Trojaner-Board - Windows 7 ständig Pop-ups mit wernung und Systemfehlerhinweisen sowie Update-Aufforderungen zu Reparatur von Windows

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7 ständig Pop-ups mit wernung und Systemfehlerhinweisen sowie Update-Aufforderungen zu Reparatur von Windows (https://www.trojaner-board.de/155293-windows-7-staendig-pop-ups-wernung-systemfehlerhinweisen-update-aufforderungen-reparatur-windows.html)

Dann bitte folgendes:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

So das hat funktioniert...

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014

Ran by SYSTEM on MININT-C8AVNOL on 24-06-2014 21:29:47

Running from g:\

Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 
 
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-28] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)

HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)

HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-24] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-24] (Symantec Corporation)

HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-01] (Dritek System Inc.)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-28] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-11] (Oracle Corporation)

HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)

HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-08] ()

HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-08] ()

HKU\Kerstin\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-04] (Google Inc.)

HKU\Kerstin\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)

HKU\Kerstin\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()

AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)

Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk ->  (No File)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} =>  No File

ShellIconOverlayIdentifiers-x32: EnhancedStorageShell -> {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} =>  No File

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  No File

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  No File

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  No File

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  No File

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  No File

ShellIconOverlayIdentifiers-x32: SharingPrivate -> {08244EE6-92F0-47f2-9FC9-929BAA2E7235} =>  No File
 

==================== Services (Whitelisted) =================
 

S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)

S2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)

S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)

S2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [318240 2014-06-21] ()

S2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [318240 2014-06-21] ()
 

==================== Drivers (Whitelisted) ====================
 

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)

S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)

S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-30] (AVAST Software)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()

S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()

S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)

S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)

S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)

S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()

S1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)

S1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-24 11:08 - 2014-06-24 11:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 09:13 - 2014-06-24 09:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 09:05 - 2014-06-24 09:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-21 09:11 - 2014-06-21 09:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 09:11 - 2014-06-21 09:11 - 00029208 _____ () C:\Windows\System32\Drivers\aswHwid.sys

2014-06-21 08:46 - 2014-06-24 21:29 - 00000000 ____D () C:\FRST

2014-06-21 08:28 - 2014-04-24 18:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\usp10.dll

2014-06-21 08:28 - 2014-04-24 18:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-21 08:28 - 2014-04-04 18:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

2014-06-21 08:28 - 2014-04-04 18:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS

2014-06-21 08:28 - 2014-03-26 06:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2014-06-21 08:28 - 2014-03-26 06:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2014-06-21 08:28 - 2014-03-26 06:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml6r.dll

2014-06-21 08:28 - 2014-03-26 06:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml3r.dll

2014-06-21 08:28 - 2014-03-26 06:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-21 08:28 - 2014-03-26 06:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-21 08:28 - 2014-03-26 06:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-21 08:28 - 2014-03-26 06:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-21 08:26 - 2014-06-21 08:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 08:22 - 2014-06-21 08:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 08:21 - 2014-06-21 08:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 01:22 - 2014-06-18 01:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 01:02 - 2014-06-18 01:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 00:57 - 2014-06-18 00:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 02:20 - 2014-06-17 02:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 00:40 - 2014-06-17 00:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe

2014-06-17 00:39 - 2014-06-17 00:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 02:16 - 2014-06-16 02:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 02:10 - 2014-06-16 02:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 02:09 - 2014-06-16 02:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 02:00 - 2014-06-16 02:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 01:59 - 2014-06-16 01:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 01:58 - 2014-06-16 01:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 01:07 - 2014-06-16 01:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-16 00:38 - 2014-06-16 00:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan

2014-06-16 00:37 - 2014-06-09 01:52 - 00061120 _____ (StdLib) C:\Windows\System32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

2014-06-10 03:49 - 2014-06-10 03:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 03:33 - 2014-06-10 03:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 03:15 - 2014-06-10 03:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 03:14 - 2014-06-10 03:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 03:12 - 2014-06-10 03:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 03:11 - 2014-06-10 03:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 03:09 - 2014-06-10 03:35 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 03:09 - 2014-06-10 03:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 03:08 - 2014-06-10 03:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 03:02 - 2014-06-10 03:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-06 01:27 - 2014-05-05 20:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2014-06-06 01:27 - 2014-05-05 20:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2014-06-06 01:27 - 2014-05-05 19:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-06 01:27 - 2014-05-05 19:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-06 01:27 - 2014-05-05 19:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2014-06-06 01:27 - 2014-05-05 18:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-06 01:26 - 2014-04-11 18:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2014-06-06 01:26 - 2014-04-11 18:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2014-06-06 01:26 - 2014-04-11 18:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll

2014-06-06 01:26 - 2014-04-11 18:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll

2014-06-06 01:26 - 2014-04-11 18:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe

2014-06-06 01:26 - 2014-04-11 18:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll

2014-06-06 01:26 - 2014-04-11 18:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll

2014-06-06 01:26 - 2014-04-11 18:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-06-06 01:26 - 2014-04-11 18:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-06-06 01:26 - 2014-03-04 01:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2014-06-06 01:26 - 2014-03-04 01:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll

2014-06-06 01:26 - 2014-03-04 01:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\System32\objsel.dll

2014-06-06 01:26 - 2014-03-04 01:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll

2014-06-06 01:26 - 2014-03-04 01:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll

2014-06-06 01:26 - 2014-03-04 01:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll

2014-06-06 01:26 - 2014-03-04 01:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll

2014-06-06 01:26 - 2014-03-04 01:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll

2014-06-06 01:26 - 2014-03-04 01:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\wincredprovider.dll

2014-06-06 01:26 - 2014-03-04 01:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe

2014-06-06 01:26 - 2014-03-04 01:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\System32\cngprovider.dll

2014-06-06 01:26 - 2014-03-04 01:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\System32\adprovider.dll

2014-06-06 01:26 - 2014-03-04 01:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\capiprovider.dll

2014-06-06 01:26 - 2014-03-04 01:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\dpapiprovider.dll

2014-06-06 01:26 - 2014-03-04 01:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\System32\dimsroam.dll

2014-06-06 01:26 - 2014-03-04 01:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll

2014-06-06 01:26 - 2014-03-04 01:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-06-06 01:26 - 2014-03-04 01:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-06-06 01:26 - 2014-03-04 01:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-06-06 01:26 - 2014-03-04 01:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-06-06 01:26 - 2014-03-04 01:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-06-01 09:32 - 2014-03-24 18:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll

2014-06-01 09:32 - 2014-03-24 18:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-06-01 06:13 - 2014-06-01 11:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 05:57 - 2014-06-01 09:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 05:49 - 2014-06-24 11:24 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
 

==================== One Month Modified Files and Folders =======
 

2014-06-24 21:29 - 2014-06-21 08:46 - 00000000 ____D () C:\FRST

2014-06-24 11:24 - 2014-06-01 05:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

2014-06-24 11:24 - 2010-11-17 07:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox

2014-06-24 11:23 - 2009-07-13 18:34 - 00000612 _____ () C:\Windows\win.ini

2014-06-24 11:22 - 2010-03-21 02:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-24 11:22 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-24 11:22 - 2009-07-13 20:51 - 00109769 _____ () C:\Windows\setupact.log

2014-06-24 11:16 - 2010-11-17 07:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox

2014-06-24 11:16 - 2010-03-20 09:53 - 01748120 _____ () C:\Windows\WindowsUpdate.log

2014-06-24 11:08 - 2014-06-24 11:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 10:56 - 2010-03-21 02:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-24 10:39 - 2014-04-01 06:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-24 09:17 - 2009-07-13 20:45 - 00017600 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-24 09:17 - 2009-07-13 20:45 - 00017600 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-24 09:13 - 2014-06-24 09:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 09:12 - 2012-08-12 04:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-06-24 09:05 - 2014-06-24 09:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-23 09:30 - 2009-07-13 21:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-22 11:08 - 2009-11-04 19:19 - 01029316 _____ () C:\Windows\PFRO.log

2014-06-21 09:12 - 2013-12-19 01:57 - 00085328 _____ (AVAST Software) C:\Windows\System32\Drivers\aswstm.sys

2014-06-21 09:12 - 2011-07-30 07:22 - 01039096 _____ (AVAST Software) C:\Windows\System32\Drivers\aswsnx.sys

2014-06-21 09:12 - 2010-03-21 12:21 - 00423240 _____ (AVAST Software) C:\Windows\System32\Drivers\aswsp.sys

2014-06-21 09:12 - 2010-03-21 12:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-06-21 09:11 - 2014-06-21 09:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 09:11 - 2014-06-21 09:11 - 00029208 _____ () C:\Windows\System32\Drivers\aswHwid.sys

2014-06-21 09:11 - 2013-03-25 01:54 - 00208416 _____ () C:\Windows\System32\Drivers\aswVmm.sys

2014-06-21 09:11 - 2013-03-25 01:54 - 00065776 _____ () C:\Windows\System32\Drivers\aswRvrt.sys

2014-06-21 09:11 - 2012-04-14 08:51 - 00093568 _____ (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys

2014-06-21 09:11 - 2011-01-19 09:48 - 00334648 _____ (AVAST Software) C:\Windows\System32\aswBoot.exe

2014-06-21 09:11 - 2010-03-21 12:21 - 00079184 _____ (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys

2014-06-21 09:10 - 2010-03-16 13:07 - 00699682 _____ () C:\Windows\System32\perfh007.dat

2014-06-21 09:10 - 2010-03-16 13:07 - 00149790 _____ () C:\Windows\System32\perfc007.dat

2014-06-21 09:10 - 2009-07-13 21:13 - 01620684 _____ () C:\Windows\System32\PerfStringBackup.INI

2014-06-21 08:42 - 2013-08-16 23:54 - 00000000 ____D () C:\Windows\System32\MRT

2014-06-21 08:40 - 2010-05-16 10:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

2014-06-21 08:40 - 2009-11-04 19:21 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-21 08:26 - 2014-06-21 08:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 08:22 - 2014-06-21 08:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 08:21 - 2014-06-21 08:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 01:23 - 2014-06-18 01:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 01:03 - 2014-06-18 01:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 00:57 - 2014-06-18 00:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 02:24 - 2014-06-17 02:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 00:40 - 2014-06-17 00:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe

2014-06-17 00:39 - 2014-06-17 00:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 02:16 - 2014-06-16 02:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 02:10 - 2014-06-16 02:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 02:09 - 2014-06-16 02:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 02:00 - 2014-06-16 02:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 01:59 - 2014-06-16 01:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 01:58 - 2014-06-16 01:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 01:16 - 2014-06-16 01:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-16 00:38 - 2014-06-16 00:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan

2014-06-16 00:38 - 2013-11-08 07:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan

2014-06-16 00:36 - 2013-12-15 01:28 - 00000000 ____D () C:\Program Files (x86)\WebSparkle

2014-06-10 05:39 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\NDF

2014-06-10 05:00 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache

2014-06-10 03:50 - 2014-06-10 03:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 03:35 - 2014-06-10 03:09 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 03:33 - 2014-06-10 03:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 03:15 - 2014-06-10 03:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 03:14 - 2014-06-10 03:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 03:12 - 2014-06-10 03:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 03:11 - 2014-06-10 03:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 03:09 - 2014-06-10 03:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 03:08 - 2014-06-10 03:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 03:02 - 2014-06-10 03:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-09 01:52 - 2014-06-16 00:37 - 00061120 _____ (StdLib) C:\Windows\System32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

2014-06-06 03:09 - 2014-03-21 08:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET

2014-06-01 12:01 - 2012-01-03 10:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-06-01 11:39 - 2014-06-01 06:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 09:43 - 2014-06-01 05:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 08:14 - 2013-12-15 02:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit

2014-06-01 05:49 - 2011-05-28 09:49 - 00001348 _____ () C:\Windows\wininit.ini
 

Some content of TEMP:

====================

C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcqtx8u.dll

C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe

C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE

C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe

C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe

C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe

C:\Users\Kerstin\AppData\Local\Temp\setup.exe

C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe

C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe

C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe

C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe
 
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== Restore Points  =========================
 

Restore point made on: 2014-04-28 11:32:32

Restore point made on: 2014-05-07 09:08:39

Restore point made on: 2014-05-07 09:55:12

Restore point made on: 2014-05-11 10:24:17

Restore point made on: 2014-05-13 02:15:32

Restore point made on: 2014-06-01 10:41:30

Restore point made on: 2014-06-01 12:02:26

Restore point made on: 2014-06-06 01:11:41

Restore point made on: 2014-06-06 02:21:03

Restore point made on: 2014-06-10 02:05:30

Restore point made on: 2014-06-21 08:19:37

Restore point made on: 2014-06-21 08:26:27

Restore point made on: 2014-06-21 08:31:16

Restore point made on: 2014-06-21 08:36:59

Restore point made on: 2014-06-21 09:09:11

Restore point made on: 2014-06-22 12:29:40
 

==================== Memory info =========================== 
 

Percentage of memory in use: 18%

Total physical RAM: 3956.5 MB

Available physical RAM: 3210.6 MB

Total Pagefile: 3954.65 MB

Available Pagefile: 3202.29 MB

Total Virtual: 8192 MB

Available Virtual: 8191.89 MB
 

==================== Drives ================================
 

Drive c: (ACER) (Fixed) (Total:285.3 GB) (Free:135.94 GB) NTFS

Drive e: (PQSERVICE) (Fixed) (Total:12.7 GB) (Free:2.43 GB) NTFS

Drive g: () (Removable) (Total:7.45 GB) (Free:5.68 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 1B5F1B5F)

Partition 1: (Not Active) - (Size=13 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 7 GB) (Disk ID: 001DE8BD)

Partition 1: (Active) - (Size=7 GB) - (Type=0B)
 
 

LastRegBack: 2014-06-22 11:45
 

==================== End Of Log ============================

--- --- ---

Dein Rechner scheint Probleme zu haben, Downloads korrekt abzuschliessen.
Deshalb bitte alle Tools die ich aufführe, per USB Stick von einem anderen Rechner downloaden.

Schritt 1

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 3

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 4

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte in der Antwort posten:

AdwCleaner Log
JRT Log
Malwarebytes Log
neues FRST Log

Hallo Timo,

das hat alles ohne murren geklappt. Ich habe mein Antivirusprogramm dazu deaktiviert, was allerdings nicht auszuschalten ging war das SPBOT Search & Destroy. Ich habe dann immer bestätigt, dass Änderungen zugelassen werden dürfen. In letzter Zeit macht dieses Programm kirre - ich kann es aber irgendwie nicht deaktivieren. Trotzdem hat alles geklappt und einiges wurde auch gefunden.

AdwCleaner Log

Code:

# AdwCleaner v3.213 - Bericht erstellt am 25/06/2014 um 18:57:26

# Aktualisiert 23/06/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Kerstin - HUGO

# Gestartet von : E:\adwcleaner_3.213.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\apn

Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar

Ordner Gelöscht : C:\ProgramData\Partner

Ordner Gelöscht : C:\ProgramData\QuickSet

Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar

Ordner Gelöscht : C:\Program Files (x86)\smart pc cleaner

[!] Ordner Gelöscht : C:\Program Files (x86)\WebSparkle

Ordner Gelöscht : C:\Users\Kerstin\AppData\Local\Temp\AskSearch

Ordner Gelöscht : C:\Users\Kerstin\AppData\Local\Temp\OCS

Ordner Gelöscht : C:\Users\Kerstin\Documents\smart pc cleaner

Ordner Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\ICQToolbarData

Ordner Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-1.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-10.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-11.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-12.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-13.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-14.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-2.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-3.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-4.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-5.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-6.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-7.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-8.xml

Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-9.xml
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ikgojpdbiniccokkgadmdheobjfdbbcg

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateWebSparkle_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateWebSparkle_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\utilWebSparkle_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\utilWebSparkle_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKLM\Software\Driver-Soft

Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar

Schlüssel Gelöscht : HKLM\Software\InstallIQ

Schlüssel Gelöscht : HKLM\Software\Uniblue
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17041
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
 

-\\ Mozilla Firefox v28.0 (de)
 

[ Datei : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\prefs.js ]
 

Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]

Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");

Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");

Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);

Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);

Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1342944049);

Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");

Zeile gelöscht : user_pref("icqtoolbar.history", "rennsteig||sonnenschutzfolie||wandtatoo||coachtisch||disentis%20schweiz%20hotel%20cucagna||disentis%20schweiz||wetter||w%C3%A4hrungsrechner||couchtisch||FA%20Gers||kal[...]

Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);

Zeile gelöscht : user_pref("icqtoolbar.installTime", "1289838458");

Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");

Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "0");

Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);

Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.6.28");

Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");

Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);

Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "128982929112898288521289838458614");

Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1343455487);

Zeile gelöscht : user_pref("icqtoolbar.version", "1.1.7");

Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);

Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);

Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);

Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);

Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);

Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=");
 

-\\ Google Chrome v35.0.1916.153
 

[ Datei : C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [8855 octets] - [25/06/2014 18:55:41]

AdwCleaner[S0].txt - [8478 octets] - [25/06/2014 18:57:26]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8538 octets] ##########

JRT Log

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by Kerstin on 25.06.2014 at 19:07:29,95

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 

Successfully stopped: [Service] update websparkle 

Successfully deleted: [Service] update websparkle 
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\Program Files (x86)\websparkle"
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\Kerstin\AppData\Roaming\mozilla\firefox\profiles\qjeq9mrb.default\prefs.js
 

user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" t

user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\"

user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar

user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o

user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o

user_pref("google.toolbar.id", "XZN5OLV9SAU6OL4CNSOAZEYMBT7DWCE4QT0Y89IER3DCTQJRBM");

user_pref("google.toolbar.install_id", "XZN5OLV9SAU6OL4CNSOAZEYMBT7DWCE4QT0Y89IER3DCTQJRBM");

user_pref("google.toolbar.search-icon", "data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7PT7/3zF6/9Ptu//RbHx/

Successfully deleted the following from C:\Users\Kerstin\AppData\Roaming\mozilla\firefox\profiles\qjeq9mrb.default\prefs.js
 

user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" t

user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\"

user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar

user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o

user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o

Emptied folder: C:\Users\Kerstin\AppData\Roaming\mozilla\firefox\profiles\qjeq9mrb.default\minidumps [13 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 25.06.2014 at 19:16:06,39

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Log

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 25.06.2014

Suchlauf-Zeit: 19:21:28

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.03.04.09

Rootkit Datenbank: v2014.02.20.01

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Kerstin
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 256463

Verstrichene Zeit: 10 Min, 29 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 4

PUP.Optional.WebSparkle.A, HKU\S-1-5-21-319184197-2032305868-326389486-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{9F56BAB3-2739-40ED-A8D0-1451657A9742}, In Quarantäne, [53f63bc4730775c1ce3b3f0230d24fb1], 

PUP.Optional.WebSparkle.A, HKU\S-1-5-21-319184197-2032305868-326389486-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{9F56BAB3-2739-40ED-A8D0-1451657A9742}, In Quarantäne, [53f63bc4730775c1ce3b3f0230d24fb1], 

PUP.Optional.WebSparkle.A, HKLM\SOFTWARE\WOW6432NODE\WebSparkle, In Quarantäne, [88c1609f0575e74f670afbc7937050b0], 

PUP.Optional.WebSparkle.A, HKU\S-1-5-21-319184197-2032305868-326389486-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WebSparkle, In Quarantäne, [15341ae52357270fff568e23ad56936d], 
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 3

Trojan.Agent.ED, C:\Users\Kerstin\AppData\Local\Temp\BIT7370.tmp, In Quarantäne, [2128e619304a9c9ad34ede3d07fa4fb1], 

PUP.Optional.InstalleRex, C:\Users\Kerstin\Downloads\Unmasking the Face_ A Guide to Recognizing Emotions From Facial.exe, In Quarantäne, [27220ef1c6b404324aae9ada8f72cb35], 

PUP.Optional.InstallIQ, C:\Users\Kerstin\Downloads\openfreely.exe, In Quarantäne, [f4553fc0e89270c6f874a5b7d72aa858], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

neues FRST Log

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014

Ran by Kerstin (administrator) on HUGO on 25-06-2014 19:42:08

Running from E:\

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

() C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(Dropbox, Inc.) C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(France Telecom SA) C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe

(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)

HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)

HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)

HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-05] (Google Inc.)

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {6e471881-5678-11e3-a9de-00262d8630e0} - E:\laucher.exe

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {77a9aa59-bb6f-11df-9b81-00262d8630e0} - E:\MicroLauncher.exe

AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk

ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()

Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5740&r=27360310l526l0418z155t54m1d66q

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default

FF SelectedSearchEngine: Google

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\Win32\npPDFXCviewNPPlugin.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]

FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]

FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]

FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]

FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-04-01]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-07-30]

FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

FF StartMenuInternet: FIREFOX.EXE - firefox.exe
 

Chrome: 

=======

CHR HomePage: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()

CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File

CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)

R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)

S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)

S2 Util WebSparkle; "C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-31] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()

R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()

S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)

S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)

S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-25] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()

R1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)

R1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-25 19:20 - 2014-06-25 19:37 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-25 19:19 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-25 19:19 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-25 19:19 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt

2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT

2014-06-25 18:55 - 2014-06-25 18:57 - 00000000 ____D () C:\AdwCleaner

2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-06-21 18:46 - 2014-06-25 19:42 - 00000000 ____D () C:\FRST

2014-06-21 18:28 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-21 18:28 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-21 18:28 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-21 18:28 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-21 18:28 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-21 18:28 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-21 18:28 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-21 18:28 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 11:22 - 2014-06-18 11:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 11:02 - 2014-06-18 11:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 12:20 - 2014-06-17 12:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 10:40 - 2014-06-17 10:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe

2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 11:07 - 2014-06-16 11:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan

2014-06-16 10:37 - 2014-06-09 11:52 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

2014-06-10 13:49 - 2014-06-10 13:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 13:09 - 2014-06-10 13:35 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-06 11:27 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-06 11:27 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-06 11:27 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-06 11:27 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-06 11:27 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-06 11:27 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-06 11:26 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-06-06 11:26 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-06-06 11:26 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-06-06 11:26 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-06-06 11:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-06-06 11:26 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-06-06 11:26 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-06-06 11:26 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-06-06 11:26 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-06-06 11:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-06-06 11:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-06-06 11:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-06-06 11:26 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-06-01 19:32 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-06-01 19:32 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-06-01 16:13 - 2014-06-01 21:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 15:57 - 2014-06-01 19:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 15:49 - 2014-06-25 19:01 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
 

==================== One Month Modified Files and Folders =======
 

2014-06-25 19:43 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-25 19:43 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-25 19:42 - 2014-06-21 18:46 - 00000000 ____D () C:\FRST

2014-06-25 19:39 - 2014-04-01 16:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-25 19:37 - 2014-06-25 19:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-25 19:35 - 2010-03-21 12:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-25 19:35 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-25 19:34 - 2010-11-17 17:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox

2014-06-25 19:34 - 2010-03-20 19:53 - 01800797 _____ () C:\Windows\WindowsUpdate.log

2014-06-25 19:34 - 2009-11-05 05:19 - 01030950 _____ () C:\Windows\PFRO.log

2014-06-25 19:34 - 2009-07-14 06:51 - 00109993 _____ () C:\Windows\setupact.log

2014-06-25 19:32 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins

2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-25 19:20 - 2014-06-25 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt

2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT

2014-06-25 19:01 - 2014-06-01 15:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

2014-06-25 19:01 - 2012-08-12 14:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-06-25 19:01 - 2010-11-17 17:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox

2014-06-25 18:57 - 2014-06-25 18:55 - 00000000 ____D () C:\AdwCleaner

2014-06-25 18:57 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini

2014-06-25 18:56 - 2010-03-21 12:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-23 19:30 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-21 19:12 - 2013-12-19 11:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-06-21 19:12 - 2011-07-30 17:22 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-06-21 19:12 - 2010-03-21 22:21 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-06-21 19:12 - 2010-03-21 22:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-06-21 19:11 - 2013-03-25 11:54 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-06-21 19:11 - 2013-03-25 11:54 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-06-21 19:11 - 2012-04-14 18:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-06-21 19:11 - 2011-01-19 19:48 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-06-21 19:11 - 2010-03-21 22:21 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-06-21 19:10 - 2010-03-16 23:07 - 00699682 _____ () C:\Windows\system32\perfh007.dat

2014-06-21 19:10 - 2010-03-16 23:07 - 00149790 _____ () C:\Windows\system32\perfc007.dat

2014-06-21 19:10 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-21 18:42 - 2013-08-17 09:54 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-21 18:40 - 2010-05-16 20:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-21 18:40 - 2009-11-05 05:21 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 11:23 - 2014-06-18 11:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 11:03 - 2014-06-18 11:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 12:24 - 2014-06-17 12:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 10:40 - 2014-06-17 10:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe

2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 11:16 - 2014-06-16 11:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan

2014-06-16 10:38 - 2013-11-08 17:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan

2014-06-10 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-06-10 15:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-06-10 13:50 - 2014-06-10 13:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 13:35 - 2014-06-10 13:09 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 13:19 - 2011-11-15 20:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy

2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-09 11:52 - 2014-06-16 10:37 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

2014-06-06 13:09 - 2014-03-21 18:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET

2014-06-01 22:01 - 2012-01-03 20:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-06-01 21:39 - 2014-06-01 16:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 19:43 - 2014-06-01 15:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 18:14 - 2013-12-15 12:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit

2014-06-01 15:49 - 2011-05-28 19:49 - 00001348 _____ () C:\Windows\wininit.ini

2014-06-01 15:49 - 2010-11-17 17:20 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
 

Some content of TEMP:

====================

C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpycnwyi.dll

C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe

C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE

C:\Users\Kerstin\AppData\Local\Temp\Quarantine.exe

C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe

C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe

C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe

C:\Users\Kerstin\AppData\Local\Temp\setup.exe

C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe

C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe

C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe

C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-22 21:45
 

==================== End Of Log ============================

--- --- ---

Meine Empfehlung: Spybot S&D deinstallieren. Malwarebytes ist die bessere Alternative. Du musst zwar in der Free Version "von Hand" scannen, aber dafür bist du in guten Händen.

Probier bitte aus:

Prüfe, ob du inzwischen wieder sauber Dateien downloaden und ausführen kannst, falls nicht
Deinstallier Spybot S&D
Prüfe erneut

Schreib mir dann, ob es geklappt hat.

Führe die folgenden Schritte auf jeden Fall aus.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

R1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)

R1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Danach:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Und dann nochmal:

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Hallo Timo,

das downloaden und ausführen von Dateien funktioniert wieder ohne Probleme, allerdings habe ich schon dem erstem Versuch Spybot deinstalliert (also wieß ich nicht ob es mit auch gegangen wäre). Ich habe das Eset Programm problemlos runterladen können. Dabei kamen auch keine komischen pop-ups mehr und keine sytemfehlermeldungen. Ich habe auf web seiten auch keine unterstrichenen Wörter mehr.
was ich noche nebenbei erwähnen möchte: ich habe beim löschen von spybot in den Programmen auch die Datei web-sparkle gefunden (die hatte sich im Internet immer am rand geöffnet mit diversen links). Ich habe diese Datei tatsächlich aus Versehen deinstalliert (ich wollte voanders hinklicken - und habe dabie deinstallieren geklickt). Das tut wahrscheinlich eh nichts zur Sache (hätte ja eh weg gemusst), wollte es aber nur mal erwähnt haben. Hier dann also der geforderte Rest:

Fixlog

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-06-2014

Ran by Kerstin at 2014-06-26 20:27:02 Run:2

Running from E:\

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

R1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)

R1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.

         

*****************
 

{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64 => Service stopped successfully.

{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64 => Service deleted successfully.

{058899d6-9704-4de3-aae7-17e9fc44c761}w64 => Service stopped successfully.

{058899d6-9704-4de3-aae7-17e9fc44c761}w64 => Service deleted successfully.

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys => Moved successfully.

"C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64." => File/Directory not found.
 

==== End of Fixlog ====

log eset

Code:

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7587

# api_version=3.0.2

# EOSSerial=12b4ca954c71e24cbfefcbabbbf612c3

# engine=18903

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-06-26 08:33:31

# local_time=2014-06-26 10:33:31 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='avast! Antivirus'

# compatibility_mode=783 16777213 100 97 350724 168235301 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 8853 155444661 0 0

# scanned=271469

# found=22

# cleaned=0

# scan_time=6934

sh=0B6A4A28A529F3FAE9C14804D67B08976F5C403E ft=1 fh=89e587294b6f9618 vn="Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\updateWebSparkle.exe.vir"

sh=0B6A4A28A529F3FAE9C14804D67B08976F5C403E ft=1 fh=89e587294b6f9618 vn="Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe.vir"

sh=3D4CC64B1EA729800B6AE85C16F7D308CC8F1A8F ft=1 fh=5ee4fb30f9d1bfe1 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\WebSparkle.BrowserAdapter.exe.vir"

sh=0E7636A92D455CF171FDABF92B97E8072E9EB1AA ft=1 fh=5fb503d5f4df3dc7 vn="Variante von Win64/BrowseFox.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\WebSparkle.PurBrowse64.exe.vir"

sh=1E73B2A630629D096D1903F0442F14E85DD78264 ft=1 fh=7add065383508a83 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\WebSparkleBAApp.dll.vir"

sh=C33C2787D0302CE14454CF396142B8ACF8C1FEC7 ft=1 fh=1c8256ac362d35e2 vn="Variante von Win32/BrowseFox.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\{058899d6-9704-4de3-aae7-17e9fc44c761}.dll.vir"

sh=0FD48FC786E8753E1FCE997ED07C92B426013F9A ft=1 fh=e17288734ceb1731 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.Bromon.dll.vir"

sh=E2A91279D391E414CF162DA05F8B742D3289BB72 ft=1 fh=e1262aff2468489e vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.BroStats.dll.vir"

sh=EF67C68E003D74B0E64D6A080EDE6DCE28687667 ft=1 fh=96adf3f4ba4e47ec vn="möglicherweise Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.BrowserAdapterS.dll.vir"

sh=B9A09041CCCB5C0CB30B69A95F179F01F63BB091 ft=1 fh=e7a8c984b8d3acb2 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.CompatibilityChecker.dll.vir"

sh=D65BFDAC8908F3F95A87CE6CA44B092F7AE294C1 ft=1 fh=f6235a9780e16f3e vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.FFUpdate.dll.vir"

sh=79826FD79583D6210CEF3F4C88C68B02F0453772 ft=1 fh=8a713370bd2c7629 vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.GCUpdate.dll.vir"

sh=127294EF57DD1C84BA7571899278E05BA9F6F65B ft=1 fh=4680720c9b2bf816 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.IEUpdate.dll.vir"

sh=C881D9A9B6ED97F5516874FC0CFB716D4D9621AA ft=1 fh=e4b2cf926a41bc34 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.PurBrowse.dll.vir"

sh=F49F92D964B9C5984EDDB591C634E35DC8A41428 ft=1 fh=70c42155351b53c9 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.PurBrowseG.dll.vir"

sh=FB88AE452A46C2C9FDB4DD74004C3CE2C60802D0 ft=1 fh=68f5c0cabda73c1f vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.Repmon.dll.vir"

sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kerstin\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"

sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}\Custom.dll"

sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}\Custom.dll"

sh=AFC5D79A125519B24DD96F763517408BE5E64DC2 ft=1 fh=a1542e0b8b7d232b vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kerstin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SEKW855J\SpeedUpMyPC-standalone-setup[1].exe"

sh=AE9401F65556B69533D957BA556C37C75CA9082B ft=1 fh=8d5324f717d1c6da vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kerstin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZPOQ1P0\Setup[1].exe"

sh=0E817328E2E09447EE8F8AE7E0D4B9BA21BED676 ft=1 fh=fc9d93cb113d639b vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe"

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014

Ran by Kerstin (administrator) on HUGO on 26-06-2014 23:08:38

Running from E:\

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

() C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(Dropbox, Inc.) C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(France Telecom SA) C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe

(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)

HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)

HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)

HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {6e471881-5678-11e3-a9de-00262d8630e0} - E:\laucher.exe

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {77a9aa59-bb6f-11df-9b81-00262d8630e0} - E:\MicroLauncher.exe

AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk

ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()

Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5740&r=27360310l526l0418z155t54m1d66q

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default

FF SelectedSearchEngine: Google

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\Win32\npPDFXCviewNPPlugin.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]

FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]

FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]

FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]

FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-04-01]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-07-30]

FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

FF StartMenuInternet: FIREFOX.EXE - firefox.exe
 

Chrome: 

=======

CHR HomePage: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()

CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File

CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)

R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)

S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)

S2 Util WebSparkle; "C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-31] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()

R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()

S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)

S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)

S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-26] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe

2014-06-25 19:20 - 2014-06-26 22:11 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-25 19:19 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-25 19:19 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-25 19:19 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt

2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT

2014-06-25 18:55 - 2014-06-25 18:57 - 00000000 ____D () C:\AdwCleaner

2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-06-21 18:46 - 2014-06-26 23:08 - 00000000 ____D () C:\FRST

2014-06-21 18:28 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-21 18:28 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-21 18:28 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-21 18:28 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-21 18:28 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-21 18:28 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-21 18:28 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-21 18:28 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 11:22 - 2014-06-18 11:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 11:02 - 2014-06-18 11:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 12:20 - 2014-06-17 12:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 11:07 - 2014-06-16 11:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan

2014-06-16 10:37 - 2014-06-09 11:52 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

2014-06-10 13:49 - 2014-06-10 13:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 13:09 - 2014-06-10 13:35 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-06 11:27 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-06 11:27 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-06 11:27 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-06 11:27 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-06 11:27 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-06 11:27 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-06 11:26 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-06-06 11:26 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-06-06 11:26 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-06-06 11:26 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-06-06 11:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-06-06 11:26 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-06-06 11:26 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-06-06 11:26 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-06-06 11:26 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-06-06 11:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-06-06 11:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-06-06 11:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-06-06 11:26 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-06-01 19:32 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-06-01 19:32 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-06-01 16:13 - 2014-06-01 21:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 15:57 - 2014-06-01 19:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 15:49 - 2014-06-26 19:58 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
 

==================== One Month Modified Files and Folders =======
 

2014-06-26 23:08 - 2014-06-21 18:46 - 00000000 ____D () C:\FRST

2014-06-26 22:56 - 2010-03-21 12:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-26 22:39 - 2014-04-01 16:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-26 22:11 - 2014-06-25 19:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-26 21:39 - 2010-03-20 19:53 - 01842845 _____ () C:\Windows\WindowsUpdate.log

2014-06-26 20:35 - 2010-03-16 23:07 - 00699682 _____ () C:\Windows\system32\perfh007.dat

2014-06-26 20:35 - 2010-03-16 23:07 - 00149790 _____ () C:\Windows\system32\perfc007.dat

2014-06-26 20:35 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe

2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy

2014-06-26 20:08 - 2009-11-05 02:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-06-26 20:04 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-26 20:04 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-26 20:02 - 2009-11-05 05:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone

2014-06-26 20:00 - 2009-11-05 05:32 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone

2014-06-26 20:00 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-06-26 19:58 - 2014-06-01 15:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

2014-06-26 19:58 - 2012-08-12 14:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-06-26 19:58 - 2010-11-17 17:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox

2014-06-26 19:58 - 2010-11-17 17:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox

2014-06-26 19:55 - 2010-03-21 12:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-26 19:55 - 2009-11-05 05:19 - 01031304 _____ () C:\Windows\PFRO.log

2014-06-26 19:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-26 19:55 - 2009-07-14 06:51 - 00110049 _____ () C:\Windows\setupact.log

2014-06-25 19:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins

2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-25 19:20 - 2014-06-25 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt

2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT

2014-06-25 18:57 - 2014-06-25 18:55 - 00000000 ____D () C:\AdwCleaner

2014-06-25 18:57 - 2010-11-15 18:27 - 00000000 ____D () C:\ProgramData\ICQ

2014-06-25 18:57 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini

2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-23 19:30 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-21 19:12 - 2013-12-19 11:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-06-21 19:12 - 2011-07-30 17:22 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-06-21 19:12 - 2010-03-21 22:21 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-06-21 19:12 - 2010-03-21 22:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-06-21 19:11 - 2013-03-25 11:54 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-06-21 19:11 - 2013-03-25 11:54 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-06-21 19:11 - 2012-04-14 18:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-06-21 19:11 - 2011-01-19 19:48 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-06-21 19:11 - 2010-03-21 22:21 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-06-21 18:42 - 2013-08-17 09:54 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-21 18:40 - 2010-05-16 20:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-21 18:40 - 2009-11-05 05:21 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 11:23 - 2014-06-18 11:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 11:03 - 2014-06-18 11:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 12:24 - 2014-06-17 12:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 11:16 - 2014-06-16 11:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus

2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan

2014-06-16 10:38 - 2013-11-08 17:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan

2014-06-10 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-06-10 15:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-06-10 13:50 - 2014-06-10 13:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 13:35 - 2014-06-10 13:09 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-09 11:52 - 2014-06-16 10:37 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

2014-06-06 13:09 - 2014-03-21 18:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET

2014-06-01 22:01 - 2012-01-03 20:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-06-01 21:39 - 2014-06-01 16:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 19:43 - 2014-06-01 15:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 18:14 - 2013-12-15 12:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit

2014-06-01 15:49 - 2011-05-28 19:49 - 00001348 _____ () C:\Windows\wininit.ini

2014-06-01 15:49 - 2010-11-17 17:20 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
 

Some content of TEMP:

====================

C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprhfpxv.dll

C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe

C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE

C:\Users\Kerstin\AppData\Local\Temp\Quarantine.exe

C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe

C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe

C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe

C:\Users\Kerstin\AppData\Local\Temp\setup.exe

C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe

C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe

C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe

C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-22 21:45
 

==================== End Of Log ============================

--- --- ---

Ja, das Web Sparke löschen hast du gut gemacht :sword2:
Ich würd dich aber noch bitten, einiges mehr zu deinstallieren.
Einige Sachen davon hast du evtl schon deinstalliert, aber ich liste nochmal alles auf, was Anfangs installiert war.

Schritt 1

Adware & Co. deinstallieren

Lade Dir bitte von hier http://deeprybka.trojaner-board.de/b...ninstaller.pngRevo Uninstaller herunter.
Installiere und starte das Programm.
Lösche bitte folgende Programme

Code:

McAfee Security Scan Plus Spybot - Search & Destroy WebSparkle Adobe Flash Player 10 ActiveX Adobe Flash Player 12 Plugin Adobe Reader 9.5.5 MUI Java 7 Update 25
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
http://deeprybka.trojaner-board.de/b.../uninstall.PNG http://deeprybka.trojaner-board.de/b...o/moderat2.PNG
Reste löschen:
Klicke auf http://deeprybka.trojaner-board.de/b.../selectall.PNG dann auf http://deeprybka.trojaner-board.de/b...evo/delete.PNG und dann auf http://deeprybka.trojaner-board.de/b...evo/weiter.PNG.

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Schritt 2

Revo Uninstaller-Junkdateien bereinigen

Starte bitte den Revo Uninstaller erneut falls er geschlossen wurde
Wähle "Tools" aus der oberen Leiste, wähle dann" Optimierungen" - "Junkdateien bereinigen" aus
Klicke in der oberen Leiste auf "Scan"
Nach Beendigung des Scans, klicke in der oberen Leiste auf "Lösche"

Schritt 3

Hab beim Fix "gepfuscht", das kann ich so nicht stehen lassen :blah:
Und da wir das Tool grad nochmal bemühen, löschen wir auch noch Reste:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}

C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe"

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 4

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Hallo Timo,

also Web sparkle und Spybot waren scheinbar vollständig deinstalliert - die wurden von REVO uninstaller nicht mehr gefunden. McAffee wurde ebenfalls nicht gefunden - das habe ich von der Systemsteuerung aus deinstalliert.
Ich habe dann die Junkdateien suchen lassen - und da habe ich es mit der Angst zu tun bekommen. Darunter waren viele Dateien, die ich noch brauche. Ich habe ein spezielles Softwareprogramm für medizinische Datenauswertungen, das hat Datensätze gespeichert, die ich noch benötige. Alle diese Daten habe ich natürlich auch auf einer externen festplatte, aber ich glaube die Datensätze für dieses bestimmte programm (suempathy100) kann ich nur öffnen wenn die datensätze direkt auf der festplatte gespeichert sind (bin mir aber auch nicht sicher). stutzig macht mich allerdings die Endung ".TMP", die bei den Junkdateien angezeigt wird (sonst benötigt dieses Programm Dateien mit den Endungen SDA, SDM und SDR. Ich bin verwirrt. Wenn ich alle Junkdateien lösche, kann ich die Daten dann noch öffnen?

Ich hoffe ich konnte mich irgendwie verständlich machen.

Insgeamt aber nocheinmal herzlichen Dank für deine Hilfe.

Lief denn das Programm während des Junkdateien-Scans ?

Es ist nicht unüblich, das Programme während des Betriebs temporäre Dateien erzeugen.

Hallo Timo,

ich habe allen Mut zusammengenommen und bei den Junkdateien auf löschen gedrückt - und es ist tatsächlich nichts passiert. Ich kann das besagte Programm ganz normal benutzen und alle Datensätze öffnen sich ohne zu murren (hab dann erstmal einen Schanps getrunken). Das Programm lief nicht während des Scans.
Zwei Junkdateien ließen sich allerdings nicht löschen, weil windows diese angeblcih benutzt ( C:\Windows\ServiceProfiles\AppData\Local\~FontCache-FontFace.dat und C:\Windows\ServiceProfiles\AppData\Local\~FontCache-System.dat). Ich verrate dir sicher kein Geheimnis, wenn ich dir sage, dass ich mit diesem Schulli nichts anfangen kann.
Den Rest habe ich nach Anleitung weiter durchgeführt. Bitte nicht wundern. Zwischendurch hat sie Malewarebytes gemeldet und wieder was komisches gefunden, Ich habe dass dann wieder in die Quarantäne geschickt und das Suchlaufprotokoll als txt gespeichert. Ich schicke dir das nur nochmal zu Sicherheit mit. Diese Protokolle kann ich in Zukunft sicher für mich behalten oder?

Fixlog

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-06-2014

Ran by Kerstin at 2014-07-01 10:42:34 Run:3

Running from E:\

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys

C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}

C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe"

         

*****************
 

"C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys" => File/Directory not found.

C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D} => Moved successfully.

C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe => Moved successfully.
 

==== End of Fixlog ====

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2014

Ran by Kerstin (administrator) on HUGO on 01-07-2014 10:43:38

Running from E:\

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe

(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

() C:\Windows\PLFSetI.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

() C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe

(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe

(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe

(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe

(France Telecom SA) C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe

(Dropbox, Inc.) C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)

HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)

HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)

HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)

HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)

HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)

HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)

HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)

HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)

HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)

HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {6e471881-5678-11e3-a9de-00262d8630e0} - E:\laucher.exe

HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {77a9aa59-bb6f-11df-9b81-00262d8630e0} - E:\MicroLauncher.exe

AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk

ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk

ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()

Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5740&r=27360310l526l0418z155t54m1d66q

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default

FF SelectedSearchEngine: Google

FF Homepage: hxxp://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\Win32\npPDFXCviewNPPlugin.dll No File

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]

FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]

FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]

FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]

FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-04-01]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-07-30]

FF StartMenuInternet: FIREFOX.EXE - firefox.exe
 

Chrome: 

=======

CHR HomePage: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()

CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll No File

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File

CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File

CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)

R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)

S2 Util WebSparkle; "C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-31] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()

R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()

S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)

S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)

S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-01] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-27 19:29 - 2014-06-27 19:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kerstin\Desktop\revosetup95.exe

2014-06-27 19:29 - 2014-06-27 19:29 - 00001268 _____ () C:\Users\Kerstin\Desktop\Revo Uninstaller.lnk

2014-06-27 19:29 - 2014-06-27 19:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe

2014-06-26 20:06 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-26 20:06 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-26 20:06 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-26 20:06 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-26 20:06 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-26 20:06 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-26 20:06 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-26 20:06 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-26 20:06 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-26 20:06 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-26 20:06 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-26 20:06 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-26 20:06 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-26 20:06 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-26 20:06 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-26 20:06 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-26 20:06 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-26 20:06 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-26 20:06 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-26 20:06 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-26 20:06 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-26 20:06 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-26 20:06 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-26 20:06 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-26 20:06 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-26 20:06 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-26 20:06 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-26 20:06 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-26 20:06 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-26 20:06 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-26 20:06 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-26 20:06 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-26 20:06 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-26 20:06 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-26 20:06 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-26 20:06 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-26 20:06 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-26 20:06 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-26 20:06 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-26 20:06 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-26 20:06 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-26 20:06 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-26 20:06 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-26 20:06 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-26 20:06 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-26 20:06 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-26 20:06 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-26 20:06 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-26 20:06 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-26 20:06 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-26 20:06 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-26 20:06 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-25 19:20 - 2014-07-01 10:30 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-25 19:19 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-06-25 19:19 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-06-25 19:19 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt

2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT

2014-06-25 18:55 - 2014-06-25 18:57 - 00000000 ____D () C:\AdwCleaner

2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-06-21 18:46 - 2014-07-01 10:43 - 00000000 ____D () C:\FRST

2014-06-21 18:28 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-21 18:28 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-21 18:28 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-21 18:28 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-21 18:28 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-21 18:28 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-21 18:28 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-21 18:28 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 11:22 - 2014-06-18 11:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 11:02 - 2014-06-18 11:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 12:20 - 2014-06-17 12:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 11:07 - 2014-06-16 11:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-10 13:49 - 2014-06-10 13:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 13:09 - 2014-06-10 13:35 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-06 11:26 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2014-06-06 11:26 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2014-06-06 11:26 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2014-06-06 11:26 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2014-06-06 11:26 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2014-06-06 11:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-06-06 11:26 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-06-06 11:26 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-06-06 11:26 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-06-06 11:26 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-06-06 11:26 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll

2014-06-06 11:26 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-06-06 11:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2014-06-06 11:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2014-06-06 11:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll

2014-06-06 11:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-06-06 11:26 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-06-01 19:32 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-06-01 19:32 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-06-01 16:13 - 2014-06-01 21:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 15:57 - 2014-06-01 19:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 15:49 - 2014-07-01 10:32 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
 

==================== One Month Modified Files and Folders =======
 

2014-07-01 10:43 - 2014-06-21 18:46 - 00000000 ____D () C:\FRST

2014-07-01 10:42 - 2013-11-27 14:19 - 00000000 ____D () C:\ProgramData\InstallMate

2014-07-01 10:39 - 2014-04-01 16:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-01 10:38 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-01 10:38 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-01 10:37 - 2010-03-16 23:07 - 00699682 _____ () C:\Windows\system32\perfh007.dat

2014-07-01 10:37 - 2010-03-16 23:07 - 00149790 _____ () C:\Windows\system32\perfc007.dat

2014-07-01 10:37 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-01 10:33 - 2010-11-17 17:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox

2014-07-01 10:32 - 2014-06-01 15:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

2014-07-01 10:32 - 2010-11-17 17:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox

2014-07-01 10:30 - 2014-06-25 19:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-01 10:30 - 2010-03-21 12:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-01 10:29 - 2009-11-05 05:19 - 01034070 _____ () C:\Windows\PFRO.log

2014-07-01 10:29 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-01 10:29 - 2009-07-14 06:51 - 00110217 _____ () C:\Windows\setupact.log

2014-07-01 10:28 - 2012-01-03 20:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM

2014-07-01 10:28 - 2010-03-20 19:53 - 01958377 _____ () C:\Windows\WindowsUpdate.log

2014-07-01 10:18 - 2010-03-21 12:01 - 00000000 ____D () C:\Users\Kerstin\Doktorarbeit

2014-07-01 10:18 - 2010-03-20 19:55 - 00000000 ____D () C:\Users\Kerstin

2014-07-01 10:03 - 2010-03-21 12:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-01 09:58 - 2012-08-12 14:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-06-27 21:12 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache

2014-06-27 20:05 - 2013-11-08 17:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan

2014-06-27 19:57 - 2010-03-21 12:43 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-27 19:57 - 2010-03-21 12:43 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-27 19:42 - 2009-11-05 02:38 - 00000000 ____D () C:\Program Files (x86)\Adobe

2014-06-27 19:41 - 2010-04-05 19:16 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Adobe

2014-06-27 19:41 - 2009-11-05 02:38 - 00000000 ____D () C:\ProgramData\Adobe

2014-06-27 19:29 - 2014-06-27 19:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kerstin\Desktop\revosetup95.exe

2014-06-27 19:29 - 2014-06-27 19:29 - 00001268 _____ () C:\Users\Kerstin\Desktop\Revo Uninstaller.lnk

2014-06-27 19:29 - 2014-06-27 19:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe

2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy

2014-06-26 20:08 - 2009-11-05 02:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-06-26 20:02 - 2009-11-05 05:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone

2014-06-26 20:00 - 2009-11-05 05:32 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone

2014-06-26 20:00 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2014-06-25 19:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins

2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-25 19:20 - 2014-06-25 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt

2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT

2014-06-25 18:57 - 2014-06-25 18:55 - 00000000 ____D () C:\AdwCleaner

2014-06-25 18:57 - 2010-11-15 18:27 - 00000000 ____D () C:\ProgramData\ICQ

2014-06-25 18:57 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini

2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe

2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe

2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg

2014-06-23 19:30 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-21 19:12 - 2013-12-19 11:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-06-21 19:12 - 2011-07-30 17:22 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-06-21 19:12 - 2010-03-21 22:21 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-06-21 19:12 - 2010-03-21 22:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-06-21 19:11 - 2013-03-25 11:54 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-06-21 19:11 - 2013-03-25 11:54 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-06-21 19:11 - 2012-04-14 18:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-06-21 19:11 - 2011-01-19 19:48 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-06-21 19:11 - 2010-03-21 22:21 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-06-21 18:42 - 2013-08-17 09:54 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-21 18:40 - 2010-05-16 20:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-21 18:40 - 2009-11-05 05:21 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe

2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe

2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe

2014-06-18 11:23 - 2014-06-18 11:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe

2014-06-18 11:03 - 2014-06-18 11:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe

2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe

2014-06-17 12:24 - 2014-06-17 12:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe

2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe

2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe

2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe

2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe

2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe

2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe

2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe

2014-06-16 11:16 - 2014-06-16 11:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe

2014-06-10 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-06-10 13:50 - 2014-06-10 13:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe

2014-06-10 13:35 - 2014-06-10 13:09 - 00000136 _____ () C:\Windows\Reimage.ini

2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe

2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB

2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe

2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe

2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe

2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe

2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe

2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe

2014-06-06 13:09 - 2014-03-21 18:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET

2014-06-01 21:39 - 2014-06-01 16:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung

2014-06-01 19:43 - 2014-06-01 15:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01

2014-06-01 18:14 - 2013-12-15 12:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit

2014-06-01 15:49 - 2011-05-28 19:49 - 00001348 _____ () C:\Windows\wininit.ini

2014-06-01 15:49 - 2010-11-17 17:20 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
 

Some content of TEMP:

====================

C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptuyjkv.dll

C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe

C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE

C:\Users\Kerstin\AppData\Local\Temp\Quarantine.exe

C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe

C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe

C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe

C:\Users\Kerstin\AppData\Local\Temp\setup.exe

C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe

C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe

C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe

C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe

C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-22 21:45
 

==================== End Of Log ============================

--- --- ---

mbam

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 01.07.2014

Suchlauf-Zeit: 09:57:56

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.07.01.02

Rootkit Datenbank: v2014.07.01.01

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Kerstin
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 296003

Verstrichene Zeit: 25 Min, 50 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 0

(No malicious items detected)
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 1

PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys, In Quarantäne, [05519ffbdc9fa096b19a54b5e91b3ec2], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Keine Angst, die beiden Dateien sind legitim und auch so einfach nicht löschbar.
Mein Holzauge sieht auch keine aktiven Infektionen mehr, die Logs sind sauber.

Damit können wir uns ans "aufräumen" machen:

Aufräumen:
Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Update: Firefox, Addons und Plugins

Klicke auf http://www.trojaner-board.de/picture...&pictureid=324 > Hilfe > Über Firefox

Warte bis das Update geladen ist, klicke auf Update installieren und lasse Firefox neu starten.

Prüfe bitte, ob weitere Updates vorliegen oder ob Firefox aktuell ist.

Klicke nun auf http://www.trojaner-board.de/picture...&pictureid=324 > Add-ons > http://www.trojaner-board.de/picture...&pictureid=326 > Auf Updates überprüfen

Nach einem weiteren Neustart von Firefox sollte alles aktuell sein.

Prüfe bitte auch (regelmässig), ob folgende Links fehlende Updates bei deinen Plugins zeigen:
PluginCheck-Schnelltest

Mozilla Plugin-Check

Update: Adobe Reader

Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Haken für den McAfee SecurityScan bzw. Google Chrome.

Flash Player veraltet !

Deinstalliere bitte deine aktuelle Version von Adobe Player

Start--> Systemsteuerung--> Software--> Adobe Player und lade dir die neue Version von Hier herunter-
Entferne den Haken für den McAfee SecurityScan bzw. Google Chrome.

Dein Java ist nicht mehr aktuell.
Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 60 ) herunter laden.
Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
Klicke erneut OK.

schneller Plugin-Test: PluginCheck

und der Rest ?

Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems.

Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7 / 8 : Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti-Viren-Programm und zusätzlicher Schutz

Gehe sicher, dass du immer nur eine Anti-Viren Software installiert hast und dass diese auch up to date ist!
MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion bietet zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
AdwCleaner
Dieses Tool erkennt eine Vielzahl von Werbeprogrammen (Adware) und unerwümschten Programmen (PUPs).
Starte das Tool einmal die Woche und lass es laufen. Sollte eine neue Version verfügbar sein, so wird dies angezeigt und du kannst dir die neueste Version direkt auf den Desktop downloaden.
SpywareBlaster
Eine kurze Einführung findest du Hier
WOT (Web of trust)
Dieses AddOn warnt dich, bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Mozilla Firefox

Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
NoScript
Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt, wenn Du es bestätigst.
AdblockPlus
Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
Es spart außerdem Downloadkapazität.

Performance

Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von Registry Cleanern.
Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link:
Miekemoes Blogspot ( MVP )

Was du vermeiden solltest:

Klicke nicht auf alles, nur weil es dich dazu auffordert und schön bunt ist.
Verwende keine P2P oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie z.B. deinFoto.jpg.exe.
Lade keine Software von Softonic oder Chip herunter, da diese Installer oft mit Adware oder unerünschter Software versehen sind!

Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen?

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Hallo Timo,

Holzauge? Ja ja - unter den Blinden ist der Einäugige der König...
Ich hatte leider viel Stress auf Arbeit und daher hatte ich erst heute abend Zeit, den Endspurt anzutreten und man glaubt es kaum - ich bin wieder auf ein Problem gestoßen (eigentlich zwei):
Es gibt auf meinem Computer eine Java(32-bit) und eine Flash Player (32-bit) Version. Diese finde ich direkt unter Systemsteuerung, ohne zuerst auf Programme zu klicken. Beide Dateien kann ich nicht deinstallieren, löschen oder verschieben.
Was ist denn davon zu halten?
:confused:

Hast du denn die dazugehörigen Programme mit dem Revo Uninstaller oder über Systemsteuerung - Programme - Programm deinstallieren, deinstalliert ?

Die 2 Einträge Flash Player (32-bit) und Java (32-bit) sind immmer in der Systemsteuerung, wenn man Java oder Flash Player installiert hat. Darüber kannst du weitere Einstellungen zu Flash oder Java vornehmen.

Hier hatte ich dich gebeten, Flash+Java zu deinstallieren (da veraltet bzw. unsichere Versionen mit bekannten Sicherheitslücken).

Hallo Timo,

es hat etwas gedauert - aber gut Ding will ja bekanntlich Weile haben.
Habe auch die letzten Schritte durchgeführt. Die anderen Programme waren natürlich schon deinstalliert.
Also hiermit nocheinmal vielen lieben Dank für deine Hilfe.

Liebe Grüße
Kerstin