogger.exe
2014-05-28 21:11 - 2014-05-27 22:11 - 00000292 _____ () C:\Windows\Tasks\Speedial.job
2014-05-28 21:11 - 2009-07-14 06:34 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-28 21:11 - 2009-07-14 06:34 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-28 21:04 - 2014-05-15 16:53 - 00189032 _____ () C:\Windows\WindowsUpdate.log
2014-05-28 20:59 - 2014-05-05 06:52 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-28 20:59 - 2014-05-05 06:52 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-28 20:59 - 2014-05-05 06:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-28 20:48 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-28 20:45 - 2014-04-27 17:00 - 00000000 ____D () C:\Users\Marco\Documents\Mein Steuer-Sparbuch Heute
2014-05-28 20:43 - 2014-05-18 08:56 - 00000952 _____ () C:\Windows\setupact.log
2014-05-28 20:43 - 2014-04-17 02:24 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-05-28 20:43 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-28 18:47 - 2014-05-28 18:47 - 00257616 _____ () C:\Windows\msxml4-KB2758694-enu.LOG
2014-05-28 09:11 - 2014-05-28 09:11 - 00000047 _____ () C:\Users\Marco\AppData\Roaming\WB.CFG
2014-05-28 08:50 - 2014-05-27 22:11 - 00000000 ____D () C:\Program Files\webget
2014-05-27 22:33 - 2014-05-27 22:33 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Nero
2014-05-27 22:33 - 2014-05-27 22:27 - 00000000 ____D () C:\ProgramData\Nero
2014-05-27 22:31 - 2014-05-27 22:31 - 00002889 _____ () C:\Users\Public\Desktop\Nero 2014.lnk
2014-05-27 22:31 - 2014-05-27 22:27 - 00000000 ____D () C:\Program Files\Nero
2014-05-27 22:31 - 2014-05-27 22:27 - 00000000 ____D () C:\Program Files\Common Files\Nero
2014-05-27 22:31 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Cursors
2014-05-27 22:29 - 2014-05-27 22:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
2014-05-27 22:24 - 2014-04-18 09:53 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-05-27 22:17 - 2014-05-27 22:17 - 284895400 _____ (Nero AG) C:\Users\Marco\Downloads\81291-673291-nero.exe
2014-05-27 22:17 - 2014-05-27 22:17 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\0V1L2Z2Z1T1I1L1T
2014-05-27 22:16 - 2014-05-27 22:16 - 00000000 ____D () C:\Users\Marco\Documents\Optimizer Pro
2014-05-27 22:16 - 2014-05-27 22:16 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Optimizer Pro
2014-05-27 22:11 - 2014-05-27 22:11 - 00001028 _____ () C:\Users\Marco\Desktop\Optimizer Pro.lnk
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Speedial
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\Program Files\Speedial
2014-05-27 22:11 - 2014-05-27 22:11 - 00000000 ____D () C:\Program Files\Optimizer Pro
2014-05-27 18:50 - 2014-05-14 19:01 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\FileAdvisor
2014-05-27 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\Program Files\File Type Advisor
2014-05-27 16:14 - 2014-05-28 09:20 - 00052920 _____ (StdLib) C:\Windows\system32\Drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw.sys
2014-05-22 12:42 - 2014-04-17 02:30 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-22 12:42 - 2014-04-17 02:30 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-21 18:08 - 2014-04-27 16:32 - 00000583 _____ () C:\Windows\wiso.ini
2014-05-18 08:56 - 2014-05-18 08:56 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-15 19:47 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-05-15 16:52 - 2014-04-17 16:28 - 00000000 ____D () C:\Program Files\PDFCreator
2014-05-15 16:51 - 2014-04-17 02:08 - 00000000 ____D () C:\Windows\Panther
2014-05-14 21:11 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-14 19:01 - 2014-05-14 18:50 - 00001112 _____ () C:\Users\Marco\Desktop\My Music Tools.lnk
2014-05-14 19:01 - 2014-05-14 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter
2014-05-14 19:01 - 2014-05-14 18:50 - 00000000 ____D () C:\Program Files\Free M4a to MP3 Converter
2014-05-14 18:55 - 2014-04-18 16:43 - 00000000 ____D () C:\Program Files\SearchProtect
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\SupTab
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\qone8
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\ProgramData\WPM
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Type Advisor
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-05-14 18:50 - 2014-05-14 18:50 - 00000000 ____D () C:\Program Files\SupTab
2014-05-14 18:50 - 2014-04-17 08:17 - 00001311 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 18:50 - 2014-04-17 08:17 - 00001299 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-14 18:50 - 2014-04-17 01:31 - 00001603 _____ () C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-14 18:23 - 2014-05-06 19:27 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-14 18:23 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-05-14 09:06 - 2014-04-17 01:38 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 09:05 - 2014-05-14 09:05 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-14 09:05 - 2014-04-17 03:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 09:04 - 2014-04-17 03:05 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-13 13:07 - 2014-04-17 08:17 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-13 05:03 - 2014-05-12 21:40 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\becker
2014-05-12 21:40 - 2014-05-12 21:40 - 00001120 _____ () C:\Users\Marco\Desktop\Content Manager 2.lnk
2014-05-12 21:40 - 2014-05-12 21:40 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Becker
2014-05-12 21:40 - 2014-05-12 21:40 - 00000000 ____D () C:\Program Files\Becker
2014-05-11 17:10 - 2014-05-11 17:10 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 09:06 - 2014-05-14 08:47 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 09:04 - 2014-05-14 08:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 05:25 - 2014-05-14 09:02 - 17382912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:07 - 2014-05-14 09:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 04:10 - 2014-05-14 09:02 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 06:52 - 2014-05-05 06:52 - 00000000 ____D () C:\Windows\system32\Macromed
2014-05-05 06:52 - 2014-05-05 06:52 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Macromedia
2014-05-05 06:52 - 2014-05-05 06:52 - 00000000 ____D () C:\Users\Marco\AppData\Local\Macromedia
2014-05-04 20:37 - 2014-04-17 11:03 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Apple Computer
2014-05-04 20:36 - 2014-05-04 20:36 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-05-04 20:03 - 2014-05-03 18:34 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-05-02 18:00 - 2014-04-17 11:06 - 00000000 ____D () C:\Users\Marco\AppData\Local\Apple Computer
2014-05-01 18:44 - 2014-04-17 09:10 - 00000000 ____D () C:\Users\Marco\AppData\Local\Thunderbird

Some content of TEMP:
====================
C:\Users\Marco\AppData\Local\Temp\avgnt.exe
C:\Users\Marco\AppData\Local\Temp\installer_nero_Deutsch.exe
C:\Users\Marco\AppData\Local\Temp\nsh6349.exe
C:\Users\Marco\AppData\Local\Temp\nsh6656.exe
C:\Users\Marco\AppData\Local\Temp\nsh8D0B.exe
C:\Users\Marco\AppData\Local\Temp\nsm8FE9.exe
C:\Users\Marco\AppData\Local\Temp\optprosetup.exe
C:\Users\Marco\AppData\Local\Temp\smtnew_qone8.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe
[2014-05-14 08:47] - [2014-03-04 11:17] - 0304128 ____A (Microsoft Corporation) 998507B046BA314CE8245364C686FA67

C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-24 12:40

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---


Addition.txt
==================FRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:25-05-2014 02
Ran by Marco at 2014-05-28 21:17:20
Running from C:\Users\Marco\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Avira Savings Advisor (HKLM\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Content Manager 2 (HKLM\...\Content Manager 2) (Version: 3.18.0.342250 - NNG Llc.)
CrystalDiskInfo 6.1.12 (HKLM\...\CrystalDiskInfo_is1) (Version: 6.1.12 - Crystal Dew World)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{349F73CA-653A-43A6-AE77-970B07D6EDA0}) (Version:  - Microsoft)
File Type Advisor 1.4 (HKLM\...\File Type Advisor_is1) (Version:  - filetypeadvisor.com)
Free M4a to MP3 Converter 8.1 (HKLM\...\Free M4a to MP3 Converter_is1) (Version:  - ManiacTools.com)
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
iTunes (HKLM\...\{2F21564D-DE05-4C6D-B21E-08B9D313FAB3}) (Version: 11.1.5.5 - Apple Inc.)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Naviextras Toolbox Prerequesities (HKLM\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
Nero 2014 (HKLM\...\{4AD31A53-7852-4D98-86F3-156B34B49F40}) (Version: 15.0.03400 - Nero AG)
Nero Audio Pack 1 (Version: 11.0.11500.110.0 - Nero AG) Hidden
Nero Blu-ray Player (Version: 12.0.20051 - Nero AG) Hidden
Nero Blu-ray Player Help (CHM) (Version: 15.0.00015 - Nero AG) Hidden
Nero Burning Core (Version: 15.0.24000 - Nero AG) Hidden
Nero Burning ROM (Version: 15.0.24000 - Nero AG) Hidden
Nero Burning ROM Help (CHM) (Version: 15.0.00018 - Nero AG) Hidden
Nero ControlCenter (Version: 11.0.16700 - Nero AG) Hidden
Nero ControlCenter Help (CHM) (Version: 15.0.00015 - Nero AG) Hidden
Nero Core Components (Version: 11.0.22900 - Nero AG) Hidden
Nero Disc Menus Basic (Version: 12.0.11500 - Nero AG) Hidden
Nero Disc to Device (Version: 15.0.12010 - Nero AG) Hidden
Nero Effects Basic (Version: 15.0.10011 - Nero AG) Hidden
Nero Express (Version: 15.0.24000 - Nero AG) Hidden
Nero Express Help (CHM) (Version: 15.0.00018 - Nero AG) Hidden
Nero Info (Version: 15.1.0023 - Nero AG) Hidden
Nero Kwik Themes Basic (Version: 12.0.11500 - Nero AG) Hidden
Nero Launcher (Version: 15.0.10000 - Nero AG) Hidden
Nero MediaHome (Version: 1.20.8300 - Nero AG) Hidden
Nero MediaHome Help (CHM) (Version: 15.0.00018 - Nero AG) Hidden
Nero Packages (HKCU\...\Nero Packages) (Version:  - ) <==== ATTENTION
Nero PiP Effects Basic (Version: 15.0.10008 - Nero AG) Hidden
Nero Recode (Version: 15.0.14000 - Nero AG) Hidden
Nero Recode Help (CHM) (Version: 15.0.00018 - Nero AG) Hidden
Nero RescueAgent (Version: 15.0.2000 - Nero AG) Hidden
Nero RescueAgent Help (CHM) (Version: 15.0.00015 - Nero AG) Hidden
Nero SharedVideoCodecs (Version: 1.0.15003 - Nero AG) Hidden
Nero Update (Version: 11.0.13300.42.0 - Nero AG) Hidden
Nero Video (Version: 15.0.15000 - Nero AG) Hidden
Nero Video Help (CHM) (Version: 15.0.00018 - Nero AG) Hidden
Optimizer Pro v3.2 (HKLM\...\Optimizer Pro_is1) (Version:  - ) <==== ATTENTION
PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.2 - pdfforge)
PMB (HKLM\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.2.00.03250 - Sony Corporation)
Prerequisite installer (Version: 15.0.0005 - Nero AG) Hidden
qone8 uninstaller (HKLM\...\qone8 uninstaller) (Version:  - qone8) <==== ATTENTION
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)
Search Protect (HKLM\...\SearchProtect) (Version: 2.13.1.47 - Client Connect LTD) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft) Hidden
Speedial (HKLM\...\Speedial) (Version:  - Speedial) <==== ATTENTION
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)
webget (HKLM\...\webget) (Version: 2014.05.27.190610 - webget) <==== ATTENTION
WISO Steuer-Sparbuch 2014 (HKLM\...\{C37132C6-0C9A-42D0-A9E0-BA5415772545}) (Version: 21.00.8480 - Buhl Data Service GmbH)
WPM18.8.0.304 (HKLM\...\WPM) (Version: 18.8.0.304 - Cherished Technololgy LIMITED) <==== ATTENTION

==================== Restore Points  =========================

27-05-2014 15:49:10 Geplanter Prüfpunkt
27-05-2014 20:22:47 DirectX wurde installiert
27-05-2014 20:23:08 DirectX wurde installiert
27-05-2014 20:23:20 DirectX wurde installiert
27-05-2014 20:23:33 DirectX wurde installiert
27-05-2014 20:23:45 DirectX wurde installiert
27-05-2014 20:27:03 Installed Nero 2014.
28-05-2014 16:47:29 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {02BE75A9-28AE-4B71-8F80-857EA5B0E789} - System32\Tasks\FileAdvisorUpdate => C:\Program Files\File Type Advisor\fileadvisor.exe [2013-09-04] (File Type Advisor)
Task: {071A3B04-80C5-47A5-8D34-1BA62C09B1C6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {0F04FA39-1315-450A-98D2-73EA24476217} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {14E31B19-5A51-42C6-AE6E-6FE85EA9C87B} - System32\Tasks\Nero\Nero Info => C:\Program Files\Common Files\Nero\Nero Info\NeroInfo.exe [2013-08-20] (Nero AG)
Task: {89F98BED-3AE4-4D60-82B7-75EF460198F3} - System32\Tasks\FileAdvisorCheck => C:\Program Files\File Type Advisor\file-type-advisor.exe [2013-09-04] (filetypeadvisor.com                                        )
Task: {8D728471-AE6D-4594-9584-B552C01D6B53} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {B20C64F6-FEB2-49CE-BC46-CEA5E6881B7E} - System32\Tasks\Speedial => C:\Users\Marco\AppData\Roaming\Speedial\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {B51BD15C-1656-4D70-8F68-5B61E8E593EF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-28] (Adobe Systems Incorporated)
Task: {E1137246-976A-4181-AC34-6906AC8E5CC8} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files\avira\Internet Explorer\swu.vbs"
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Speedial.job => C:\Users\Marco\AppData\Roaming\Speedial\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-05-27 22:11 - 2014-05-27 22:11 - 00186496 _____ () C:\Program Files\Optimizer Pro\OptProCrashSvc.dll
2014-05-27 22:11 - 2014-05-27 22:11 - 03000776 _____ () C:\Program Files\Optimizer Pro\OptProCrash.dll
2014-05-27 21:06 - 2014-05-28 09:23 - 00317720 _____ () C:\Program Files\webget\updatewebget.exe
2014-05-28 08:50 - 2014-05-28 08:50 - 00317720 _____ () C:\Program Files\webget\bin\utilwebget.exe
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01430320 _____ () C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe
2014-04-27 16:56 - 2014-04-23 15:03 - 09787184 _____ () C:\Program Files\WISO\Steuersoftware 2014\wgui14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 00035632 _____ () C:\Program Files\WISO\Steuersoftware 2014\rsdcom48.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 00309040 _____ () C:\Program Files\WISO\Steuersoftware 2014\rscorewinapi48.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 00322864 _____ () C:\Program Files\WISO\Steuersoftware 2014\rsguiwinapi48.dll
2014-04-27 16:56 - 2014-04-23 15:04 - 03807024 _____ () C:\Program Files\WISO\Steuersoftware 2014\wcore14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 00136496 _____ () C:\Program Files\WISO\Steuersoftware 2014\rsodbc48.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 02703152 _____ () C:\Program Files\WISO\Steuersoftware 2014\wfvie14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 02001200 _____ () C:\Program Files\WISO\Steuersoftware 2014\wsteu14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01929520 _____ () C:\Program Files\WISO\Steuersoftware 2014\wreli14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 04321072 _____ () C:\Program Files\WISO\Steuersoftware 2014\wauff14.dll
2014-04-27 16:56 - 2014-02-11 11:53 - 01043456 _____ () C:\Program Files\WISO\Steuersoftware 2014\clucene-core.dll
2014-04-27 16:56 - 2014-02-11 11:53 - 00094720 _____ () C:\Program Files\WISO\Steuersoftware 2014\clucene-shared.dll
2014-04-27 16:56 - 2014-02-11 11:53 - 00250368 _____ () C:\Program Files\WISO\Steuersoftware 2014\clucene-contribs-lib.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01562928 _____ () C:\Program Files\WISO\Steuersoftware 2014\wmain14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 05154096 _____ () C:\Program Files\WISO\Steuersoftware 2014\wbae114.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01691440 _____ () C:\Program Files\WISO\Steuersoftware 2014\wbae214.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01807152 _____ () C:\Program Files\WISO\Steuersoftware 2014\wbae314.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01626416 _____ () C:\Program Files\WISO\Steuersoftware 2014\wbae414.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01115440 _____ () C:\Program Files\WISO\Steuersoftware 2014\whau114.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01329456 _____ () C:\Program Files\WISO\Steuersoftware 2014\whau214.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01257264 _____ () C:\Program Files\WISO\Steuersoftware 2014\wwerb14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 07326512 _____ () C:\Program Files\WISO\Steuersoftware 2014\wkont14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01285936 _____ () C:\Program Files\WISO\Steuersoftware 2014\wimp14.dll
2014-04-27 16:56 - 2014-04-23 15:03 - 01330480 _____ () C:\Program Files\WISO\Steuersoftware 2014\wfabu14.dll
2014-05-11 17:10 - 2014-05-11 17:10 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-05-14 08:59 - 2014-05-14 08:59 - 16361136 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/28/2014 09:11:55 PM) (Source: Software Protection Platform Service) (EventID: 1017) (User: )
Description: Fehler bei der Installation des Kaufnachweises. 0xC004F015
Teil-Pkey=D9G84
ACID=5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
Genauer Fehler[?]

Error: (05/28/2014 09:07:54 PM) (Source: Software Protection Platform Service) (EventID: 1017) (User: )
Description: Fehler bei der Installation des Kaufnachweises. 0xC004F015
Teil-Pkey=D9G84
ACID=5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
Genauer Fehler[?]

Error: (05/28/2014 08:43:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 06:08:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 08:51:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 10:27:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 10:22:47 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {305bd0e6-d600-40cd-afde-6748d4e3173f}

Error: (05/27/2014 10:02:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 04:47:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2014 09:57:39 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "H:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"


System errors:
=============
Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:49:35 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:47:34 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (05/27/2014 05:47:34 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.


Microsoft Office Sessions:
=========================
Error: (05/28/2014 09:11:55 PM) (Source: Software Protection Platform Service) (EventID: 1017) (User: )
Description: 0xC004F015D9G845e017a8a-f3f9-4167-b1bd-ba3e236a4d8f?

Error: (05/28/2014 09:07:54 PM) (Source: Software Protection Platform Service) (EventID: 1017) (User: )
Description: 0xC004F015D9G845e017a8a-f3f9-4167-b1bd-ba3e236a4d8f?

Error: (05/28/2014 08:43:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 06:08:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 08:51:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 10:27:18 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 10:22:47 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {305bd0e6-d600-40cd-afde-6748d4e3173f}

Error: (05/27/2014 10:02:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 04:47:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2014 09:57:39 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: H:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)


==================== Memory info ===========================

Percentage of memory in use: 36%
Total physical RAM: 3063.11 MB
Available physical RAM: 1936.96 MB
Total Pagefile: 6124.51 MB
Available Pagefile: 4881.83 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.66 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:292.97 GB) (Free:140.35 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Daten) (Fixed) (Total:292.97 GB) (Free:188.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 000E6699)
Partition 1: (Active) - (Size=293 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=293 GB) - (Type=83)
Partition 3: (Not Active) - (Size=293 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=53 GB) - (Type=05)

==================== End Of Log ============================
--- --- ---

GMER
==========
GMER Logfile:
Code:
GMER 2.1.19357 - GMER - Rootkit Detector and Remover
Rootkit scan 2014-05-28 22:50:43
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 ST31000528AS rev.CC44 931,51GB
Running: ui13orb8.exe; Driver: C:\Users\Marco\AppData\Local\Temp\fwloypog.sys


---- System - GMER 2.1 ----

SSDT  98053D46                                  ZwCreateSection
SSDT  98053D50                                  ZwRequestWaitReplyPort
SSDT  98053D4B                                  ZwSetContextThread
SSDT  98053D55                                  ZwSetSecurityObject
SSDT  98053D5A                                  ZwSystemDebugControl
SSDT  98053CE7                                  ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!ZwRollbackEnlistment + 142D  82A80A15 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2    82ABA212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text  ntkrnlpa.exe!KeRemoveQueueEx + 11F7      82AC158C 4 Bytes  [46, 3D, 05, 98]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1553      82AC18E8 4 Bytes  [50, 3D, 05, 98]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1597      82AC192C 4 Bytes  [4B, 3D, 05, 98]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1613      82AC19A8 4 Bytes  [55, 3D, 05, 98]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1667      82AC19FC 4 Bytes  [5A, 3D, 05, 98]
.text  ...                                     

---- EOF - GMER 2.1 ----
--- --- ---

Noch was:
ich habe PC optimizer pro auf dem Rechner, kann das die Ursache sein?
Ich habe free m4a to mp3 converter 8.1 installiert. nach der Installation kam die Info, dass ein update notwendig ist, habe dann das update runtergeladen und war wohl etwas unaufmerksam, und habe zuspät gemerkt, dass sich in der Installationsroutine andere Programme mitinstalliert haben. Die tick-boxen waren schon angeklickt und ich habe einfach "weiter" gedrückt. Habe dann das Programm wieder deinstalliert und neu installiert ohne update, aber da war wohl schon alles zu spät.
Jetzt sind qone8, optimizer pro v3.2, speedial, file type advisor WPM18.8.0.304 auf dem Rechner installiert.
Qone8 startet auch immer de firefox seite, obwohl ich google als Startseite habe.
Hoffe die Info hilft weiter.

schrauber 30.05.2014 09:41
Adware & Co. deinstallieren

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:




Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

magu1961 15.06.2014 11:07
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo Schrauber,
habe über deinen Link die aktuelle Revo Uninstaller 1.95 version runtergeladen und gestartet.
Sorry, aber ich finde im Revo im Uninstallerfeld niergends einen Hinweis auf "additional scan result of farbar recovery scan tool". Auch in Detail ansicht nicht.
Ebenso erscheint niergends der Hinweis <===== attention.

Wo genau finde ich das?
Würde gerne Deiner super Anleitung genau folgen.

Vielen Dank für Deine Hilfe
Marco

magu1961 15.06.2014 12:55
Hallo Schrauber,
erst mal nachträglich vielen Dank für Deine Mühe mit Deiner Anleitung mir zu helfen.

Da die Werbung extrem lästig ist, konnte ich es nicht abwarten und habe mittels Revo Uninstaller alle klar merkwürdigen Programme deinstalliert: Webget, qone8, Optimizer pro.
Dann MBAM entsprechend Deiner Anleitung durchgeführt.

Protokoll:

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 15.06.2014
Suchlauf-Zeit: 12:36:05
Logdatei: MBAM_2014-06-14.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.15.02
Rootkit Datenbank: v2014.06.02.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Marco

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 244509
Verstrichene Zeit: 5 Min, 2 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 2
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, 1244, Löschen bei Neustart, [b10d99dfa6d585b12559e2775ea3e41c]
PUP.Optional.WpManager, C:\ProgramData\WPM\wprotectmanager.exe, 1296, Löschen bei Neustart, [714d45334734dd599b513b2889788d73]

Module: 1
PUP.Optional.Skytech.A, C:\Program Files\SupTab\DpInterface32.dll, Löschen bei Neustart, [a11df78145361d192e51e3a5ae53ec14],

Registrierungsschlüssel: 16
PUP.Optional.IePluginService.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, In Quarantäne, [b10d99dfa6d585b12559e2775ea3e41c],
PUP.Optional.WpManager, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Wpm, In Quarantäne, [714d45334734dd599b513b2889788d73],
PUP.Optional.WpManager, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WPM, In Quarantäne, [714d45334734dd599b513b2889788d73],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.SupTab.A, HKU\S-1-5-21-4000187890-1113432505-3674514099-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\INPROCSERVER32, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SearchProtect, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.Qone8.A, HKLM\SOFTWARE\qone8Software, In Quarantäne, [e1dd6612bac1b38334202db4c04301ff],
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [dce284f4611a8ea8287f3fa3d330fb05],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4000187890-1113432505-3674514099-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [03bba5d369121224924b576904fe738d],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4000187890-1113432505-3674514099-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [6b53b5c39edd6cca30b86f671ee5cc34],
PUP.Optional.Qone8, HKU\S-1-5-21-4000187890-1113432505-3674514099-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [744ae593a0dbf5415d494d95af5445bb],

Registrierungswerte: 3
PUP.Optional.QuickStart.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|quick_start@gmail.com, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com, In Quarantäne, [c0fe7efadaa14aec717f526272901de3]
PUP.Optional.WpManager.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WPM|ImagePath, C:\ProgramData\WPM\wprotectmanager.exe -service, In Quarantäne, [437b641432499f9796ed19ce5ea5d32d]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4000187890-1113432505-3674514099-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, zr2X2X1G1S1F2V1S2Q0V, In Quarantäne, [6b53b5c39edd6cca30b86f671ee5cc34]

Registrierungsdaten: 6
PUP.Optional.Qone8, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://start.qone8.com/?type=sc&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://start.qone8.com/?type=sc&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J),Ersetzt,[dfdf96e2631806300d1cf0872cd8847c]
Hijack.StartPage, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://start.qone8.com/?type=hp&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J, Gut: (hxxp://www.google.com), Schlecht: (hxxp://start.qone8.com/?type=hp&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J),Ersetzt,[318de98f3249989e474abeaf986c2ad6]
PUP.Optional.Speedial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://speedial.com/?f=1&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1 V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0 Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=, Gut: (www.google.com), Schlecht: (hxxp://speedial.com/?f=1&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1 V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0 Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=),Ersetzt,[605e1662e398d95d71705e0e966ec43c]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[209e7dfbaccf132369c1fa7d62a22dd3]
PUP.Optional.Speedial.A, HKU\S-1-5-21-4000187890-1113432505-3674514099-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://speedial.com/?f=1&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1 V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0 Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=, Gut: (www.google.com), Schlecht: (hxxp://speedial.com/?f=1&a=spd_vit_14_22_ff&cd=2XzuyEtN2Y1L1Qzu0DtDtByBzzzztD0CtB0FtBzzzz0A0EyEtN0D0Tzu0SzzyBzztN1L2XzutBtFtBtDtFtCzytFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1 V1N2Y1L1Qzu2StBtD0ByCtCtB0FyCtG0AtBtCtBtGzz0CtDyDtGyE0Ezz0DtGyE0D0DtCyEtDtC0Bzy0EtCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAyE0ByCyBzz0C0BtGzztDyC0AtG0ByD0F0DtG0 Azz0DtBtGyDyDyD0B0E0DtBtDtD0CtAzy2Q&cr=1467219866&ir=),Ersetzt,[2896c2b677044ceadd0538346f95c43c]
Hijack.StartPage, HKU\S-1-5-21-4000187890-1113432505-3674514099-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://start.qone8.com/?type=hp&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J, Gut: (hxxp://www.google.com), Schlecht: (hxxp://start.qone8.com/?type=hp&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J),Ersetzt,[655988f042390234375bbdb0e91b27d9]

Ordner: 113
PUP.Optional.SupTab.A, C:\Program Files\SupTab, Löschen bei Neustart, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\weather, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\en-US, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-419, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-ES, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-BE, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CA, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CH, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-FR, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-LU, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-CH, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-IT, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pl, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt-BR, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru-MO, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\tr-TR, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\vi-VI, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-CN, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-TW, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\Main, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\Main\bin, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\Main\rep, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\bin, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\rep, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\bin, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\bubble, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\libs, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protection, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protectionDS, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\settings, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\uninstall, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\rep, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
Rogue.Multiple, C:\ProgramData\2308189059, In Quarantäne, [d5e95622bfbc90a6995efe7a57aba957],
PUP.Optional.OpenCandy, C:\Users\Marco\AppData\Roaming\OpenCandy, In Quarantäne, [08b63f39afcc3afc316d5731dc264eb2],
PUP.Optional.OpenCandy, C:\Users\Marco\AppData\Roaming\OpenCandy\E862F7E9654C4D97B35C2DA71C772990, In Quarantäne, [08b63f39afcc3afc316d5731dc264eb2],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include\tools, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\lib, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\pack, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\en, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\en-US, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\es, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\es-419, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-BE, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-CA, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-CH, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-LU, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\it, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\it-CH, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\pl, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\pt-BR, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\ru, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\ru-MO, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\tr, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\vi, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\zh-CN, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\zh-TW, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\weather, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\defaults, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\defaults\preferences, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Speedial, In Quarantäne, [625c0276dc9fc0762b6ab4e2639fa759],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\icons, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\resources, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\favorites, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\info, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\_locales, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\_locales\en-US, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, Löschen bei Neustart, [d3eb0771a2d99c9a93072f6f966c36ca],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, In Quarantäne, [d3eb0771a2d99c9a93072f6f966c36ca],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\SearchProtect, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\SearchProtect\rep, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\SearchProtect\STG, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\UI, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\UI\rep, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],

Dateien: 355
PUP.Optional.Trovi.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\searchplugins\trovi-search.xml, Keine Aktion durch Benutzer, [645aa3d5d4a73006e924971161a1aa56],
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, Löschen bei Neustart, [b10d99dfa6d585b12559e2775ea3e41c],
PUP.Optional.Skytech.A, C:\Program Files\SupTab\DpInterface32.dll, Löschen bei Neustart, [a11df78145361d192e51e3a5ae53ec14],
PUP.Optional.WpManager, C:\ProgramData\WPM\wprotectmanager.exe, Löschen bei Neustart, [714d45334734dd599b513b2889788d73],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\SupTab.dll, In Quarantäne, [3985fa7e84f75ed8203960d5bb45857b],
PUP.Optional.Conduit.A, C:\Users\Marco\AppData\Roaming\OpenCandy\E862F7E9654C4D97B35C2DA71C772990\sp-downloader.exe, In Quarantäne, [09b5384045361422baf976a9a25f15eb],
PUP.Optional.Skytech.A, C:\$Recycle.Bin\S-1-5-21-4000187890-1113432505-3674514099-1000\$R0N8MEI\UninstallManager.exe, In Quarantäne, [e0de6315dba05fd791ee67219b668a76],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\searchplugins\Speedial.xml, In Quarantäne, [fdc190e8b2c956e059521d8ce51d33cd],
PUP.Optional.Conduit.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\searchplugins\conduit.xml, In Quarantäne, [d7e7d5a37308b68046ba54629b6733cd],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\install.data, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\DpInterface64.dll, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\DpInterfacef32.dll, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\RSHP.exe, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\SearchProtect64.dll, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\SpAPPSv32.dll, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\SpAPPSv64.dll, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\uninstall.exe, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\WebDataJs, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\data.html, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\indexIE.html, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\indexIE8.html, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\main.css, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\ver.txt, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\arrow.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\default_add_logo.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\default_add_logo_hover.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\default_logo.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\googlelogo.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\googlelogo2.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\google_trends.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon128.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon16.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\icon48.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\loading.gif, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\logo32.ico, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\img\weather\0.png, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\common.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\ga.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\ie8.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\jquery-1.11.0.min.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\jquery.autocomplete.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\js.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\library.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\js\xagainit.js, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\en-US\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-419\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\es-ES\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-BE\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CA\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-CH\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-FR\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\fr-LU\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-CH\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\it-IT\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pl\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\pt-BR\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\ru-MO\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\tr-TR\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\vi-VI\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-CN\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SupTab.A, C:\Program Files\SupTab\web\_locales\zh-TW\messages.json, In Quarantäne, [17a785f35625c76faef3d8e5dc260cf4],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\EULA.txt, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\Main\bin\SPTool.dll, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\Main\bin\uninstall.exe, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\Main\rep\SystemRepository.dat, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\bin\cltmng.exe, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\bin\SPTool64.exe, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\bin\SPVC32.dll, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\bin\SPVC32Loader.dll, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\bin\SPVC64.dll, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\SearchProtect\bin\SPVC64Loader.dll, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\bin\cltmngui.exe, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\settings.html, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\style.css, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\bubble\bubble.css, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\bubble\bubble.html, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\bubble\bubble.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\bubble\defaults.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\hez-selected.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\Apply-default.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\Apply-onclick.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\bg-uninstall.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\bg-with-logo.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\bg.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\bgNotif.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\bgSettings.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\bgUninstall.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\btnBlue.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\btnClose.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\btnSilver.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\button-bg.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\checkbox.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\checkbox_checked.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\checkbox_def.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\close-win-def.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\close-win-over-click.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\gray-bg.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\hez-def.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\hez.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\icon-win.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\info-icon.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\menu-rollover.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\menu-selected.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\radio-button-def.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\radio-button-selected.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\radio-button.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\radio-button2.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\Settings-icon.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\text-field.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\v.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\Images\x.png, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\libs\defaults.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\libs\dialogUtils.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\libs\json2.min.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\libs\main.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\libs\SPDialogAPI.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protection\defaults.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protection\protection.css, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protection\protection.html, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protection\protection.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protectionDS\defaults.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\settings\defaults.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\settings\settings.css, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\settings\settings.html, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\settings\settings.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\uninstall\defaults.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\uninstall\uninstall.css, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\uninstall\uninstall.html, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.SearchProtect.A, C:\Program Files\SearchProtect\UI\dialogs\uninstall\uninstall.js, In Quarantäne, [f3cbe296e09ba591ae5f9e43838010f0],
PUP.Optional.Qone8.A, C:\Program Files\Mozilla Firefox\browser\searchplugins\qone8.xml, In Quarantäne, [d0eeb0c8087354e2e0732db45ba8fe02],
Rogue.Multiple, C:\ProgramData\2308189059\BITA3E.tmp, In Quarantäne, [d5e95622bfbc90a6995efe7a57aba957],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome.manifest, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\install.rdf, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\index.html, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\quick_start.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include\pageload.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include\tools\about_blank_hoo k.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include\tools\popup_image_hel per.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\include\tools\urlrequestor.js , In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\js.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\toolbar.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\lib\doT.min.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\lib\jquery-2.1.0.min.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\lib\jquery.autocomplete.js , In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\bookmark.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\helpGider.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\hotSearch.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\other.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\pageManager.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\pageNew.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\search.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\searchMode.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\stat.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\wallpaper.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\module\weather.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\pack\browerStart.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\pack\common.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\pack\ga.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\content\js\pack\xagainit.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\arrow.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\default_add_logo.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\default_add_logo_hover.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\googlelogo.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\googlelogo2.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\icon.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\loading.gif, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\logo.ico, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\logo.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\logo32.ico, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\media.css, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\style.css, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\chrome\skin\weather\0.png, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\defaults\preferences\preferences.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\addonmanager.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\aes.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\config.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\dialogs.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\last_tab.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\misc.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\properties.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\remoterequest.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\restoreprefs.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.QuickStart.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\quick_start@gmail.com\modules\settings.js, In Quarantäne, [f8c6294f53289a9caf519ef1bf43867a],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\bootstrap.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\chrome.manifest, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\install.rdf, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser\background.9.5.5.jsm, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser\background.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser\browser.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser\header.9.5.5.jsm, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser\header.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser\timer.jsm, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_de.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_en-gb.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_en_us.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_fr.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_he.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_it.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_pt-br.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_ru.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data\favorites_tr.json, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\crypto-js.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\jquery-2.1.0.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\jquery.autocomplete.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\jquery.balloon.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\jquery.fittext.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\jquery.Jcrop.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\jquery.simplecolorpicker.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\mustache.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\string.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external\underscore-min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab\gallery.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab\gallery.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab\newtab.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab\newtab.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab\search.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab\search.min.js, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external\foundation.min.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external\indicator.gif, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external\Jcrop.gif, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external\jquery.autocomplete.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external\jquery.Jcrop.min.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external\jquery.simplecolorpicker.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external\normalize.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\arrow-gallery-cat-selected.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\arrow.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\emptyArea.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\gallery.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\gallery_templates.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\icon-gallery-search.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\not_available_32.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\plus.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery\X.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\icons\16.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\icons\48.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\icons\64.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\icons\_16.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css\buttons.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css\footer.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css\header.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css\list.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css\newtab.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css\search.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css\themes.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\ajax-loader-2.gif, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\ajax-loader-bar.gif, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\ajax-loader-medium.gif, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\ajax-loader-small.gif, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\ajax-loader.gif, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\arrow-footer.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\arrow-header.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\attachment.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\close.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\edit-button.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\icon-chrome.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\icon-edit.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\icon-layout.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\icon-plus.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\icon-theme.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\menu_v.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\menu_v_white.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\provider.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\x-button.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\arab_tile.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\batthern_@2X.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\bo_play_pattern_@2X.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\dark_wood_@2X.jpg, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\diagonal_striped_brick.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\escheresque_ste_@2X.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\gold_scale.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\purty_wood_@2X.jpg, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\readme.txt, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\starring_@2X.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\tileable_wood_texture_@2X.jpg, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\weave_@2X.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\wild_oliva_@2X.jpg, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns\woven.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\resources\list.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\resources\menu.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\activetabs.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\favorites.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\layout.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\modal-fav-add.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\modal-fav-edit.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\modal-fav-group.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\readitlater.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\recentlyclosed.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\theme.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css\webapps.css, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\bookmarks.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\download.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\downloads.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\downloas.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\extensions.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\history.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\settings.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome\trash.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\favorites\empty.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\favorites\error.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\favorites\shadow.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\info\contactus.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\info\facebook.ico, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\info\rateus.png, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\info\twitter.ico, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\activetabs.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\favorites.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\layout.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\modal-fav-add.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\modal-fav-edit.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\modal-fav-group.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\readitlater.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\readitlater_content.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\readitlater_menu.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\recentlyclosed.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\theme.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\webapps.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources\webapps_contextmenu.html, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.Speedial.A, C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\9idjly3v.default\extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52}\_locales\en-US\translations.dtd, In Quarantäne, [f2cc4632a4d7a393dfb7366044be649c],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, In Quarantäne, [d3eb0771a2d99c9a93072f6f966c36ca],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\SearchProtect\rep\UserRepository.dat, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\SearchProtect\rep\UserSettings.dat, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],
PUP.Optional.SearchProtect.A, C:\Users\Marco\AppData\Local\SearchProtect\UI\rep\UIRepository.dat, In Quarantäne, [f1cd690fc9b21422900b118ddc26a25e],

Physische Sektoren: 0
(No malicious items detected)


(end)

Ergebnis von AdwCleaner:
AdwCleaner Logfile:
Code:
# AdwCleaner v3.212 - Bericht erstellt am 15/06/2014 um 13:31:12
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Marco - MARCO-PC
# Gestartet von : C:\Users\Marco\Downloads\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : {55685567-4840-4a91-962b-49a412e9485a}Gw

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Users\Marco\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Marco\AppData\Roaming\0V1L2Z2Z1T1I1L1T
Ordner Gelöscht : C:\Users\Marco\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Marco\AppData\Roaming\SupTab
Ordner Gelöscht : C:\Users\Marco\Documents\Optimizer Pro
Datei Gelöscht : C:\Windows\system32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw.sys

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Marco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Marco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewebget_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updatewebget_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\utilwebget_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\utilwebget_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\webget_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\webget_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\Vittalia
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\Wpm
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~1\suptab\search~1.dll

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\6sbnhoy3.default-1402830633556\prefs.js ]


*************************

AdwCleaner[R0].txt - [4610 octets] - [15/06/2014 13:30:17]
AdwCleaner[S0].txt - [3769 octets] - [15/06/2014 13:31:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3829 octets] ##########
--- --- ---

und jetzt noch Ergebnis von JRT:JRT Logfile:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Professional x86
Ran by Marco on 15.06.2014 at 13:51:15,76
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.06.2014 at 13:53:12,33
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---

schrauber 16.06.2014 07:34

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

magu1961 19.06.2014 20:00
Hallo,

nochmals Danke für die Hilfe. Bis jetzt keine unerwünschten Werbeeinblendungen mehr.

Nachfolgend LOG file von ESET Scan C-Partition mit Betriebssystem und allen Programmen:

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=5a039ac1ef265e468eee6fc783a883da
# engine=18750
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-17 05:43:06
# local_time=2014-06-17 07:43:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 3077 9666122 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 154004 154614977 0 0
# scanned=133595
# found=9
# cleaned=0
# scan_time=2394
sh=2DAAB83B0439BC76845E58F3F7DDB84EE8E210C4 ft=1 fh=855a37aa5dbeb36f vn="Win32/InstallCore.PC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Marco\AppData\Roaming\0V1L2Z2Z1T1I1L1T\Nero Packages\uninstaller.exe.vir"
sh=B9A96D9AE94C4B42CA5499933F6DF218B3903768 ft=1 fh=966b3592656dc188 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=81C2C3354F11ECE49D7667538CEFE9F2B2395319 ft=1 fh=cca4b3788ffc60aa vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\DVDVideoSoft\AskTB\ApnIC.dll"
sh=99DD33D629341F95D9853B1E63FCE454EC654560 ft=1 fh=08803d4e54260720 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\DVDVideoSoft\AskTB\ApnToolbarInstaller.exe"
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe"
sh=2DAAB83B0439BC76845E58F3F7DDB84EE8E210C4 ft=1 fh=855a37aa5dbeb36f vn="Win32/InstallCore.PC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marco\AppData\Local\Temp\5370584.Uninstall\uninstaller.exe"
sh=9EA2EC35286E8B152E1B0FB0F7CB45ECE5DD1E94 ft=1 fh=1d1710bbc0b94508 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marco\Desktop\Alte Firefox-Daten\9idjly3v.default\extensions\{f999a48b-1950-4d81-9971-79018f807b4b}\ctypes\FirefoxCtype.dll"
sh=E5893674EB5035340F082FF31ABEA60C87BC26E7 ft=1 fh=4a5efe03ccdce2f0 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marco\Desktop\Alte Firefox-Daten\9idjly3v.default\extensions\{f999a48b-1950-4d81-9971-79018f807b4b}\Plugins\npFirefoxPlugin.dll"
sh=ACFAAC92B5210832B185D476D047B1C2733D792A ft=1 fh=a510a895afb6c194 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\Marco\Downloads\CrystalDiskInfo6_1_12-en.exe"

ENDE ESET LOG FILE


Leider habe ich beim Scan von Partition D und externer Festplatte den Haken vergessen rauszumachen bei "Entdeckte Bedrohungen entfernen". Somit hier kein LOGFILE (wie dumm von mir).

Nachfolgend LOGFILE von Securitiy check (habe Antivir und firewall noch nicht aktiviert gehabt):

Results of screen317's Security Check version 0.99.83
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Adobe Flash Player 13.0.0.214
Mozilla Firefox (29.0.1)
Mozilla Thunderbird (24.6.0)
Google Chrome 33.0.1750.154
Google Chrome 34.0.1847.116
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Malwarebytes Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

ENDE EST LOGFILE:
Nachfolgend neues LOGFILE vom FRST

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-06-2014
Ran by Marco (administrator) on MARCO-PC on 19-06-2014 20:54:37
Running from C:\Users\Marco\Desktop
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
() C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM\...\Run: [PMBVolumeWatcher] => C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [599328 2010-03-24] (Sony Corporation)
HKU\S-1-5-21-4000187890-1113432505-3674514099-1000\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4000187890-1113432505-3674514099-1000\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3D8BA8F8D259CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://www.qone8.com/web/?type=ds&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J&q={searchTerms}
SearchScopes: HKCU - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://www.qone8.com/web/?type=ds&ts=1400086215&from=smt&uid=ST31000528AS_6VP3AM8JXXXX6VP3AM8J&q={searchTerms}
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Avira Savings Advisor BHO - {A18A516C-AA41-46A9-92DB-60208917E442} - C:\Program Files\avira\Internet Explorer\avira32.dll ()
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\6sbnhoy3.default-1402830633556
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-04-17]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-02-25] (Avira GmbH)
R1 {55685567-4840-4a91-962b-49a412e9485a}w; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys [52920 2014-06-12] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-19 20:46 - 2014-06-19 20:46 - 00854367 _____ () C:\Users\Marco\Desktop\SecurityCheck.exe
2014-06-19 10:38 - 2014-06-19 10:38 - 00000000 ____D () C:\Users\Marco\Desktop\FRST-OlderVersion
2014-06-18 06:15 - 2014-06-18 06:16 - 00001676 _____ () C:\Users\Marco\Desktop\ESETOnlineScannerApp.exe.lnk
2014-06-17 06:58 - 2014-06-17 06:58 - 00000000 ____D () C:\Program Files\ESET
2014-06-17 06:56 - 2014-06-17 06:56 - 02347384 _____ (ESET) C:\Users\Marco\Desktop\esetsmartinstaller_deu.exe
2014-06-15 13:53 - 2014-06-15 13:53 - 00000648 _____ () C:\Users\Marco\Desktop\JRT.txt
2014-06-15 13:48 - 2014-06-15 13:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-15 13:29 - 2014-06-15 13:31 - 00000000 ____D () C:\AdwCleaner
2014-06-15 13:28 - 2014-06-15 13:28 - 01333465 _____ () C:\Users\Marco\Downloads\adwcleaner_3.212.exe
2014-06-15 13:18 - 2014-06-16 06:08 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-06-15 13:06 - 2014-06-15 13:06 - 00095818 _____ () C:\Users\Marco\Desktop\MBAM_2014-06-14.txt
2014-06-15 12:56 - 2014-06-15 13:32 - 00166138 _____ () C:\Windows\PFRO.log
2014-06-15 12:34 - 2014-06-19 20:42 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-15 12:33 - 2014-06-15 12:33 - 00001068 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-15 12:33 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-15 12:33 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-15 12:33 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-15 11:32 - 2014-06-15 11:32 - 00001230 _____ () C:\Users\Marco\Desktop\Revo Uninstaller.lnk
2014-06-15 11:32 - 2014-06-15 11:32 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-14 16:52 - 2014-06-14 16:57 - 00000000 ____D () C:\Users\Marco\AppData\Local\Nero
2014-06-14 16:52 - 2014-06-14 16:52 - 00000000 ____D () C:\Users\Marco\AppData\Local\Nero_AG
2014-06-14 08:29 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-14 08:29 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-14 08:29 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-14 08:29 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-14 08:29 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-14 08:29 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-14 08:29 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-14 08:29 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-14 08:29 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-14 08:29 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-14 08:29 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-14 08:29 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-14 08:28 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-14 08:28 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-14 08:28 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-14 08:28 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-14 08:28 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-14 08:28 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-14 08:28 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-14 08:28 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-14 08:28 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-14 08:28 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-14 08:28 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-14 08:28 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-14 08:28 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-14 08:28 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-14 08:28 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-14 08:28 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-14 08:28 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-14 08:28 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-14 08:28 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-14 08:28 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-14 08:28 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-14 08:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-14 08:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-14 08:25 - 2014-06-12 14:52 - 00052920 _____ (StdLib) C:\Windows\system32\Drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys
2014-05-29 12:39 - 2014-05-29 12:39 - 00284388 _____ () C:\Users\Marco\Desktop\dp_hash_setup.zip
2014-05-29 12:39 - 2014-05-29 12:39 - 00001835 _____ () C:\Users\Marco\Desktop\dp_hash.lnk
2014-05-29 12:39 - 2014-05-29 12:39 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DP Hash
2014-05-29 12:39 - 2014-05-29 12:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DP Hash
2014-05-29 12:39 - 2014-05-29 12:39 - 00000000 ____D () C:\Program Files\DP Hash
2014-05-29 12:35 - 2014-05-29 12:45 - 1017118720 _____ () C:\Users\Marco\Desktop\ubuntu-14.04-desktop-i386.iso
2014-05-29 11:47 - 2014-06-19 20:32 - 00002486 _____ () C:\Windows\setupact.log
2014-05-29 11:47 - 2014-05-29 11:47 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-28 21:52 - 2014-05-28 21:52 - 00380416 _____ () C:\Users\Marco\Desktop\ui13orb8.exe
2014-05-28 21:17 - 2014-06-19 20:54 - 00008331 _____ () C:\Users\Marco\Desktop\FRST.txt
2014-05-28 21:17 - 2014-06-19 20:36 - 00028542 _____ () C:\Users\Marco\Desktop\FRST-alt.txt
2014-05-28 21:17 - 2014-05-28 21:17 - 00028333 _____ () C:\Users\Marco\Desktop\Addition.txt
2014-05-28 21:16 - 2014-06-19 20:54 - 01072128 _____ (Farbar) C:\Users\Marco\Desktop\FRST.exe
2014-05-28 21:16 - 2014-06-19 20:54 - 00000000 ____D () C:\FRST
2014-05-28 21:14 - 2014-05-28 21:14 - 00000472 _____ () C:\Users\Marco\Desktop\defogger_disable.log
2014-05-28 21:14 - 2014-05-28 21:14 - 00000000 _____ () C:\Users\Marco\defogger_reenable
2014-05-28 21:13 - 2014-05-28 21:13 - 00050477 _____ () C:\Users\Marco\Desktop\Defogger.exe
2014-05-28 09:11 - 2014-05-28 09:11 - 00000047 _____ () C:\Users\Marco\AppData\Roaming\WB.CFG
2014-05-27 22:33 - 2014-05-27 22:33 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Nero
2014-05-27 22:27 - 2014-06-15 12:16 - 00000000 ____D () C:\ProgramData\Nero
2014-05-27 22:23 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-05-27 22:23 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-05-27 22:17 - 2014-05-27 22:17 - 284895400 _____ (Nero AG) C:\Users\Marco\Downloads\81291-673291-nero.exe
2014-05-27 22:16 - 2014-05-27 22:16 - 00000000 ____D () C:\ProgramData\TEMP

==================== One Month Modified Files and Folders =======

2014-06-19 20:54 - 2014-05-28 21:17 - 00008331 _____ () C:\Users\Marco\Desktop\FRST.txt
2014-06-19 20:54 - 2014-05-28 21:16 - 01072128 _____ (Farbar) C:\Users\Marco\Desktop\FRST.exe
2014-06-19 20:54 - 2014-05-28 21:16 - 00000000 ____D () C:\FRST
2014-06-19 20:46 - 2014-06-19 20:46 - 00854367 _____ () C:\Users\Marco\Desktop\SecurityCheck.exe
2014-06-19 20:42 - 2014-06-15 12:34 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-19 20:37 - 2010-11-20 23:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-19 20:36 - 2014-05-28 21:17 - 00028542 _____ () C:\Users\Marco\Desktop\FRST-alt.txt
2014-06-19 20:36 - 2014-05-15 16:53 - 00512603 _____ () C:\Windows\WindowsUpdate.log
2014-06-19 20:32 - 2014-05-29 11:47 - 00002486 _____ () C:\Windows\setupact.log
2014-06-19 20:32 - 2014-04-17 02:24 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs
2014-06-19 20:32 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-19 10:54 - 2009-07-14 06:34 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-19 10:54 - 2009-07-14 06:34 - 00016656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-19 10:38 - 2014-06-19 10:38 - 00000000 ____D () C:\Users\Marco\Desktop\FRST-OlderVersion
2014-06-19 09:59 - 2014-05-05 06:52 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-18 06:16 - 2014-06-18 06:15 - 00001676 _____ () C:\Users\Marco\Desktop\ESETOnlineScannerApp.exe.lnk
2014-06-18 00:21 - 2014-04-17 01:31 - 00000000 ____D () C:\Users\Marco\AppData\Local\VirtualStore
2014-06-17 20:10 - 2014-04-27 17:00 - 00000000 ____D () C:\Users\Marco\Documents\Mein Steuer-Sparbuch Heute
2014-06-17 06:58 - 2014-06-17 06:58 - 00000000 ____D () C:\Program Files\ESET
2014-06-17 06:56 - 2014-06-17 06:56 - 02347384 _____ (ESET) C:\Users\Marco\Desktop\esetsmartinstaller_deu.exe
2014-06-16 20:26 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-06-16 17:38 - 2014-04-17 08:17 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-16 06:08 - 2014-06-15 13:18 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-06-15 13:53 - 2014-06-15 13:53 - 00000648 _____ () C:\Users\Marco\Desktop\JRT.txt
2014-06-15 13:48 - 2014-06-15 13:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-15 13:32 - 2014-06-15 12:56 - 00166138 _____ () C:\Windows\PFRO.log
2014-06-15 13:31 - 2014-06-15 13:29 - 00000000 ____D () C:\AdwCleaner
2014-06-15 13:31 - 2014-04-17 08:17 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-15 13:31 - 2014-04-17 08:17 - 00001015 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-15 13:31 - 2014-04-17 01:31 - 00001156 _____ () C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-15 13:28 - 2014-06-15 13:28 - 01333465 _____ () C:\Users\Marco\Downloads\adwcleaner_3.212.exe
2014-06-15 13:06 - 2014-06-15 13:06 - 00095818 _____ () C:\Users\Marco\Desktop\MBAM_2014-06-14.txt
2014-06-15 12:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Resources
2014-06-15 12:33 - 2014-06-15 12:33 - 00001068 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-15 12:33 - 2014-06-15 12:33 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-15 12:16 - 2014-05-27 22:27 - 00000000 ____D () C:\ProgramData\Nero
2014-06-15 11:32 - 2014-06-15 11:32 - 00001230 _____ () C:\Users\Marco\Desktop\Revo Uninstaller.lnk
2014-06-15 11:32 - 2014-06-15 11:32 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-15 11:03 - 2009-07-14 04:04 - 00000505 _____ () C:\Windows\win.ini
2014-06-14 16:57 - 2014-06-14 16:52 - 00000000 ____D () C:\Users\Marco\AppData\Local\Nero
2014-06-14 16:53 - 2014-04-17 01:31 - 00000000 ____D () C:\Users\Marco
2014-06-14 16:52 - 2014-06-14 16:52 - 00000000 ____D () C:\Users\Marco\AppData\Local\Nero_AG
2014-06-14 08:46 - 2014-04-17 03:05 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-14 08:46 - 2014-04-17 01:38 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-14 08:45 - 2014-04-17 03:05 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 14:52 - 2014-06-14 08:25 - 00052920 _____ (StdLib) C:\Windows\system32\Drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys
2014-05-30 11:18 - 2014-06-14 08:28 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-14 08:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-14 08:28 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-14 08:28 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-14 08:28 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-14 08:29 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-14 08:28 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-14 08:29 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-14 08:29 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-14 08:28 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-14 08:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-14 08:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-14 08:28 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-14 08:29 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-14 08:29 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-14 08:29 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-14 08:28 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-14 08:28 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-14 08:28 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-14 08:28 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-14 08:28 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-14 08:29 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-14 08:28 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-14 08:29 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-14 08:28 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-14 08:28 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-14 08:29 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-14 08:28 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-29 12:45 - 2014-05-29 12:35 - 1017118720 _____ () C:\Users\Marco\Desktop\ubuntu-14.04-desktop-i386.iso
2014-05-29 12:39 - 2014-05-29 12:39 - 00284388 _____ () C:\Users\Marco\Desktop\dp_hash_setup.zip
2014-05-29 12:39 - 2014-05-29 12:39 - 00001835 _____ () C:\Users\Marco\Desktop\dp_hash.lnk
2014-05-29 12:39 - 2014-05-29 12:39 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DP Hash
2014-05-29 12:39 - 2014-05-29 12:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DP Hash
2014-05-29 12:39 - 2014-05-29 12:39 - 00000000 ____D () C:\Program Files\DP Hash
2014-05-29 11:47 - 2014-05-29 11:47 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-29 11:27 - 2014-04-17 10:48 - 00000973 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-05-29 11:27 - 2014-04-17 10:48 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-28 21:52 - 2014-05-28 21:52 - 00380416 _____ () C:\Users\Marco\Desktop\ui13orb8.exe
2014-05-28 21:17 - 2014-05-28 21:17 - 00028333 _____ () C:\Users\Marco\Desktop\Addition.txt
2014-05-28 21:14 - 2014-05-28 21:14 - 00000472 _____ () C:\Users\Marco\Desktop\defogger_disable.log
2014-05-28 21:14 - 2014-05-28 21:14 - 00000000 _____ () C:\Users\Marco\defogger_reenable
2014-05-28 21:13 - 2014-05-28 21:13 - 00050477 _____ () C:\Users\Marco\Desktop\Defogger.exe
2014-05-28 20:59 - 2014-05-05 06:52 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-28 20:59 - 2014-05-05 06:52 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-28 09:11 - 2014-05-28 09:11 - 00000047 _____ () C:\Users\Marco\AppData\Roaming\WB.CFG
2014-05-27 22:33 - 2014-05-27 22:33 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\Nero
2014-05-27 22:31 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Cursors
2014-05-27 22:24 - 2014-04-18 09:53 - 00000000 ____D () C:\Program Files\MSXML 4.0
2014-05-27 22:17 - 2014-05-27 22:17 - 284895400 _____ (Nero AG) C:\Users\Marco\Downloads\81291-673291-nero.exe
2014-05-27 22:16 - 2014-05-27 22:16 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-27 18:50 - 2014-05-14 19:01 - 00000000 ____D () C:\Users\Marco\AppData\Roaming\FileAdvisor
2014-05-22 12:42 - 2014-04-17 02:30 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-22 12:42 - 2014-04-17 02:30 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-21 18:08 - 2014-04-27 16:32 - 00000583 _____ () C:\Windows\wiso.ini

Some content of TEMP:
====================
C:\Users\Marco\AppData\Local\Temp\avgnt.exe
C:\Users\Marco\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 00:58

==================== End Of Log ============================
--- --- ---
Was muss ich jetz mit den von ESET entdeckten files machen?

schrauber 20.06.2014 18:57
Da wird Adware in Programm angemeckert, die Programme kannste deinstallieren.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
R1 {55685567-4840-4a91-962b-49a412e9485a}w; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys [52920 2014-06-12] (StdLib)
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

magu1961 23.06.2014 05:29
Hallo Schrauber,

Frage, Du schreibst:
"Da wird Adware in Programm angemeckert, die Programme kannste deinstallieren"
welche Programme genau soll ich deinstallieren?
Bin a bissele confused.
Danke für Deine Antwort.


Nachfolgend Fixlog.txt nach Fixing wie Du es beschrieben hast.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:21-06-2014 01
Ran by Marco at 2014-06-22 14:44:47 Run:1
Running from C:\Users\Marco\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
R1 {55685567-4840-4a91-962b-49a412e9485a}w; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys [52920 2014-06-12] (StdLib)
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys

*****************

{55685567-4840-4a91-962b-49a412e9485a}w => Service stopped successfully.
{55685567-4840-4a91-962b-49a412e9485a}w => Service deleted successfully.
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w.sys => Moved successfully.

==== End of Fixlog ====


ok, habe sonst alles durchgeführt wi eoben beschrieben.

Herlichen Dank, ich finde Deine / Eure Hilfe total super.

Grüße
Marco

A C H T U N G:

oh fu..
malwarebytes antimalware hat eben routinemäßig gescant und eine Meldung gemacht.

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 23.06.2014
Suchlauf-Zeit: 06:17:57
Logdatei: mwamb.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.23.02
Rootkit Datenbank: v2014.06.20.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Marco

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 246073
Verstrichene Zeit: 6 Min, 35 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
Fängt das jetzt von vorne an?

schrauber 23.06.2014 18:45
Ich seh keinen Fund im MBAM Log.


Alles von DVDVideoSoft (Youtube to MP3 Converter und Co) deinstallieren, ebenso Avira.

magu1961 28.06.2014 18:08
Hallp Schrauber,

erst nochmals herzlichen Dank für Deine Hilfe!!!!!!!!!!!!!!!!!!!!!!!
Blöde Frage, warum Avira deinstallieren?
Grüße
Marco

schrauber 29.06.2014 11:10
Zitat:
Frage, Du schreibst:
"Da wird Adware in Programm angemeckert, die Programme kannste deinstallieren"
welche Programme genau soll ich deinstallieren?
Bin a bissele confused.
Weil Avira ebenso von ESET angemeckert wird. Weil Avira die ASK Toolbar installiet, Adware ;)


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:29 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131