Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 7 ständig Pop-ups mit wernung und Systemfehlerhinweisen sowie Update-Aufforderungen zu Reparatur von Windows (https://www.trojaner-board.de/155293-windows-7-staendig-pop-ups-wernung-systemfehlerhinweisen-update-aufforderungen-reparatur-windows.html)

1Stift 16.06.2014 10:37

Windows 7 ständig Pop-ups mit wernung und Systemfehlerhinweisen sowie Update-Aufforderungen zu Reparatur von Windows
 
ich habe seit ca. einer Woche dass Problem, dass sich im Iternet ständig pop-up fenster öffnen (Werbung und Meldungen, dass mein Computer bedroht sei und ich diverse updates runter laden soll). Zudem sind auch immer wieder Wörter bunt und unterstrichen. Wenn ich mit der Maus darüber gehe,tauchen ebenso komische update aufforderungen auf.
Ich habe keine Ahnung von Viren und Trojaner und ich möchte es vermeiden, Windows zu deinstallieren, weil ich wichtige Programme nicht verlieren möchte.
Kann mir jemand helfen?

Warlord711 16.06.2014 10:48

Hallo 1Stift

:hallo:

Mein Name ist Timo und ich werde Dir bei deinem Problem behilflich sein.



  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scans durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist immer der sicherste Weg.

Wir "arbeiten" hier alle freiwillig und in unserer Freizeit *hust*. Daher kann es bei Antworten zu Verzögerungen kommen.
Solltest du innerhalb 48 Std keine Antwort von mir erhalten, dann schreib mit eine PM
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis ich oder jemand vom Team sagt, dass Du clean bist.

Wichtig:
Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst. Ich bedanke mich für deine Geduld :)

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


1Stift 16.06.2014 11:09

zuersteinmal vielen Dank, für deine Hilfe.

wenn ich versuche diese Datei herunterzuladen egal ob 32 oder 64 bit, kommt beim Ausführen der Datei eine Fehlermeldung. Es steht dann da: "Diese Datei verfügt über keine gültige Signitau, die den Herausgeber verifiziert. Sie sollten nur Software ausführen, die von Herausgebern stammt, denen Sie vertrauen."
Gehe ich dann trotzdem auf Ausführen kommt folgende Fehlermeldung: C:\Users\Kerstin\Downloads\FRST(1).exe ist keine zulässige Win32-Anwendung.

Was habe ich denn jetzt falsch gemacht?
Un nur so zur Info: wie gesagt ich bin frph wenn ich HIlfe bekomme. Ich bin selbst berufsdtätig und arbeite im Schichtsystem. diese Woche habe ich Spätdienst und arbeite am Vormittag ev. ab 00:00Uhr am Computer.

Vielen Dank

Warlord711 16.06.2014 12:05

Kannst du bitte nochmal versuchen, die Datei herunterzuladen ? Vielleicht ist der Download fehlerhaft. Speicher die Datei auch bitte auf den Desktop ab oder kopiere Sie nach dem Download dorthin.

1Stift 17.06.2014 09:50

Hallo Timo,

ich habe gestern meine guten Manieren vergessen und vergessen mich vorzustellen. Mein Name ist Kerstin.
Mein Probelm von gestern besteht leider immernoch. Ich habe die 64-Bit Version einmal nach dem Download auf dem Desktop gespeichert und einmal direkt über Ziel speichern unter auf dem Desktop gespeichert. Zusätzlich habe ich die gleichen Varianten mit der älteren Version, die dort zum Download angeboten wird, versucht. Es kommt leider immer wieder die gleiche Fehlermeldung wie gestern und ich kann den Scan nicht starten.
Gibt es noch eine andere Seite von der ich das ganze runterladen kann?
Vielleicht hängt das aber auch dem Zeug zusammen, was ich mir da eingefangen habe?

Warlord711 17.06.2014 10:01

Hallo Kerstin !

Dann versuche bitte die Alternativseite:

Farbar Recovery Scan Tool Download

1Stift 17.06.2014 11:06

So das ganz hat jetzt ewig gedauert - mit dem Ergebnis der gleichen Fehlermeldung.
Leider hängt google auch immer wieder, sodass ich tw. auch erst mit Verzögerung deine Nachrichten bekomme.
Was nun?

Warlord711 17.06.2014 12:05

Kannst du denn andere Dateien aus dem Internet laden und ausführen ?

1Stift 18.06.2014 10:08

Hallo Timo,

so wie es aussieht kann ich auch keine anderen Dateien laden und ausführen. Hab aus SPaß an der Freude versucht Kaspersky zu laden und auszuführen. Beim Ausführen kam wieder die Meldung, dass dies keine zulässige Win32-Anwendung ist. Vorher wird mir wieder erzählt, dass es keine gültige Signatur gibt...

Gibt es noch Hoffnung oder muss ich das System neu installieren?

Warlord711 19.06.2014 15:24

Bitte führe diese Anleitung durch:

http://www.trojaner-board.de/85464-f...usfuehren.html

1Stift 21.06.2014 18:00

Hallo Timo,

über Umwege habe ich das ganze jetzt geschafft. Über die Fixexe Datei und die Ausweichvariante hat das auch nicht geklappt. Ich habe die FRST64 Datei auf einem anderen sauberen Rechner auf einen USB-Stick runtergeladen. Die Dateien habe ich vom Stick aus am betroffenen Rechner im abgesicherten Modus ohne Netzwerkverbindungen gestartet. Das hat dann tatsächlich funktioniert. Nun folgen die FRST.txt und Addition.txt Dateien

Danke Kerstin

FRST.txt

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-06-2014 01
Ran by Kerstin (administrator) on HUGO on 21-06-2014 18:47:17
Running from E:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Safe Mode (minimal)


==================== Processes (Whitelisted) =================



==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [avast5] => C:\Program Files\Alwil Software\Avast5\avastUI.exe [3764024 2013-12-19] (AVAST Software)
HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3764024 2013-12-19] (AVAST Software)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-05] (Google Inc.)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {6e471881-5678-11e3-a9de-00262d8630e0} - E:\laucher.exe
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {77a9aa59-bb6f-11df-9b81-00262d8630e0} - E:\MicroLauncher.exe
AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5740&r=27360310l526l0418z155t54m1d66q
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\Win32\npPDFXCviewNPPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-10.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-11.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-12.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-13.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-14.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-4.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-5.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-6.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-7.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-8.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-9.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-10.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-11.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-12.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-13.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-14.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-4.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-5.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-6.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-7.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-8.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-9.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: ICQ Toolbar - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012-08-13]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: ICQ Toolbar - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012-08-13]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-04-01]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-07-30]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR HKLM-x32\...\Chrome\Extension: [ikgojpdbiniccokkgadmdheobjfdbbcg] - C:\Program Files (x86)\WebSparkle\ikgojpdbiniccokkgadmdheobjfdbbcg.crx [2013-09-02]

==================== Services (Whitelisted) =================

S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2013-12-19] (AVAST Software)
S2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
S2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [318240 2014-06-21] ()
S2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [318240 2014-06-21] ()

==================== Drivers (Whitelisted) ====================

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-19] (AVAST Software)
S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-19] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-19] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-19] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-19] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-12] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-31] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-19] ()
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)
S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)
S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)
S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)
S1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-21 18:46 - 2014-06-21 18:47 - 00000000 ____D () C:\FRST
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02066384 _____ () C:\Users\Kerstin\Desktop\FRST64(5).exe
2014-06-21 18:12 - 2014-06-21 18:12 - 00001205 _____ () C:\Users\Kerstin\Desktop\FixNCR.reg
2014-06-21 18:10 - 2014-06-21 18:11 - 00000335 _____ () C:\Users\Kerstin\Desktop\FixExe.reg
2014-06-18 11:22 - 2014-06-18 11:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:02 - 2014-06-18 11:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:20 - 2014-06-17 12:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 12:01 - 2014-06-17 12:01 - 02067160 _____ () C:\Users\Kerstin\Desktop\FRST64(3).exe
2014-06-17 10:40 - 2014-06-17 10:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-17 10:38 - 2014-06-17 10:38 - 02057276 _____ () C:\Users\Kerstin\Desktop\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:07 - 2014-06-16 11:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 10:37 - 2014-06-09 11:52 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-10 13:49 - 2014-06-10 13:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:35 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-06 11:27 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-06 11:27 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-06 11:27 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-06 11:27 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-06 11:27 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-06 11:27 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-06 11:26 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-06-06 11:26 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-06-06 11:26 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-06-06 11:26 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-06-06 11:26 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-06-06 11:26 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-06-06 11:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-06-01 19:32 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-06-01 19:32 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-06-01 16:13 - 2014-06-01 21:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 15:57 - 2014-06-01 19:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 15:49 - 2014-06-21 18:18 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

==================== One Month Modified Files and Folders =======

2014-06-21 18:47 - 2014-06-21 18:46 - 00000000 ____D () C:\FRST
2014-06-21 18:47 - 2010-03-16 23:07 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-06-21 18:47 - 2010-03-16 23:07 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-06-21 18:47 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-21 18:42 - 2013-08-17 09:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-21 18:42 - 2010-03-20 19:53 - 01449500 _____ () C:\Windows\WindowsUpdate.log
2014-06-21 18:40 - 2010-05-16 20:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-21 18:40 - 2009-11-05 05:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-21 18:39 - 2014-04-01 16:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-21 18:36 - 2010-11-17 17:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:25 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-21 18:25 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-21 18:23 - 2012-08-12 14:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02066384 _____ () C:\Users\Kerstin\Desktop\FRST64(5).exe
2014-06-21 18:18 - 2014-06-01 15:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
2014-06-21 18:18 - 2010-11-17 17:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox
2014-06-21 18:16 - 2010-03-21 12:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-21 18:16 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-21 18:15 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-21 18:14 - 2009-07-14 06:51 - 00109153 _____ () C:\Windows\setupact.log
2014-06-21 18:12 - 2014-06-21 18:12 - 00001205 _____ () C:\Users\Kerstin\Desktop\FixNCR.reg
2014-06-21 18:11 - 2014-06-21 18:10 - 00000335 _____ () C:\Users\Kerstin\Desktop\FixExe.reg
2014-06-21 17:56 - 2010-03-21 12:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-18 11:23 - 2014-06-18 11:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:03 - 2014-06-18 11:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:24 - 2014-06-17 12:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 12:01 - 2014-06-17 12:01 - 02067160 _____ () C:\Users\Kerstin\Desktop\FRST64(3).exe
2014-06-17 10:40 - 2014-06-17 10:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-17 10:38 - 2014-06-17 10:38 - 02057276 _____ () C:\Users\Kerstin\Desktop\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:16 - 2014-06-16 11:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 10:38 - 2013-11-08 17:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-16 10:36 - 2013-12-15 11:28 - 00000000 ____D () C:\Program Files (x86)\WebSparkle
2014-06-10 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-10 15:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-10 13:50 - 2014-06-10 13:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:35 - 2014-06-10 13:09 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:19 - 2011-11-15 20:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-09 11:52 - 2014-06-16 10:37 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-06 13:09 - 2014-03-21 18:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET
2014-06-01 22:01 - 2012-01-03 20:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-01 21:39 - 2014-06-01 16:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 19:43 - 2014-06-01 15:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 18:14 - 2013-12-15 12:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit
2014-06-01 15:49 - 2011-05-28 19:49 - 00001348 _____ () C:\Windows\wininit.ini
2014-06-01 15:49 - 2010-11-17 17:20 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4ql2vq.dll
C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe
C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Kerstin\AppData\Local\Temp\setup.exe
C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe
C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-10 14:44

==================== End Of Log ============================

--- --- ---



Addition.txt
Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-06-2014 01
Ran by Kerstin at 2014-06-21 18:48:33
Running from E:\
Boot Mode: Safe Mode (minimal)
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7112 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7112 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye Webcam (HKLM-x32\...\{7760D94E-B1B5-40A0-9AA0-ABF942108755}) (Version: 5.2.9.3 - Suyin Optronics Corp)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.5.0715 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.6.0.6090 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.6.0.6090 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.2.152.32 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{DBCE1208-433D-4D3E-A26A-CB1B5E71A8F5}) (Version: 1.4.17.35005 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.4.17.35005 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.1.0.381 - Amazon Services LLC)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
ATI Catalyst Install Manager (HKLM\...\{11F38253-8940-FFDA-D131-B14120C357E4}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2011 - Avast Software)
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
Broadcom Gigabit NetLink Controller (HKLM\...\{A325B368-A9EC-40EF-A95C-9DEAD3683AE3}) (Version: 12.33.03 - Broadcom Corporation)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
CanoScan LiDE 110 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_cnq2414) (Version:  - )
Card Detector for Option Icon 515 (HKLM-x32\...\CardDetectorICON515) (Version: 1.1.2.0 - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2009.1209.2335.42329 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.1209.2335.42329 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2009.1209.2335.42329 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2009.1209.2335.42329 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.1209.2335.42329 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2009.1209.2335.42329 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2009.1209.2335.42329 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Czech (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Danish (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Dutch (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help English (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Finnish (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help French (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help German (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Greek (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Italian (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Japanese (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Korean (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Polish (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Russian (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Spanish (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Swedish (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Thai (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
CCC Help Turkish (x32 Version: 2009.1209.2334.42329 - ATI) Hidden
ccc-core-static (x32 Version: 2009.1209.2335.42329 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2009.1209.2335.42329 - ATI) Hidden
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version:  - Oberon Media)
Cisco Systems VPN Client 5.0.07.0290 (HKLM\...\{467D5E81-8349-4892-9E81-C3674ED8E451}) (Version: 5.0.7 - Cisco Systems, Inc.)
Citrix Authentication Manager (x32 Version: 4.0.0.53726 - Citrix Systems, Inc.) Hidden
Citrix Receiver (DV) (x32 Version: 13.4.0.25 - Citrix Systems, Inc.) Hidden
Citrix Receiver (HDX Flash-Umleitung) (x32 Version: 13.4.0.25 - Citrix Systems, Inc.) Hidden
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 13.4.0.25 - Citrix Systems, Inc.)
Citrix Receiver (USB) (x32 Version: 13.4.0.25 - Citrix Systems, Inc.) Hidden
Citrix Receiver Inside (x32 Version: 3.4.0.29585 - Citrix Systems, Inc.) Hidden
Citrix Receiver Updater (x32 Version: 3.4.0.29577 - Citrix Systems, Inc.) Hidden
Citrix Receiver(Aero) (x32 Version: 13.4.0.25 - Citrix Systems, Inc.) Hidden
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
EndNote X3 (HKLM-x32\...\{86B3F2D6-AC2B-4E88-8AE1-F2F77F781B0C}) (Version: 13.0.0.4094 - Thomson Reuters)
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version:  - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1002 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Internet Everywhere deinstallieren (HKLM-x32\...\{BEWINTERNET-CH}.UninstallSuite) (Version:  - )
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
K-Lite Codec Pack 7.0.0 (Standard) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.0.0 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
mediscript Hammerexamen (HKLM-x32\...\{1231D46E-3174-4F1F-859E-41DCB0D070D2}) (Version: 5.0.0 - Elsevier GmbH)
Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version:  - Oberon Media)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Ultimate 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.0.162.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.0.162.0 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
Online Plug-in (x32 Version: 13.4.0.25 - Citrix Systems, Inc.) Hidden
Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41418}) (Version: 3.61.0 - dotPDN LLC)
PDF-Viewer (HKLM\...\{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1) (Version: 2.0.50.0 - Tracker Software Products Ltd)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
ResearchSoft Direct Export Helper (HKLM-x32\...\ResearchSoft Direct Export Helper) (Version:  - )
Self-Service Plug-in (x32 Version: 3.4.0.33684 - Citrix Systems, Inc.) Hidden
Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sophos Windows Shortcut Exploit Protection Tool (HKLM-x32\...\{54171711-61B7-4B0E-A209-12FF5B3BD183}) (Version: 1.0.0.0 - Sophos)
SPSS 15.0 für Windows [Auswertung Version] (HKLM-x32\...\{6D9B9CF3-1E9C-45B6-B41E-5CF568605556}) (Version: 15.0.1 - SPSS Inc.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
TeamViewer 5 (HKLM-x32\...\TeamViewer 5) (Version: 5.0.8421  - TeamViewer GmbH)
Überwachungstool für die Intel® Turbo-Boost-Technik (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.186.6 - Intel)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ULTIMATER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2881065) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{B7EF38F7-1D58-4085-A9A4-0F6C69A5AA1E}) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VLC media player 1.1.3 (HKLM-x32\...\VLC media player) (Version: 1.1.3 - VideoLAN)
WebSparkle (HKLM\...\WebSparkle) (Version: 2013.12.07.011955 - WebSparkle) <==== ATTENTION
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
Wise Registry Cleaner 6.14 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version:  - WiseCleaner.com, Inc.)
WISO Steuer 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version:  - )

==================== Restore Points  =========================

28-04-2014 19:01:43 Windows Update
28-04-2014 19:32:07 Windows Update
07-05-2014 17:08:07 Windows Update
07-05-2014 17:55:06 Windows Update
11-05-2014 18:23:17 Windows Update
13-05-2014 10:14:48 Windows Update
01-06-2014 18:41:06 Geplanter Prüfpunkt
01-06-2014 20:02:04 Windows Update
06-06-2014 09:09:34 Windows Update
06-06-2014 10:20:28 Windows Update
10-06-2014 10:04:56 Windows Update
21-06-2014 16:16:00 avast! antivirus system restore point
21-06-2014 16:26:14 Windows Update
21-06-2014 16:31:10 avast! antivirus system restore point
21-06-2014 16:36:53 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2011-11-15 20:22 - 00438443 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com
127.0.0.1        www.100sexlinks.com
127.0.0.1        100sexlinks.com
127.0.0.1        10sek.com
127.0.0.1        www.10sek.com
127.0.0.1        www.1-2005-search.com
127.0.0.1        1-2005-search.com
127.0.0.1        123fporn.info
127.0.0.1        www.123fporn.info
127.0.0.1        123haustiereundmehr.com
127.0.0.1        www.123haustiereundmehr.com
127.0.0.1        123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {0666B8B5-0254-4CDC-BDB2-011F21B402B7} - System32\Tasks\{FDCAE0D5-2D0B-4827-9273-490DB752506B} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {07E00FAB-4F5B-40F8-92BE-9D9006C83502} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2012-11-02] (Microsoft)
Task: {109BFCBD-94EE-467D-A8D4-8CB7217CEB13} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-01] (Adobe Systems Incorporated)
Task: {1BC7DB76-EBF1-452D-AB55-40CB22D22060} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-10-01] (Acer)
Task: {20C1BE03-F597-4857-AAA5-D061A01238F2} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2012-11-02] (Microsoft Corporation)
Task: {667540B5-E479-4754-AE77-BB627262EEE1} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2012-11-02] (Microsoft Corporation)
Task: {B0EA23C9-BA2B-4D12-B808-7A67A9FADFF7} - System32\Tasks\McQcModifier-5c47-a7b0 => C:\ProgramData\McQcModifier-5c47-a7b0\McQcModifier-5c47-a7b0.cmd [2009-08-29] ()
Task: {BADC4FA6-4809-4B9B-ACAA-C2184E1332FD} - System32\Tasks\{230639C5-1C63-4394-8C81-1DC3C6E8591F} => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\Launcher\Launcher.exe [2009-11-12] (France Telecom SA)
Task: {BDDBB04A-27AF-44DE-AF38-73CACB10228D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-21] (Google Inc.)
Task: {C1C6488E-BCED-4000-9548-F5F6BA5B0738} - System32\Tasks\{FD274F6B-FE19-4429-9AFD-A18E6FB0950A} => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\Launcher\Launcher.exe [2009-11-12] (France Telecom SA)
Task: {E4E5B5DF-2A2E-407F-B5EE-1132B1718E23} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-21] (Google Inc.)
Task: {F92A6DBF-3CAF-42D1-871E-BAD07CBB6A91} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2013-12-19] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:0B9176C0
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: aswRvrt
Description: aswRvrt
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswRvrt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: aswVmm
Description: aswVmm
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswVmm
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/21/2014 06:26:58 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (06/21/2014 06:26:52 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (06/21/2014 06:23:07 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (06/21/2014 06:23:06 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (06/18/2014 10:57:16 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (06/17/2014 11:53:58 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/16/2014 00:51:16 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (06/16/2014 11:18:34 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (06/16/2014 11:18:24 AM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (06/10/2014 02:57:01 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.


System errors:
=============
Error: (06/21/2014 06:45:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:04 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/21/2014 06:45:04 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (06/21/2014 06:45:04 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}


Microsoft Office Sessions:
=========================
Error: (05/23/2013 02:42:56 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3418 seconds with 2520 seconds of active time.  This session ended with a crash.

Error: (05/23/2013 01:24:58 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 851 seconds with 780 seconds of active time.  This session ended with a crash.

Error: (05/23/2013 01:00:06 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 431 seconds with 420 seconds of active time.  This session ended with a crash.

Error: (05/23/2013 00:52:41 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 8000 seconds with 7620 seconds of active time.  This session ended with a crash.

Error: (05/23/2013 10:38:38 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 121 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (05/23/2013 10:36:09 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1877 seconds with 1500 seconds of active time.  This session ended with a crash.


==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3956.5 MB
Available physical RAM: 3222.68 MB
Total Pagefile: 7911.18 MB
Available Pagefile: 7212.94 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:285.3 GB) (Free:136.34 GB) NTFS
Drive e: () (Removable) (Total:7.45 GB) (Free:5.68 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 1B5F1B5F)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 001DE8BD)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================


Warlord711 23.06.2014 11:51

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

Reg: reg query "HKCU\Software\Classes\.exe" /S
Reg: reg query "HKCU\Software\Classes\exefile" /S
Reg: reg query "HKCU\Software\Classes\secfile" /S
Reg: reg query "HKCU\Software\Classes\ah" /S
Reg: reg query "HKCR\.exe" /S
Reg: reg query "HKCR\secfile" /S
Reg: reg query "HKCR\exefile" /S
Reg: reg query "HKCR\pezfile" /S
Reg: reg query "HKCR\sezfile" /S
Reg: reg query "HKCR\ah" /S

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

1Stift 23.06.2014 18:39

Hallo Timo,

hier die Fixlog.txt

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-06-2014 01
Ran by Kerstin at 2014-06-23 19:27:37 Run:1
Running from E:\
Boot Mode: Safe Mode (minimal)
==============================================

Content of fixlist:
*****************
Reg: reg query "HKCU\Software\Classes\.exe" /S
Reg: reg query "HKCU\Software\Classes\exefile" /S
Reg: reg query "HKCU\Software\Classes\secfile" /S
Reg: reg query "HKCU\Software\Classes\ah" /S
Reg: reg query "HKCR\.exe" /S
Reg: reg query "HKCR\secfile" /S
Reg: reg query "HKCR\exefile" /S
Reg: reg query "HKCR\pezfile" /S
Reg: reg query "HKCR\sezfile" /S
Reg: reg query "HKCR\ah" /S
       
*****************


========= reg query "HKCU\Software\Classes\.exe" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg query "HKCU\Software\Classes\exefile" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg query "HKCU\Software\Classes\secfile" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg query "HKCU\Software\Classes\ah" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg query "HKCR\.exe" /S =========


HKEY_CLASSES_ROOT\.exe
    (Standard)    REG_SZ    exefile
    Content Type    REG_SZ    application/x-msdownload

HKEY_CLASSES_ROOT\.exe\PersistentHandler
    (Standard)    REG_SZ    {098f2470-bae0-11cd-b579-08002b30bfeb}



========= End of Reg: =========


========= reg query "HKCR\secfile" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg query "HKCR\exefile" /S =========


HKEY_CLASSES_ROOT\exefile
    (Standard)    REG_SZ    Application
    EditFlags    REG_BINARY    38070000
    FriendlyTypeName    REG_EXPAND_SZ    @%SystemRoot%\System32\shell32.dll,-10156

HKEY_CLASSES_ROOT\exefile\DefaultIcon
    (Standard)    REG_SZ    %1

HKEY_CLASSES_ROOT\exefile\shell

HKEY_CLASSES_ROOT\exefile\shell\open
    EditFlags    REG_BINARY    00000000

HKEY_CLASSES_ROOT\exefile\shell\open\command
    (Standard)    REG_SZ    "%1" %*

HKEY_CLASSES_ROOT\exefile\shell\runas
    HasLUAShield    REG_SZ   

HKEY_CLASSES_ROOT\exefile\shell\runas\command
    (Standard)    REG_SZ    "%1" %*

HKEY_CLASSES_ROOT\exefile\shell\runasuser
    (Standard)    REG_SZ    @shell32.dll,-50944
    Extended    REG_SZ   
    SuppressionPolicyEx    REG_SZ    {F211AA05-D4DF-4370-A2A0-9F19C09756A7}

HKEY_CLASSES_ROOT\exefile\shell\runasuser\command
    DelegateExecute    REG_SZ    {ea72d00e-4960-42fa-ba92-7792a7944c1d}

HKEY_CLASSES_ROOT\exefile\shellex

HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers
    (Standard)    REG_SZ    Compatibility

HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers\Compatibility
    (Standard)    REG_SZ    {1d27f844-3a1f-4410-85ac-14651078412d}

HKEY_CLASSES_ROOT\exefile\shellex\DropHandler
    (Standard)    REG_SZ    {86C86720-42A0-1069-A2E8-08002B30309D}

HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers

HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page
    (Standard)    REG_SZ    {513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}

HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}
    (Standard)    REG_SZ   

HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}
    (Standard)    REG_SZ   



========= End of Reg: =========


========= reg query "HKCR\pezfile" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg query "HKCR\sezfile" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


========= reg query "HKCR\ah" /S =========

FEHLER: Der angegebene Registrierungsschlssel bzw. Wert wurde nicht gefunden.


========= End of Reg: =========


==== End of Fixlog ====


Warlord711 23.06.2014 20:06

Ok, versuchen wir erst einmal, die Fehlermeldung beim Starten von Programmen in den Griff zu bekommen.

Start--> ausführen--> notepad (reinschreiben)--> ok Kopiere nun bitte folgenden Text aus der Code-Box in das leere Textdokument
Code:

Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\.exe]

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
32,00,5c,00,73,00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,\
00,2c,00,2d,00,31,00,30,00,31,00,35,00,36,00,00,00

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]
"HasLUAShield"=""

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runasuser]
@="@shell32.dll,-50944"
"Extended"=""
"SuppressionPolicyEx"="{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"

[HKEY_CLASSES_ROOT\exefile\shell\runasuser\command]
"DelegateExecute"="{ea72d00e-4960-42fa-ba92-7792a7944c1d}"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers]
@="Compatibility"

[HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers\Compatibility]
@="{1d27f844-3a1f-4410-85ac-14651078412d}"

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[-HKEY_CLASSES_ROOT\SystemFileAssociations\.exe]

[HKEY_CLASSES_ROOT\SystemFileAssociations\.exe]
"FullDetails"="prop:System.PropGroup.Description;System.FileDescription;System.ItemTypeText;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateModified;System.Language;*System.Trademarks;*System.OriginalFileName"
"InfoTip"="prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size"
"TileInfo"="prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids]
"exefile"=hex(0):

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

  • Speichere es nun unter regfix.reg
  • achte darauf, dass bei Datei-Typ "Alle Dateien" angegeben ist
  • nun sollte http://image.hijackthis.eu/upload/regfix_kl.jpg auf Deinem Desktop erscheinen
  • Mache nun einen Doppelklick auf die Datei regfix.reg
  • Bestätige mit Ja, dann drücke OK
  • Starte den Rechner neu auf
Hier findest Du eine bebilderte Anleitung


Danach bitte den Rechner im Normalmodus starten und eine Datei die vorher nicht funktionierte, ausführen.

1Stift 24.06.2014 18:28

Hallo Timo,

dieser Versuch ist leider fehlgeschalgen. Ich habe alles nach Anweisung befolgt. Nach dem Speichern unter Desktop erschien auch das beschriebene Symbol auf dem Dektop - nur hieß die Datei dann nicht regfix.reg sondern nur "regfix" . Ich habe dann trotzdem die Anweisungen weiter befolgt und am Ende kam auch die Mitteilung: "Die Schlüssel und Werte von C:user\Kerstin\Desktop\regfix.reg wurden erfolgreich in die Registrierung eingetragen." Ich habe den Laptop neu gestartet und ich habe versucht die FRST-Datei zu starten (die war noch auf dem Desktop) - das hat dann nicht funktioniert. Ich habe diese erneut aus dem Internet runtergeladen, was dann auch nicht funktioniert hat. Zudem habe ich die regfix - Datei auch mal auf dem USB-Stick gespreichert und es darüber versucht - hat leidern auch nicht funktioniert...

Warlord711 24.06.2014 19:23

Dann bitte folgendes:

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


1Stift 24.06.2014 20:35

So das hat funktioniert...


FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by SYSTEM on MININT-C8AVNOL on 24-06-2014 21:29:47
Running from g:\
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.




==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-22] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-10] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-28] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-24] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-24] (Symantec Corporation)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-01] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-28] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-11] (Oracle Corporation)
HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-08] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-08] ()
HKU\Kerstin\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-04] (Google Inc.)
HKU\Kerstin\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\Kerstin\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()
AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)
Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} =>  No File
ShellIconOverlayIdentifiers-x32: EnhancedStorageShell -> {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  No File
ShellIconOverlayIdentifiers-x32: SharingPrivate -> {08244EE6-92F0-47f2-9FC9-929BAA2E7235} =>  No File

==================== Services (Whitelisted) =================

S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)
S2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-10] (Egis Technology Inc.)
S2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [318240 2014-06-21] ()
S2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [318240 2014-06-21] ()

==================== Drivers (Whitelisted) ====================

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)
S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-30] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)
S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)
S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)
S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)
S1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-24 11:08 - 2014-06-24 11:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 09:13 - 2014-06-24 09:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 09:05 - 2014-06-24 09:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-21 09:11 - 2014-06-21 09:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 09:11 - 2014-06-21 09:11 - 00029208 _____ () C:\Windows\System32\Drivers\aswHwid.sys
2014-06-21 08:46 - 2014-06-24 21:29 - 00000000 ____D () C:\FRST
2014-06-21 08:28 - 2014-04-24 18:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\System32\usp10.dll
2014-06-21 08:28 - 2014-04-24 18:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-21 08:28 - 2014-04-04 18:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2014-06-21 08:28 - 2014-04-04 18:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2014-06-21 08:28 - 2014-03-26 06:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2014-06-21 08:28 - 2014-03-26 06:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2014-06-21 08:28 - 2014-03-26 06:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml6r.dll
2014-06-21 08:28 - 2014-03-26 06:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2014-06-21 08:28 - 2014-03-26 06:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-21 08:28 - 2014-03-26 06:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-21 08:28 - 2014-03-26 06:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-21 08:28 - 2014-03-26 06:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-21 08:26 - 2014-06-21 08:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 08:22 - 2014-06-21 08:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 08:21 - 2014-06-21 08:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 01:22 - 2014-06-18 01:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 01:02 - 2014-06-18 01:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 00:57 - 2014-06-18 00:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 02:20 - 2014-06-17 02:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 00:40 - 2014-06-17 00:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe
2014-06-17 00:39 - 2014-06-17 00:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 02:16 - 2014-06-16 02:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 02:10 - 2014-06-16 02:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 02:09 - 2014-06-16 02:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 02:00 - 2014-06-16 02:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 01:59 - 2014-06-16 01:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 01:58 - 2014-06-16 01:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 01:07 - 2014-06-16 01:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 00:38 - 2014-06-16 00:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 00:37 - 2014-06-09 01:52 - 00061120 _____ (StdLib) C:\Windows\System32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-10 03:49 - 2014-06-10 03:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 03:33 - 2014-06-10 03:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 03:15 - 2014-06-10 03:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 03:14 - 2014-06-10 03:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 03:12 - 2014-06-10 03:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 03:11 - 2014-06-10 03:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 03:09 - 2014-06-10 03:35 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 03:09 - 2014-06-10 03:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 03:08 - 2014-06-10 03:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 03:02 - 2014-06-10 03:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-06 01:27 - 2014-05-05 20:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-06-06 01:27 - 2014-05-05 20:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-06-06 01:27 - 2014-05-05 19:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-06 01:27 - 2014-05-05 19:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-06 01:27 - 2014-05-05 19:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-06-06 01:27 - 2014-05-05 18:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-06 01:26 - 2014-04-11 18:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2014-06-06 01:26 - 2014-04-11 18:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2014-06-06 01:26 - 2014-04-11 18:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-06-06 01:26 - 2014-04-11 18:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2014-06-06 01:26 - 2014-04-11 18:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2014-06-06 01:26 - 2014-04-11 18:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2014-06-06 01:26 - 2014-04-11 18:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2014-06-06 01:26 - 2014-04-11 18:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-06-06 01:26 - 2014-04-11 18:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-06-06 01:26 - 2014-03-04 01:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-06-06 01:26 - 2014-03-04 01:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-06-06 01:26 - 2014-03-04 01:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\System32\objsel.dll
2014-06-06 01:26 - 2014-03-04 01:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2014-06-06 01:26 - 2014-03-04 01:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-06-06 01:26 - 2014-03-04 01:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-06-06 01:26 - 2014-03-04 01:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-06-06 01:26 - 2014-03-04 01:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-06-06 01:26 - 2014-03-04 01:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\wincredprovider.dll
2014-06-06 01:26 - 2014-03-04 01:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-06-06 01:26 - 2014-03-04 01:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\System32\cngprovider.dll
2014-06-06 01:26 - 2014-03-04 01:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\System32\adprovider.dll
2014-06-06 01:26 - 2014-03-04 01:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\capiprovider.dll
2014-06-06 01:26 - 2014-03-04 01:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\dpapiprovider.dll
2014-06-06 01:26 - 2014-03-04 01:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\System32\dimsroam.dll
2014-06-06 01:26 - 2014-03-04 01:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-06-06 01:26 - 2014-03-04 01:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-06-06 01:26 - 2014-03-04 01:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-06-06 01:26 - 2014-03-04 01:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-06-06 01:26 - 2014-03-04 01:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-06-06 01:26 - 2014-03-04 01:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-06-01 09:32 - 2014-03-24 18:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2014-06-01 09:32 - 2014-03-24 18:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-06-01 06:13 - 2014-06-01 11:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 05:57 - 2014-06-01 09:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 05:49 - 2014-06-24 11:24 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

==================== One Month Modified Files and Folders =======

2014-06-24 21:29 - 2014-06-21 08:46 - 00000000 ____D () C:\FRST
2014-06-24 11:24 - 2014-06-01 05:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
2014-06-24 11:24 - 2010-11-17 07:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox
2014-06-24 11:23 - 2009-07-13 18:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-24 11:22 - 2010-03-21 02:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-24 11:22 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-24 11:22 - 2009-07-13 20:51 - 00109769 _____ () C:\Windows\setupact.log
2014-06-24 11:16 - 2010-11-17 07:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox
2014-06-24 11:16 - 2010-03-20 09:53 - 01748120 _____ () C:\Windows\WindowsUpdate.log
2014-06-24 11:08 - 2014-06-24 11:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 10:56 - 2010-03-21 02:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-24 10:39 - 2014-04-01 06:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-24 09:17 - 2009-07-13 20:45 - 00017600 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-24 09:17 - 2009-07-13 20:45 - 00017600 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-24 09:13 - 2014-06-24 09:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 09:12 - 2012-08-12 04:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-24 09:05 - 2014-06-24 09:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-23 09:30 - 2009-07-13 21:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-22 11:08 - 2009-11-04 19:19 - 01029316 _____ () C:\Windows\PFRO.log
2014-06-21 09:12 - 2013-12-19 01:57 - 00085328 _____ (AVAST Software) C:\Windows\System32\Drivers\aswstm.sys
2014-06-21 09:12 - 2011-07-30 07:22 - 01039096 _____ (AVAST Software) C:\Windows\System32\Drivers\aswsnx.sys
2014-06-21 09:12 - 2010-03-21 12:21 - 00423240 _____ (AVAST Software) C:\Windows\System32\Drivers\aswsp.sys
2014-06-21 09:12 - 2010-03-21 12:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-21 09:11 - 2014-06-21 09:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 09:11 - 2014-06-21 09:11 - 00029208 _____ () C:\Windows\System32\Drivers\aswHwid.sys
2014-06-21 09:11 - 2013-03-25 01:54 - 00208416 _____ () C:\Windows\System32\Drivers\aswVmm.sys
2014-06-21 09:11 - 2013-03-25 01:54 - 00065776 _____ () C:\Windows\System32\Drivers\aswRvrt.sys
2014-06-21 09:11 - 2012-04-14 08:51 - 00093568 _____ (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys
2014-06-21 09:11 - 2011-01-19 09:48 - 00334648 _____ (AVAST Software) C:\Windows\System32\aswBoot.exe
2014-06-21 09:11 - 2010-03-21 12:21 - 00079184 _____ (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys
2014-06-21 09:10 - 2010-03-16 13:07 - 00699682 _____ () C:\Windows\System32\perfh007.dat
2014-06-21 09:10 - 2010-03-16 13:07 - 00149790 _____ () C:\Windows\System32\perfc007.dat
2014-06-21 09:10 - 2009-07-13 21:13 - 01620684 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-06-21 08:42 - 2013-08-16 23:54 - 00000000 ____D () C:\Windows\System32\MRT
2014-06-21 08:40 - 2010-05-16 10:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-06-21 08:40 - 2009-11-04 19:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-21 08:26 - 2014-06-21 08:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 08:22 - 2014-06-21 08:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 08:21 - 2014-06-21 08:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 01:23 - 2014-06-18 01:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 01:03 - 2014-06-18 01:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 00:57 - 2014-06-18 00:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 02:24 - 2014-06-17 02:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 00:40 - 2014-06-17 00:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe
2014-06-17 00:39 - 2014-06-17 00:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 02:16 - 2014-06-16 02:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 02:10 - 2014-06-16 02:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 02:09 - 2014-06-16 02:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 02:00 - 2014-06-16 02:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 01:59 - 2014-06-16 01:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 01:58 - 2014-06-16 01:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 01:16 - 2014-06-16 01:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 00:38 - 2014-06-16 00:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 00:38 - 2013-11-08 07:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-16 00:36 - 2013-12-15 01:28 - 00000000 ____D () C:\Program Files (x86)\WebSparkle
2014-06-10 05:39 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\NDF
2014-06-10 05:00 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-06-10 03:50 - 2014-06-10 03:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 03:35 - 2014-06-10 03:09 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 03:33 - 2014-06-10 03:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 03:15 - 2014-06-10 03:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 03:14 - 2014-06-10 03:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 03:12 - 2014-06-10 03:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 03:11 - 2014-06-10 03:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 03:09 - 2014-06-10 03:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 03:08 - 2014-06-10 03:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 03:02 - 2014-06-10 03:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-09 01:52 - 2014-06-16 00:37 - 00061120 _____ (StdLib) C:\Windows\System32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-06 03:09 - 2014-03-21 08:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET
2014-06-01 12:01 - 2012-01-03 10:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-01 11:39 - 2014-06-01 06:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 09:43 - 2014-06-01 05:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 08:14 - 2013-12-15 02:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit
2014-06-01 05:49 - 2011-05-28 09:49 - 00001348 _____ () C:\Windows\wininit.ini

Some content of TEMP:
====================
C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcqtx8u.dll
C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe
C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Kerstin\AppData\Local\Temp\setup.exe
C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe
C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-04-28 11:32:32
Restore point made on: 2014-05-07 09:08:39
Restore point made on: 2014-05-07 09:55:12
Restore point made on: 2014-05-11 10:24:17
Restore point made on: 2014-05-13 02:15:32
Restore point made on: 2014-06-01 10:41:30
Restore point made on: 2014-06-01 12:02:26
Restore point made on: 2014-06-06 01:11:41
Restore point made on: 2014-06-06 02:21:03
Restore point made on: 2014-06-10 02:05:30
Restore point made on: 2014-06-21 08:19:37
Restore point made on: 2014-06-21 08:26:27
Restore point made on: 2014-06-21 08:31:16
Restore point made on: 2014-06-21 08:36:59
Restore point made on: 2014-06-21 09:09:11
Restore point made on: 2014-06-22 12:29:40

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3956.5 MB
Available physical RAM: 3210.6 MB
Total Pagefile: 3954.65 MB
Available Pagefile: 3202.29 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:285.3 GB) (Free:135.94 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:12.7 GB) (Free:2.43 GB) NTFS
Drive g: () (Removable) (Total:7.45 GB) (Free:5.68 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 1B5F1B5F)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 001DE8BD)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2014-06-22 11:45

==================== End Of Log ============================

--- --- ---

Warlord711 25.06.2014 12:53

Dein Rechner scheint Probleme zu haben, Downloads korrekt abzuschliessen.
Deshalb bitte alle Tools die ich aufführe, per USB Stick von einem anderen Rechner downloaden.

Schritt 1

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 2

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



Schritt 3

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Schritt 4

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Bitte in der Antwort posten:
  • AdwCleaner Log
  • JRT Log
  • Malwarebytes Log
  • neues FRST Log

1Stift 25.06.2014 18:54

Hallo Timo,

das hat alles ohne murren geklappt. Ich habe mein Antivirusprogramm dazu deaktiviert, was allerdings nicht auszuschalten ging war das SPBOT Search & Destroy. Ich habe dann immer bestätigt, dass Änderungen zugelassen werden dürfen. In letzter Zeit macht dieses Programm kirre - ich kann es aber irgendwie nicht deaktivieren. Trotzdem hat alles geklappt und einiges wurde auch gefunden.

AdwCleaner Log
Code:

# AdwCleaner v3.213 - Bericht erstellt am 25/06/2014 um 18:57:26
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Kerstin - HUGO
# Gestartet von : E:\adwcleaner_3.213.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\QuickSet
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\smart pc cleaner
[!] Ordner Gelöscht : C:\Program Files (x86)\WebSparkle
Ordner Gelöscht : C:\Users\Kerstin\AppData\Local\Temp\AskSearch
Ordner Gelöscht : C:\Users\Kerstin\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Kerstin\Documents\smart pc cleaner
Ordner Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\ICQToolbarData
Ordner Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-10.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-11.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-12.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-13.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-14.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-4.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-5.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-6.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-7.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-8.xml
Datei Gelöscht : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\icqplugin-9.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ikgojpdbiniccokkgadmdheobjfdbbcg
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateWebSparkle_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateWebSparkle_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\utilWebSparkle_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\utilWebSparkle_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Driver-Soft
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\InstallIQ
Schlüssel Gelöscht : HKLM\Software\Uniblue

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v28.0 (de)

[ Datei : C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);
Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1342944049);
Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
Zeile gelöscht : user_pref("icqtoolbar.history", "rennsteig||sonnenschutzfolie||wandtatoo||coachtisch||disentis%20schweiz%20hotel%20cucagna||disentis%20schweiz||wetter||w%C3%A4hrungsrechner||couchtisch||FA%20Gers||kal[...]
Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
Zeile gelöscht : user_pref("icqtoolbar.installTime", "1289838458");
Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "0");
Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.6.28");
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "128982929112898288521289838458614");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1343455487);
Zeile gelöscht : user_pref("icqtoolbar.version", "1.1.7");
Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=");

-\\ Google Chrome v35.0.1916.153

[ Datei : C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [8855 octets] - [25/06/2014 18:55:41]
AdwCleaner[S0].txt - [8478 octets] - [25/06/2014 18:57:26]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8538 octets] ##########


JRT Log
Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Kerstin on 25.06.2014 at 19:07:29,95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully stopped: [Service] update websparkle
Successfully deleted: [Service] update websparkle



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\websparkle"



~~~ FireFox

Successfully deleted the following from C:\Users\Kerstin\AppData\Roaming\mozilla\firefox\profiles\qjeq9mrb.default\prefs.js

user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" t
user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\"
user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
user_pref("google.toolbar.id", "XZN5OLV9SAU6OL4CNSOAZEYMBT7DWCE4QT0Y89IER3DCTQJRBM");
user_pref("google.toolbar.install_id", "XZN5OLV9SAU6OL4CNSOAZEYMBT7DWCE4QT0Y89IER3DCTQJRBM");
user_pref("google.toolbar.search-icon", "data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7PT7/3zF6/9Ptu//RbHx/
Successfully deleted the following from C:\Users\Kerstin\AppData\Roaming\mozilla\firefox\profiles\qjeq9mrb.default\prefs.js

user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" t
user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\"
user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
Emptied folder: C:\Users\Kerstin\AppData\Roaming\mozilla\firefox\profiles\qjeq9mrb.default\minidumps [13 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.06.2014 at 19:16:06,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Log
Code:

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 25.06.2014
Suchlauf-Zeit: 19:21:28
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Kerstin

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 256463
Verstrichene Zeit: 10 Min, 29 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 4
PUP.Optional.WebSparkle.A, HKU\S-1-5-21-319184197-2032305868-326389486-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{9F56BAB3-2739-40ED-A8D0-1451657A9742}, In Quarantäne, [53f63bc4730775c1ce3b3f0230d24fb1],
PUP.Optional.WebSparkle.A, HKU\S-1-5-21-319184197-2032305868-326389486-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{9F56BAB3-2739-40ED-A8D0-1451657A9742}, In Quarantäne, [53f63bc4730775c1ce3b3f0230d24fb1],
PUP.Optional.WebSparkle.A, HKLM\SOFTWARE\WOW6432NODE\WebSparkle, In Quarantäne, [88c1609f0575e74f670afbc7937050b0],
PUP.Optional.WebSparkle.A, HKU\S-1-5-21-319184197-2032305868-326389486-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WebSparkle, In Quarantäne, [15341ae52357270fff568e23ad56936d],

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 3
Trojan.Agent.ED, C:\Users\Kerstin\AppData\Local\Temp\BIT7370.tmp, In Quarantäne, [2128e619304a9c9ad34ede3d07fa4fb1],
PUP.Optional.InstalleRex, C:\Users\Kerstin\Downloads\Unmasking the Face_ A Guide to Recognizing Emotions From Facial.exe, In Quarantäne, [27220ef1c6b404324aae9ada8f72cb35],
PUP.Optional.InstallIQ, C:\Users\Kerstin\Downloads\openfreely.exe, In Quarantäne, [f4553fc0e89270c6f874a5b7d72aa858],

Physische Sektoren: 0
(No malicious items detected)


(end)


neues FRST Log

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Kerstin (administrator) on HUGO on 25-06-2014 19:42:08
Running from E:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
() C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(France Telecom SA) C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-11-05] (Google Inc.)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {6e471881-5678-11e3-a9de-00262d8630e0} - E:\laucher.exe
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {77a9aa59-bb6f-11df-9b81-00262d8630e0} - E:\MicroLauncher.exe
AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5740&r=27360310l526l0418z155t54m1d66q
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\Win32\npPDFXCviewNPPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-04-01]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-07-30]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR HomePage:
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)
R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
S2 Util WebSparkle; "C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-31] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)
S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)
S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
R1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)
R1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-25 19:20 - 2014-06-25 19:37 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-25 19:19 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-25 19:19 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-25 19:19 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt
2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 18:55 - 2014-06-25 18:57 - 00000000 ____D () C:\AdwCleaner
2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-21 18:46 - 2014-06-25 19:42 - 00000000 ____D () C:\FRST
2014-06-21 18:28 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-21 18:28 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-21 18:28 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-21 18:28 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-21 18:28 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-21 18:28 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-21 18:28 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-21 18:28 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 11:22 - 2014-06-18 11:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:02 - 2014-06-18 11:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:20 - 2014-06-17 12:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 10:40 - 2014-06-17 10:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:07 - 2014-06-16 11:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 10:37 - 2014-06-09 11:52 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-10 13:49 - 2014-06-10 13:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:35 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-06 11:27 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-06 11:27 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-06 11:27 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-06 11:27 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-06 11:27 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-06 11:27 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-06 11:26 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-06-06 11:26 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-06-06 11:26 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-06-06 11:26 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-06-06 11:26 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-06-06 11:26 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-06-06 11:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-06-01 19:32 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-06-01 19:32 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-06-01 16:13 - 2014-06-01 21:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 15:57 - 2014-06-01 19:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 15:49 - 2014-06-25 19:01 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

==================== One Month Modified Files and Folders =======

2014-06-25 19:43 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-25 19:43 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-25 19:42 - 2014-06-21 18:46 - 00000000 ____D () C:\FRST
2014-06-25 19:39 - 2014-04-01 16:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-25 19:37 - 2014-06-25 19:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-25 19:35 - 2010-03-21 12:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-25 19:35 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-25 19:34 - 2010-11-17 17:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox
2014-06-25 19:34 - 2010-03-20 19:53 - 01800797 _____ () C:\Windows\WindowsUpdate.log
2014-06-25 19:34 - 2009-11-05 05:19 - 01030950 _____ () C:\Windows\PFRO.log
2014-06-25 19:34 - 2009-07-14 06:51 - 00109993 _____ () C:\Windows\setupact.log
2014-06-25 19:32 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-25 19:20 - 2014-06-25 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt
2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 19:01 - 2014-06-01 15:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
2014-06-25 19:01 - 2012-08-12 14:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-25 19:01 - 2010-11-17 17:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox
2014-06-25 18:57 - 2014-06-25 18:55 - 00000000 ____D () C:\AdwCleaner
2014-06-25 18:57 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-25 18:56 - 2010-03-21 12:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-23 19:30 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-21 19:12 - 2013-12-19 11:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-21 19:12 - 2011-07-30 17:22 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-21 19:12 - 2010-03-21 22:21 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-21 19:12 - 2010-03-21 22:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-21 19:11 - 2013-03-25 11:54 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-21 19:11 - 2013-03-25 11:54 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-21 19:11 - 2012-04-14 18:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-21 19:11 - 2011-01-19 19:48 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-21 19:11 - 2010-03-21 22:21 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-21 19:10 - 2010-03-16 23:07 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-06-21 19:10 - 2010-03-16 23:07 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-06-21 19:10 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-21 18:42 - 2013-08-17 09:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-21 18:40 - 2010-05-16 20:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-21 18:40 - 2009-11-05 05:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 11:23 - 2014-06-18 11:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:03 - 2014-06-18 11:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:24 - 2014-06-17 12:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 10:40 - 2014-06-17 10:40 - 02065748 _____ () C:\Users\Kerstin\Desktop\FRST64.exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:16 - 2014-06-16 11:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 10:38 - 2013-11-08 17:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-10 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-10 15:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-10 13:50 - 2014-06-10 13:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:35 - 2014-06-10 13:09 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:19 - 2011-11-15 20:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-09 11:52 - 2014-06-16 10:37 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-06 13:09 - 2014-03-21 18:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET
2014-06-01 22:01 - 2012-01-03 20:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-01 21:39 - 2014-06-01 16:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 19:43 - 2014-06-01 15:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 18:14 - 2013-12-15 12:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit
2014-06-01 15:49 - 2011-05-28 19:49 - 00001348 _____ () C:\Windows\wininit.ini
2014-06-01 15:49 - 2010-11-17 17:20 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpycnwyi.dll
C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Kerstin\AppData\Local\Temp\Quarantine.exe
C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe
C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Kerstin\AppData\Local\Temp\setup.exe
C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe
C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-22 21:45

==================== End Of Log ============================

--- --- ---

Warlord711 26.06.2014 08:07

Meine Empfehlung: Spybot S&D deinstallieren. Malwarebytes ist die bessere Alternative. Du musst zwar in der Free Version "von Hand" scannen, aber dafür bist du in guten Händen.

Probier bitte aus:
  • Prüfe, ob du inzwischen wieder sauber Dateien downloaden und ausführen kannst, falls nicht
  • Deinstallier Spybot S&D
  • Prüfe erneut


Schreib mir dann, ob es geklappt hat.

Führe die folgenden Schritte auf jeden Fall aus.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

R1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)
R1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)
C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys
C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Danach:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Und dann nochmal:

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

1Stift 26.06.2014 22:13

Hallo Timo,

das downloaden und ausführen von Dateien funktioniert wieder ohne Probleme, allerdings habe ich schon dem erstem Versuch Spybot deinstalliert (also wieß ich nicht ob es mit auch gegangen wäre). Ich habe das Eset Programm problemlos runterladen können. Dabei kamen auch keine komischen pop-ups mehr und keine sytemfehlermeldungen. Ich habe auf web seiten auch keine unterstrichenen Wörter mehr.
was ich noche nebenbei erwähnen möchte: ich habe beim löschen von spybot in den Programmen auch die Datei web-sparkle gefunden (die hatte sich im Internet immer am rand geöffnet mit diversen links). Ich habe diese Datei tatsächlich aus Versehen deinstalliert (ich wollte voanders hinklicken - und habe dabie deinstallieren geklickt). Das tut wahrscheinlich eh nichts zur Sache (hätte ja eh weg gemusst), wollte es aber nur mal erwähnt haben. Hier dann also der geforderte Rest:

Fixlog
Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-06-2014
Ran by Kerstin at 2014-06-26 20:27:02 Run:2
Running from E:\
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
R1 {058899d6-9704-4de3-aae7-17e9fc44c761}Gw64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys [61120 2014-04-24] (StdLib)
R1 {058899d6-9704-4de3-aae7-17e9fc44c761}w64; C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys [61120 2014-06-09] (StdLib)
C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys
C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.
       
*****************

{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64 => Service stopped successfully.
{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64 => Service deleted successfully.
{058899d6-9704-4de3-aae7-17e9fc44c761}w64 => Service stopped successfully.
{058899d6-9704-4de3-aae7-17e9fc44c761}w64 => Service deleted successfully.
C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}Gw64.sys => Moved successfully.
"C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64." => File/Directory not found.

==== End of Fixlog ====


log eset
Code:

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=12b4ca954c71e24cbfefcbabbbf612c3
# engine=18903
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-26 08:33:31
# local_time=2014-06-26 10:33:31 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 350724 168235301 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 8853 155444661 0 0
# scanned=271469
# found=22
# cleaned=0
# scan_time=6934
sh=0B6A4A28A529F3FAE9C14804D67B08976F5C403E ft=1 fh=89e587294b6f9618 vn="Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\updateWebSparkle.exe.vir"
sh=0B6A4A28A529F3FAE9C14804D67B08976F5C403E ft=1 fh=89e587294b6f9618 vn="Variante von Win32/BrowseFox.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe.vir"
sh=3D4CC64B1EA729800B6AE85C16F7D308CC8F1A8F ft=1 fh=5ee4fb30f9d1bfe1 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\WebSparkle.BrowserAdapter.exe.vir"
sh=0E7636A92D455CF171FDABF92B97E8072E9EB1AA ft=1 fh=5fb503d5f4df3dc7 vn="Variante von Win64/BrowseFox.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\WebSparkle.PurBrowse64.exe.vir"
sh=1E73B2A630629D096D1903F0442F14E85DD78264 ft=1 fh=7add065383508a83 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\WebSparkleBAApp.dll.vir"
sh=C33C2787D0302CE14454CF396142B8ACF8C1FEC7 ft=1 fh=1c8256ac362d35e2 vn="Variante von Win32/BrowseFox.K evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\{058899d6-9704-4de3-aae7-17e9fc44c761}.dll.vir"
sh=0FD48FC786E8753E1FCE997ED07C92B426013F9A ft=1 fh=e17288734ceb1731 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.Bromon.dll.vir"
sh=E2A91279D391E414CF162DA05F8B742D3289BB72 ft=1 fh=e1262aff2468489e vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.BroStats.dll.vir"
sh=EF67C68E003D74B0E64D6A080EDE6DCE28687667 ft=1 fh=96adf3f4ba4e47ec vn="möglicherweise Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.BrowserAdapterS.dll.vir"
sh=B9A09041CCCB5C0CB30B69A95F179F01F63BB091 ft=1 fh=e7a8c984b8d3acb2 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.CompatibilityChecker.dll.vir"
sh=D65BFDAC8908F3F95A87CE6CA44B092F7AE294C1 ft=1 fh=f6235a9780e16f3e vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.FFUpdate.dll.vir"
sh=79826FD79583D6210CEF3F4C88C68B02F0453772 ft=1 fh=8a713370bd2c7629 vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.GCUpdate.dll.vir"
sh=127294EF57DD1C84BA7571899278E05BA9F6F65B ft=1 fh=4680720c9b2bf816 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.IEUpdate.dll.vir"
sh=C881D9A9B6ED97F5516874FC0CFB716D4D9621AA ft=1 fh=e4b2cf926a41bc34 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.PurBrowse.dll.vir"
sh=F49F92D964B9C5984EDDB591C634E35DC8A41428 ft=1 fh=70c42155351b53c9 vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.PurBrowseG.dll.vir"
sh=FB88AE452A46C2C9FDB4DD74004C3CE2C60802D0 ft=1 fh=68f5c0cabda73c1f vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WebSparkle\bin\plugins\WebSparkle.Repmon.dll.vir"
sh=16068B8977B4DC562AE782D91BC009472667E331 ft=1 fh=c3b5a87b7d152749 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kerstin\AppData\Local\Temp\OCS\ocs_v71a.exe.vir"
sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}\Custom.dll"
sh=49D8EF6835A6DE734EAD4E0B2CBBC65735CD5C17 ft=1 fh=b7c2cf7d50fb560b vn="Win32/InstalleRex.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}\Custom.dll"
sh=AFC5D79A125519B24DD96F763517408BE5E64DC2 ft=1 fh=a1542e0b8b7d232b vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kerstin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SEKW855J\SpeedUpMyPC-standalone-setup[1].exe"
sh=AE9401F65556B69533D957BA556C37C75CA9082B ft=1 fh=8d5324f717d1c6da vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kerstin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZPOQ1P0\Setup[1].exe"
sh=0E817328E2E09447EE8F8AE7E0D4B9BA21BED676 ft=1 fh=fc9d93cb113d639b vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe"


FRST

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by Kerstin (administrator) on HUGO on 26-06-2014 23:08:38
Running from E:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
() C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(France Telecom SA) C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {6e471881-5678-11e3-a9de-00262d8630e0} - E:\laucher.exe
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {77a9aa59-bb6f-11df-9b81-00262d8630e0} - E:\MicroLauncher.exe
AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5740&r=27360310l526l0418z155t54m1d66q
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\Win32\npPDFXCviewNPPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-04-01]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-07-30]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR HomePage:
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)
R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
S2 Util WebSparkle; "C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-31] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)
S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)
S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-26] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe
2014-06-25 19:20 - 2014-06-26 22:11 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-25 19:19 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-25 19:19 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-25 19:19 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt
2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 18:55 - 2014-06-25 18:57 - 00000000 ____D () C:\AdwCleaner
2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-21 18:46 - 2014-06-26 23:08 - 00000000 ____D () C:\FRST
2014-06-21 18:28 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-21 18:28 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-21 18:28 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-21 18:28 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-21 18:28 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-21 18:28 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-21 18:28 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-21 18:28 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 11:22 - 2014-06-18 11:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:02 - 2014-06-18 11:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:20 - 2014-06-17 12:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:07 - 2014-06-16 11:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 10:37 - 2014-06-09 11:52 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-10 13:49 - 2014-06-10 13:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:35 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-06 11:27 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-06 11:27 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-06 11:27 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-06 11:27 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-06 11:27 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-06 11:27 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-06 11:26 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-06-06 11:26 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-06-06 11:26 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-06-06 11:26 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-06-06 11:26 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-06-06 11:26 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-06-06 11:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-06-01 19:32 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-06-01 19:32 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-06-01 16:13 - 2014-06-01 21:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 15:57 - 2014-06-01 19:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 15:49 - 2014-06-26 19:58 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

==================== One Month Modified Files and Folders =======

2014-06-26 23:08 - 2014-06-21 18:46 - 00000000 ____D () C:\FRST
2014-06-26 22:56 - 2010-03-21 12:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-26 22:39 - 2014-04-01 16:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-26 22:11 - 2014-06-25 19:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-26 21:39 - 2010-03-20 19:53 - 01842845 _____ () C:\Windows\WindowsUpdate.log
2014-06-26 20:35 - 2010-03-16 23:07 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-06-26 20:35 - 2010-03-16 23:07 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-06-26 20:35 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe
2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-06-26 20:08 - 2009-11-05 02:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-26 20:04 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-26 20:04 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-26 20:02 - 2009-11-05 05:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2014-06-26 20:00 - 2009-11-05 05:32 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-06-26 20:00 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-26 19:58 - 2014-06-01 15:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
2014-06-26 19:58 - 2012-08-12 14:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-26 19:58 - 2010-11-17 17:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox
2014-06-26 19:58 - 2010-11-17 17:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox
2014-06-26 19:55 - 2010-03-21 12:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-26 19:55 - 2009-11-05 05:19 - 01031304 _____ () C:\Windows\PFRO.log
2014-06-26 19:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 19:55 - 2009-07-14 06:51 - 00110049 _____ () C:\Windows\setupact.log
2014-06-25 19:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-25 19:20 - 2014-06-25 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt
2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 18:57 - 2014-06-25 18:55 - 00000000 ____D () C:\AdwCleaner
2014-06-25 18:57 - 2010-11-15 18:27 - 00000000 ____D () C:\ProgramData\ICQ
2014-06-25 18:57 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-23 19:30 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-21 19:12 - 2013-12-19 11:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-21 19:12 - 2011-07-30 17:22 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-21 19:12 - 2010-03-21 22:21 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-21 19:12 - 2010-03-21 22:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-21 19:11 - 2013-03-25 11:54 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-21 19:11 - 2013-03-25 11:54 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-21 19:11 - 2012-04-14 18:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-21 19:11 - 2011-01-19 19:48 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-21 19:11 - 2010-03-21 22:21 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-21 18:42 - 2013-08-17 09:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-21 18:40 - 2010-05-16 20:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-21 18:40 - 2009-11-05 05:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 11:23 - 2014-06-18 11:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:03 - 2014-06-18 11:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:24 - 2014-06-17 12:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:16 - 2014-06-16 11:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-16 10:38 - 2014-06-16 10:38 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-16 10:38 - 2013-11-08 17:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-10 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-10 15:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-10 13:50 - 2014-06-10 13:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:35 - 2014-06-10 13:09 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-09 11:52 - 2014-06-16 10:37 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
2014-06-06 13:09 - 2014-03-21 18:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET
2014-06-01 22:01 - 2012-01-03 20:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-01 21:39 - 2014-06-01 16:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 19:43 - 2014-06-01 15:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 18:14 - 2013-12-15 12:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit
2014-06-01 15:49 - 2011-05-28 19:49 - 00001348 _____ () C:\Windows\wininit.ini
2014-06-01 15:49 - 2010-11-17 17:20 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprhfpxv.dll
C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Kerstin\AppData\Local\Temp\Quarantine.exe
C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe
C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Kerstin\AppData\Local\Temp\setup.exe
C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe
C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-22 21:45

==================== End Of Log ============================

--- --- ---

Warlord711 27.06.2014 10:55

Ja, das Web Sparke löschen hast du gut gemacht :sword2:
Ich würd dich aber noch bitten, einiges mehr zu deinstallieren.
Einige Sachen davon hast du evtl schon deinstalliert, aber ich liste nochmal alles auf, was Anfangs installiert war.

Schritt 1

Adware & Co. deinstallieren

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Schritt 2

Revo Uninstaller-Junkdateien bereinigen
  • Starte bitte den Revo Uninstaller erneut falls er geschlossen wurde
  • Wähle "Tools" aus der oberen Leiste, wähle dann" Optimierungen" - "Junkdateien bereinigen" aus
  • Klicke in der oberen Leiste auf "Scan"
  • Nach Beendigung des Scans, klicke in der oberen Leiste auf "Lösche"

Schritt 3

Hab beim Fix "gepfuscht", das kann ich so nicht stehen lassen :blah:
Und da wir das Tool grad nochmal bemühen, löschen wir auch noch Reste:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}
C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe"


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 4

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

1Stift 27.06.2014 19:32

Hallo Timo,

also Web sparkle und Spybot waren scheinbar vollständig deinstalliert - die wurden von REVO uninstaller nicht mehr gefunden. McAffee wurde ebenfalls nicht gefunden - das habe ich von der Systemsteuerung aus deinstalliert.
Ich habe dann die Junkdateien suchen lassen - und da habe ich es mit der Angst zu tun bekommen. Darunter waren viele Dateien, die ich noch brauche. Ich habe ein spezielles Softwareprogramm für medizinische Datenauswertungen, das hat Datensätze gespeichert, die ich noch benötige. Alle diese Daten habe ich natürlich auch auf einer externen festplatte, aber ich glaube die Datensätze für dieses bestimmte programm (suempathy100) kann ich nur öffnen wenn die datensätze direkt auf der festplatte gespeichert sind (bin mir aber auch nicht sicher). stutzig macht mich allerdings die Endung ".TMP", die bei den Junkdateien angezeigt wird (sonst benötigt dieses Programm Dateien mit den Endungen SDA, SDM und SDR. Ich bin verwirrt. Wenn ich alle Junkdateien lösche, kann ich die Daten dann noch öffnen?

Ich hoffe ich konnte mich irgendwie verständlich machen.

Insgeamt aber nocheinmal herzlichen Dank für deine Hilfe.

Warlord711 30.06.2014 11:46

Lief denn das Programm während des Junkdateien-Scans ?

Es ist nicht unüblich, das Programme während des Betriebs temporäre Dateien erzeugen.

1Stift 01.07.2014 09:59

Hallo Timo,

ich habe allen Mut zusammengenommen und bei den Junkdateien auf löschen gedrückt - und es ist tatsächlich nichts passiert. Ich kann das besagte Programm ganz normal benutzen und alle Datensätze öffnen sich ohne zu murren (hab dann erstmal einen Schanps getrunken). Das Programm lief nicht während des Scans.
Zwei Junkdateien ließen sich allerdings nicht löschen, weil windows diese angeblcih benutzt ( C:\Windows\ServiceProfiles\AppData\Local\~FontCache-FontFace.dat und C:\Windows\ServiceProfiles\AppData\Local\~FontCache-System.dat). Ich verrate dir sicher kein Geheimnis, wenn ich dir sage, dass ich mit diesem Schulli nichts anfangen kann.
Den Rest habe ich nach Anleitung weiter durchgeführt. Bitte nicht wundern. Zwischendurch hat sie Malewarebytes gemeldet und wieder was komisches gefunden, Ich habe dass dann wieder in die Quarantäne geschickt und das Suchlaufprotokoll als txt gespeichert. Ich schicke dir das nur nochmal zu Sicherheit mit. Diese Protokolle kann ich in Zukunft sicher für mich behalten oder?

Fixlog
Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-06-2014
Ran by Kerstin at 2014-07-01 10:42:34 Run:3
Running from E:\
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys
C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D}
C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe"
       
*****************

"C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys" => File/Directory not found.
C:\ProgramData\InstallMate\{1BE76E8B-4D2C-433C-A1D7-050EC0044C7D} => Moved successfully.
C:\Users\Kerstin\Downloads\Paint NET - CHIP-Downloader.exe => Moved successfully.

==== End of Fixlog ====


FRST

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2014
Ran by Kerstin (administrator) on HUGO on 01-07-2014 10:43:38
Running from E:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(France Telecom SA) C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
() C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(France Telecom SA) C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Dropbox, Inc.) C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-07-23] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-29] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-20] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-09-30] (Acer Incorporated)
HKLM\...\Run: [IntelliType Pro] => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-29] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-11-12] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CardDetectorICON515] => C:\Program Files (x86)\CardDetector\ICON515\CardDetector.exe [287472 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [BEWINTERNET-CHSessionManager] => C:\Program Files (x86)\Internet Everywhere\IEWCH_8.0\SessionManager\SessionManager.exe [140016 2009-11-12] (France Telecom SA)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-21] (AVAST Software)
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\Run: [Amazon Cloud Player] => C:\Users\Kerstin\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3139072 2013-11-24] ()
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {6e471881-5678-11e3-a9de-00262d8630e0} - E:\laucher.exe
HKU\S-1-5-21-319184197-2032305868-326389486-1000\...\MountPoints2: {77a9aa59-bb6f-11df-9b81-00262d8630e0} - E:\MicroLauncher.exe
AppInit_DLLs-x32: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll => C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll [256568 2012-12-14] (Citrix Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kerstin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5740&r=27360310l526l0418z155t54m1d66q
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE371
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\Win32\npPDFXCviewNPPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Google Toolbar for Firefox - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011-08-09]
FF Extension: Adblock Plus - C:\Users\Kerstin\AppData\Roaming\Mozilla\Firefox\Profiles\qjeq9mrb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-08-12]
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-04-01]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-07-30]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR HomePage:
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll No File
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (Google Wallet) - C:\Users\Kerstin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-06-21] (AVAST Software)
R2 FTRTSVC; C:\Program Files (x86)\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [90112 2009-11-12] (France Telecom SA) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
S2 Util WebSparkle; "C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-21] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-21] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-21] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-21] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-21] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-21] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-10-31] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-21] ()
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 GTUHSBUS; C:\Windows\System32\DRIVERS\gtuhsbus.sys [88576 2009-08-04] (Option N.V.)
S3 GTUHSNDISIPXP; C:\Windows\System32\DRIVERS\gtuhs51.sys [129536 2009-08-04] (Option N.V.)
S3 GTUHSSER; C:\Windows\System32\DRIVERS\gtuhsser.sys [10496 2009-08-04] (Option N.V.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-01] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-27 19:29 - 2014-06-27 19:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kerstin\Desktop\revosetup95.exe
2014-06-27 19:29 - 2014-06-27 19:29 - 00001268 _____ () C:\Users\Kerstin\Desktop\Revo Uninstaller.lnk
2014-06-27 19:29 - 2014-06-27 19:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe
2014-06-26 20:06 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-26 20:06 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-26 20:06 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-26 20:06 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-26 20:06 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-26 20:06 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-26 20:06 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-26 20:06 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-26 20:06 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-26 20:06 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-26 20:06 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-26 20:06 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-26 20:06 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-26 20:06 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-26 20:06 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-26 20:06 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-26 20:06 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-26 20:06 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-26 20:06 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-26 20:06 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-26 20:06 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-26 20:06 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-26 20:06 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-26 20:06 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-26 20:06 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-26 20:06 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-26 20:06 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-26 20:06 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-26 20:06 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-26 20:06 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-26 20:06 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-26 20:06 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-26 20:06 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-26 20:06 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-26 20:06 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-26 20:06 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-26 20:06 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-26 20:06 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-26 20:06 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-26 20:06 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-26 20:06 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-26 20:06 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-26 20:06 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-26 20:06 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-26 20:06 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-26 20:06 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-26 20:06 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-26 20:06 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-26 20:06 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-26 20:06 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-26 20:06 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-26 20:06 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-25 19:20 - 2014-07-01 10:30 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-25 19:19 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-25 19:19 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-25 19:19 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt
2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 18:55 - 2014-06-25 18:57 - 00000000 ____D () C:\AdwCleaner
2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-21 18:46 - 2014-07-01 10:43 - 00000000 ____D () C:\FRST
2014-06-21 18:28 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-21 18:28 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-21 18:28 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-21 18:28 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-21 18:28 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-21 18:28 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-21 18:28 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-21 18:28 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-21 18:28 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-21 18:28 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 11:22 - 2014-06-18 11:23 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:02 - 2014-06-18 11:03 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:20 - 2014-06-17 12:24 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:07 - 2014-06-16 11:16 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-10 13:49 - 2014-06-10 13:50 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:35 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-06 11:26 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-06-06 11:26 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-06-06 11:26 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-06-06 11:26 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-06-06 11:26 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-06-06 11:26 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-06-06 11:26 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-06-06 11:26 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-06-06 11:26 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-06-06 11:26 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-06-06 11:26 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-06-06 11:26 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-06-01 19:32 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-06-01 19:32 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-06-01 16:13 - 2014-06-01 21:39 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 15:57 - 2014-06-01 19:43 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 15:49 - 2014-07-01 10:32 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster

==================== One Month Modified Files and Folders =======

2014-07-01 10:43 - 2014-06-21 18:46 - 00000000 ____D () C:\FRST
2014-07-01 10:42 - 2013-11-27 14:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-07-01 10:39 - 2014-04-01 16:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-01 10:38 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-01 10:38 - 2009-07-14 06:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-01 10:37 - 2010-03-16 23:07 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-07-01 10:37 - 2010-03-16 23:07 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-07-01 10:37 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-01 10:33 - 2010-11-17 17:19 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Dropbox
2014-07-01 10:32 - 2014-06-01 15:49 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\DropboxMaster
2014-07-01 10:32 - 2010-11-17 17:21 - 00000000 ___RD () C:\Users\Kerstin\Documents\My Dropbox
2014-07-01 10:30 - 2014-06-25 19:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-01 10:30 - 2010-03-21 12:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-01 10:29 - 2009-11-05 05:19 - 01034070 _____ () C:\Windows\PFRO.log
2014-07-01 10:29 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-01 10:29 - 2009-07-14 06:51 - 00110217 _____ () C:\Windows\setupact.log
2014-07-01 10:28 - 2012-01-03 20:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-07-01 10:28 - 2010-03-20 19:53 - 01958377 _____ () C:\Windows\WindowsUpdate.log
2014-07-01 10:18 - 2010-03-21 12:01 - 00000000 ____D () C:\Users\Kerstin\Doktorarbeit
2014-07-01 10:18 - 2010-03-20 19:55 - 00000000 ____D () C:\Users\Kerstin
2014-07-01 10:03 - 2010-03-21 12:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-01 09:58 - 2012-08-12 14:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-27 21:12 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-27 20:05 - 2013-11-08 17:05 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-27 19:57 - 2010-03-21 12:43 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-27 19:57 - 2010-03-21 12:43 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-27 19:42 - 2009-11-05 02:38 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-06-27 19:41 - 2010-04-05 19:16 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Adobe
2014-06-27 19:41 - 2009-11-05 02:38 - 00000000 ____D () C:\ProgramData\Adobe
2014-06-27 19:29 - 2014-06-27 19:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kerstin\Desktop\revosetup95.exe
2014-06-27 19:29 - 2014-06-27 19:29 - 00001268 _____ () C:\Users\Kerstin\Desktop\Revo Uninstaller.lnk
2014-06-27 19:29 - 2014-06-27 19:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-26 20:17 - 2014-06-26 20:17 - 02082816 _____ (Farbar) C:\Users\Kerstin\Desktop\FRST64(10).exe
2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-26 20:09 - 2011-11-15 20:16 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-06-26 20:08 - 2009-11-05 02:36 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-26 20:02 - 2009-11-05 05:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2014-06-26 20:00 - 2009-11-05 05:32 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-06-26 20:00 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-25 19:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-06-25 19:20 - 2014-06-25 19:20 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-25 19:20 - 2014-06-25 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-25 19:20 - 2014-06-25 19:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-25 19:19 - 2014-06-25 19:19 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-25 19:16 - 2014-06-25 19:16 - 00003320 _____ () C:\Users\Kerstin\Desktop\JRT.txt
2014-06-25 19:07 - 2014-06-25 19:07 - 00000000 ____D () C:\Windows\ERUNT
2014-06-25 18:57 - 2014-06-25 18:55 - 00000000 ____D () C:\AdwCleaner
2014-06-25 18:57 - 2010-11-15 18:27 - 00000000 ____D () C:\ProgramData\ICQ
2014-06-25 18:57 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-24 21:08 - 2014-06-24 21:08 - 02081404 _____ () C:\Users\Kerstin\Downloads\FRST64(9).exe
2014-06-24 19:13 - 2014-06-24 19:13 - 02071520 _____ () C:\Users\Kerstin\Downloads\FRST64(8).exe
2014-06-24 19:05 - 2014-06-24 19:05 - 00002912 _____ () C:\Users\Kerstin\Desktop\regfix.reg
2014-06-23 19:30 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-21 19:12 - 2013-12-19 11:57 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-21 19:12 - 2011-07-30 17:22 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-21 19:12 - 2010-03-21 22:21 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-21 19:12 - 2010-03-21 22:21 - 00001981 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-21 19:11 - 2014-06-21 19:11 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-21 19:11 - 2014-06-21 19:11 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-21 19:11 - 2013-03-25 11:54 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-21 19:11 - 2013-03-25 11:54 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-21 19:11 - 2012-04-14 18:51 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-21 19:11 - 2011-01-19 19:48 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-21 19:11 - 2010-03-21 22:21 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-21 18:42 - 2013-08-17 09:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-21 18:40 - 2010-05-16 20:59 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-21 18:40 - 2009-11-05 05:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-21 18:26 - 2014-06-21 18:26 - 02070620 _____ () C:\Users\Kerstin\Downloads\FRST64(5).exe
2014-06-21 18:22 - 2014-06-21 18:22 - 02053676 _____ () C:\Users\Kerstin\Downloads\FRST64(7).exe
2014-06-21 18:21 - 2014-06-21 18:21 - 02067796 _____ () C:\Users\Kerstin\Downloads\FRST64(6).exe
2014-06-18 11:23 - 2014-06-18 11:22 - 00909068 _____ () C:\Users\Kerstin\Downloads\jxpiinstall(1).exe
2014-06-18 11:03 - 2014-06-18 11:02 - 00511516 _____ () C:\Users\Kerstin\Downloads\Kaspersky%20Anti-Virus.exe
2014-06-18 10:57 - 2014-06-18 10:57 - 02075632 _____ () C:\Users\Kerstin\Downloads\FRST64(4).exe
2014-06-17 12:24 - 2014-06-17 12:20 - 02060100 _____ () C:\Users\Kerstin\Downloads\FRST64(3).exe
2014-06-17 10:39 - 2014-06-17 10:39 - 02072808 _____ () C:\Users\Kerstin\Downloads\FRST64(2).exe
2014-06-16 12:16 - 2014-06-16 12:16 - 02074220 _____ () C:\Users\Kerstin\Downloads\FRST64(1).exe
2014-06-16 12:10 - 2014-06-16 12:10 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(3).exe
2014-06-16 12:09 - 2014-06-16 12:09 - 01068404 _____ () C:\Users\Kerstin\Downloads\FRST(2).exe
2014-06-16 12:00 - 2014-06-16 12:00 - 01062756 _____ () C:\Users\Kerstin\Downloads\FRST(1).exe
2014-06-16 11:59 - 2014-06-16 11:59 - 01059932 _____ () C:\Users\Kerstin\Downloads\FRST.exe
2014-06-16 11:58 - 2014-06-16 11:58 - 02065748 _____ () C:\Users\Kerstin\Downloads\FRST64.exe
2014-06-16 11:16 - 2014-06-16 11:07 - 00955712 _____ (Chip Digital GmbH) C:\Users\Kerstin\Downloads\Kaspersky Virus Removal Tool - CHIP-Installer.exe
2014-06-10 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-10 13:50 - 2014-06-10 13:49 - 00800624 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(7).exe
2014-06-10 13:35 - 2014-06-10 13:09 - 00000136 _____ () C:\Windows\Reimage.ini
2014-06-10 13:33 - 2014-06-10 13:33 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(6).exe
2014-06-10 13:15 - 2014-06-10 13:15 - 00000000 ____D () C:\ProgramData\CDB
2014-06-10 13:14 - 2014-06-10 13:14 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(5).exe
2014-06-10 13:12 - 2014-06-10 13:12 - 00802036 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(4).exe
2014-06-10 13:11 - 2014-06-10 13:11 - 00803448 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(3).exe
2014-06-10 13:09 - 2014-06-10 13:09 - 00817568 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(2).exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00811920 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair(1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00811436 _____ (Reimage®) C:\Users\Kerstin\Downloads\ReimageRepair.exe
2014-06-06 13:09 - 2014-03-21 18:07 - 00000000 ____D () C:\Users\Kerstin\AppData\Local\Paint.NET
2014-06-01 21:39 - 2014-06-01 16:13 - 00000000 ____D () C:\Users\Kerstin\Desktop\Unterlagen.bewerbung
2014-06-01 19:43 - 2014-06-01 15:57 - 00000000 ____D () C:\Users\Kerstin\Desktop\2014_06_01
2014-06-01 18:14 - 2013-12-15 12:30 - 00000000 ____D () C:\Users\Kerstin\Arbeit
2014-06-01 15:49 - 2011-05-28 19:49 - 00001348 _____ () C:\Windows\wininit.ini
2014-06-01 15:49 - 2010-11-17 17:20 - 00000000 ____D () C:\Users\Kerstin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\Kerstin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptuyjkv.dll
C:\Users\Kerstin\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Kerstin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kerstin\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Kerstin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Kerstin\AppData\Local\Temp\Quarantine.exe
C:\Users\Kerstin\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Kerstin\AppData\Local\Temp\Risweb32.exe
C:\Users\Kerstin\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Kerstin\AppData\Local\Temp\setup.exe
C:\Users\Kerstin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\sqlite3.exe
C:\Users\Kerstin\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Kerstin\AppData\Local\Temp\{8E994A0B-B690-491A-A63E-FFBEAE77DBF3}-35.0.1916.153_35.0.1916.114_chrome_updater.exe
C:\Users\Kerstin\AppData\Local\Temp\{C735D7CC-D3D0-41C5-8B8B-60B831538B53}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{C75FA2B7-CDA9-420D-813C-89B3F2E1F860}-GoogleUpdateSetup.exe
C:\Users\Kerstin\AppData\Local\Temp\{D66B12BD-EAC9-475A-9080-7394FB83F2B6}-35.0.1916.114_chrome_installer.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-22 21:45

==================== End Of Log ============================

--- --- ---



mbam
Code:

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 01.07.2014
Suchlauf-Zeit: 09:57:56
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.07.01.02
Rootkit Datenbank: v2014.07.01.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Kerstin

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 296003
Verstrichene Zeit: 25 Min, 50 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{058899d6-9704-4de3-aae7-17e9fc44c761}w64.sys, In Quarantäne, [05519ffbdc9fa096b19a54b5e91b3ec2],

Physische Sektoren: 0
(No malicious items detected)


(end)


Warlord711 01.07.2014 13:42

Keine Angst, die beiden Dateien sind legitim und auch so einfach nicht löschbar.
Mein Holzauge sieht auch keine aktiven Infektionen mehr, die Logs sind sauber.

Damit können wir uns ans "aufräumen" machen:

Aufräumen:
Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Update: Firefox, Addons und Plugins
Prüfe bitte auch (regelmässig), ob folgende Links fehlende Updates bei deinen Plugins zeigen:

Update: Adobe Reader

Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Haken für den McAfee SecurityScan bzw. Google Chrome.

Flash Player veraltet !

Deinstalliere bitte deine aktuelle Version von Adobe Player

Start--> Systemsteuerung--> Software--> Adobe Player und lade dir die neue Version von Hier herunter-
Entferne den Haken für den McAfee SecurityScan bzw. Google Chrome.

Dein Java ist nicht mehr aktuell.
Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 60 ) herunter laden.
  • Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
  • Klicke erneut OK.
schneller Plugin-Test: PluginCheck


und der Rest ?

Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems.


Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7 / 8 : Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti-Viren-Programm und zusätzlicher Schutz
  • Gehe sicher, dass du immer nur eine Anti-Viren Software installiert hast und dass diese auch up to date ist!
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion bietet zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • AdwCleaner
    Dieses Tool erkennt eine Vielzahl von Werbeprogrammen (Adware) und unerwümschten Programmen (PUPs).
    Starte das Tool einmal die Woche und lass es laufen. Sollte eine neue Version verfügbar sein, so wird dies angezeigt und du kannst dir die neueste Version direkt auf den Desktop downloaden.
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • WOT (Web of trust)
    Dieses AddOn warnt dich, bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Mozilla Firefox
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt, wenn Du es bestätigst.
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart außerdem Downloadkapazität.


Performance
  • Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
  • Halte dich fern von Registry Cleanern.
    Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link:
    Miekemoes Blogspot ( MVP )


Was du vermeiden solltest:
  • Klicke nicht auf alles, nur weil es dich dazu auffordert und schön bunt ist.
  • Verwende keine P2P oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie z.B. deinFoto.jpg.exe.
  • Lade keine Software von Softonic oder Chip herunter, da diese Installer oft mit Adware oder unerünschter Software versehen sind!



Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen?

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Warlord711 04.07.2014 07:25

;-)

1Stift 06.07.2014 21:18

Hallo Timo,

Holzauge? Ja ja - unter den Blinden ist der Einäugige der König...
Ich hatte leider viel Stress auf Arbeit und daher hatte ich erst heute abend Zeit, den Endspurt anzutreten und man glaubt es kaum - ich bin wieder auf ein Problem gestoßen (eigentlich zwei):
Es gibt auf meinem Computer eine Java(32-bit) und eine Flash Player (32-bit) Version. Diese finde ich direkt unter Systemsteuerung, ohne zuerst auf Programme zu klicken. Beide Dateien kann ich nicht deinstallieren, löschen oder verschieben.
Was ist denn davon zu halten?
:confused:

Warlord711 07.07.2014 07:56

Hast du denn die dazugehörigen Programme mit dem Revo Uninstaller oder über Systemsteuerung - Programme - Programm deinstallieren, deinstalliert ?

Die 2 Einträge Flash Player (32-bit) und Java (32-bit) sind immmer in der Systemsteuerung, wenn man Java oder Flash Player installiert hat. Darüber kannst du weitere Einstellungen zu Flash oder Java vornehmen.

Hier hatte ich dich gebeten, Flash+Java zu deinstallieren (da veraltet bzw. unsichere Versionen mit bekannten Sicherheitslücken).

1Stift 14.07.2014 14:22

Hallo Timo,

es hat etwas gedauert - aber gut Ding will ja bekanntlich Weile haben.
Habe auch die letzten Schritte durchgeführt. Die anderen Programme waren natürlich schon deinstalliert.
Also hiermit nocheinmal vielen lieben Dank für deine Hilfe.

Liebe Grüße
Kerstin


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:32 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131