Trojaner-Board - chrome://quick_start/content/index.html in Firefox-Tab

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - chrome://quick_start/content/index.html in Firefox-Tab (https://www.trojaner-board.de/156105-chrome-quick_start-content-index-html-firefox-tab.html)

chrome://quick_start/content/index.html in Firefox-Tab

Hallo,

ich wäre euch sehr dankbar, wenn ihr mir weiterhelfen könntet. Ich bekomme, wenn ich im Firefox einen leeren Tab aufmache, folgende Anzeige in der Eingabeleiste:
chrome://quick_start/content/index.html

Ich habe recherchiert und gesehen, dass es hierzu schon einen Thread gibt (http://www.trojaner-board.de/153863-...entfernen.html), daher habe ich mich für die Logfiles an diese Anweisungen gehalten. Da ich diese aber nicht interpretieren kann und nicht weiß, welche Schritte ich nachher unternehmen soll (um das zu entfernen), möchte ich euch um eure Hilfe bitten.

Ich würde hier die FRST.txt posten:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-07-2014

Ran by *** (administrator) on PC on 05-07-2014 00:59:35

Running from C:\Users\***\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Informatic Ltd.) C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe

(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Pan-el\VolPanlu.exe

(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Adobe Systems Inc.) E:\Programme\Acrobat 9.0\Acrobat\acrotray.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\UNS\UNS.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [3019376 2011-02-22] (VIA)

HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2012-04-18] (FNet Co., Ltd.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office 2010\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Soft-ware\Avast\AvastUI.exe [3890208 2014-07-04] (AVAST Software)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => E:\Programme\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] => E:\Programme\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2008-06-11] (Adobe Systems Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-4118839908-2255762619-2302489997-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2068856 2011-10-12] (Flexera Software LLC.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ORFO Agent.lnk

ShortcutTarget: ORFO Agent.lnk -> C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe (Informatic Ltd.)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache Accept-Langs = de-AT

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://at.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x02F4BAE30888CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://de.pons.com/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explor-er\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM-x32 - DefaultScope value is missing.

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corpora-tion)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Mi-crosoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Dragon NaturallySpeaking Rich Internet Application Support - Extension - {73A89C60-CF59-4EC7-9215-9B7EF05ECEA4} - E:\Dragon Naturally Speaking 12 Deutsch\Program\ieShim.dll (Nuance Communications, Inc.)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
 

FireFox:

========

FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815

FF NewTab: chrome://quick_start/content/index.html

FF Homepage: www.google.at | hxxp://de.pons.com/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silver-light\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()

FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @real.com/nprpjplug;version=12.0.1.669 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: nuance.com/DragonRIAPlugin - E:\DRAGON~4\Program\npDgnRia.dll (Nuance Communications Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\yahoo-de.xml

FF Extension: Classic Theme Restorer - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-27]

FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-27]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: No Name - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-06-24]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Soft-ware\Avast\WebRep\FF [2012-04-19]

FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi

FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi [2013-02-11]

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-05-29]
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR HKLM-x32\...\Chrome\Extension: [mikhcaiakabeeokmenglcdebplfdjicn] - E:\Dragon Naturally Speaking 12 Deutsch\Program\chromeShim.crx [2013-02-11]
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-26] (AVAST Software)

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-04-18] (Crea-tive Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2014-06-29] (Macro-vision Europe Ltd.) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S4 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-02-17] (VIA Technologies, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-26] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-26] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-26] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-26] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-26] ()

S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2012-04-18] (FNet Co., Ltd.)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-04-18] (FNet Co., Ltd.)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-07-05 00:59 - 2014-07-05 00:59 - 02083840 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 00:59 - 2014-07-05 00:59 - 00019248 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-05 00:47 - 2014-07-05 00:46 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-05 00:22 - 2014-07-05 00:35 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect

2014-07-04 21:41 - 2014-07-04 21:46 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00001119 _____ () C:\Users\***\Desktop\Free Torrent Viewer.lnk

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-06-29 22:08 - 2008-04-07 05:38 - 00024416 ____R (Adobe Systems Inc.) C:\Windows\system32\AdobePDFUI.dll

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-13 16:54 - 2014-06-29 22:12 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-13 15:59 - 2014-06-13 15:59 - 00000737 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 00:36 - 2014-06-13 00:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:07 - 2014-07-05 00:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-12 21:07 - 2014-06-12 21:08 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:07 - 2014-06-12 21:08 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:07 - 2014-06-12 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-11 07:26 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-11 07:26 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-11 07:26 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-11 07:26 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-11 07:26 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-11 07:26 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-11 07:26 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-11 07:26 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-11 07:26 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-11 07:26 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-11 07:26 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-11 07:26 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-11 07:26 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-11 07:26 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-11 07:26 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-11 07:26 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-11 07:26 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-11 07:26 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-11 07:26 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-11 07:26 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-11 07:25 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-11 07:25 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-10 23:44 - 2014-06-11 07:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
 

==================== One Month Modified Files and Folders =======
 

2014-07-05 00:59 - 2014-07-05 00:59 - 02083840 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 00:59 - 2014-07-05 00:59 - 00019248 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-05 00:59 - 2014-05-11 18:53 - 00000000 ____D () C:\FRST

2014-07-05 00:56 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-05 00:56 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-05 00:55 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat

2014-07-05 00:55 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat

2014-07-05 00:55 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-05 00:49 - 2014-05-13 11:37 - 00000000 ____D () C:\AdwCleaner

2014-07-05 00:49 - 2013-03-04 22:40 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-05 00:49 - 2012-04-18 22:45 - 01880857 _____ () C:\Windows\WindowsUpdate.log

2014-07-05 00:49 - 2010-11-21 05:47 - 00914616 _____ () C:\Windows\PFRO.log

2014-07-05 00:49 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-07-05 00:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-05 00:49 - 2009-07-14 06:51 - 00171725 _____ () C:\Windows\setupact.log

2014-07-05 00:46 - 2014-07-05 00:47 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-05 00:41 - 2014-05-13 11:24 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-05 00:37 - 2014-06-12 21:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-05 00:35 - 2014-07-05 00:22 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect

2014-07-05 00:35 - 2012-05-12 21:03 - 00000000 ____D () C:\Users\***\AppData\Local\CrashDumps

2014-07-05 00:33 - 2014-05-17 15:06 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-07-05 00:33 - 2012-04-18 16:36 - 00001425 _____ () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-07-05 00:17 - 2013-03-04 22:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-04 21:46 - 2014-07-04 21:41 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:46 - 2012-04-18 16:36 - 00000000 ____D () C:\Users\***

2014-07-04 21:41 - 2012-04-18 23:36 - 00103928 _____ () C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-04 21:40 - 2014-07-04 21:40 - 00001119 _____ () C:\Users\***\Desktop\Free Torrent Viewer.lnk

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-07-02 19:32 - 2012-07-17 22:28 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-07-02 14:33 - 2012-09-08 14:45 - 00000000 ____D () C:\Users\***\AppData\Roaming\Skype

2014-06-30 22:56 - 2012-06-24 16:12 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc

2014-06-30 10:19 - 2009-07-14 06:45 - 00404344 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-06-29 22:12 - 2014-06-13 16:54 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-29 22:12 - 2013-05-31 23:53 - 00000000 ____D () C:\ProgramData\FLEXnet

2014-06-29 22:12 - 2012-04-18 18:26 - 00000000 ____D () C:\Users\***\AppData\Roaming\Adobe

2014-06-29 22:08 - 2012-04-18 18:26 - 00000000 ____D () C:\ProgramData\Adobe

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-28 14:09 - 2013-08-08 15:26 - 00000000 ____D () C:\ProgramData\Package Cache

2014-06-27 19:44 - 2012-04-22 14:10 - 00000000 ____D () C:\Users\***\Desktop\***

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-27 14:35 - 2012-04-18 23:36 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-21 21:12 - 2013-03-04 22:40 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-21 21:12 - 2013-03-04 22:40 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-14 21:56 - 2013-12-11 02:17 - 00014820 _____ () C:\Windows\IE11_main.log

2014-06-13 15:59 - 2014-06-13 15:59 - 00000737 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-13 15:59 - 2014-05-13 11:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 09:53 - 2012-05-03 11:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-13 00:37 - 2014-06-13 00:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:08 - 2014-06-12 21:07 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:08 - 2014-06-12 21:07 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:08 - 2014-06-12 21:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-12 14:13 - 2013-06-13 16:03 - 00000000 ____D () C:\Windows\rescache

2014-06-11 10:08 - 2013-07-25 11:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-11 10:07 - 2012-05-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-11 10:07 - 2012-04-19 13:54 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-11 10:06 - 2014-04-30 10:52 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-11 07:36 - 2014-06-10 23:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-06-08 11:13 - 2014-06-11 07:25 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 11:08 - 2014-06-11 07:25 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
 

Files to move or delete:

====================

C:\ProgramData\ezsid.dat
 
 

Some content of TEMP:

====================

C:\Users\***\AppData\Local\Temp\htmlayout.dll

C:\Users\***\AppData\Local\Temp\ochelper.exe

C:\Users\***\AppData\Local\Temp\Quarantine.exe

C:\Users\***\AppData\Local\Temp\toolbar39931093.exe

C:\Users\***\AppData\Local\Temp\toolbar39933689.exe

C:\Users\***\AppData\Local\Temp\uninstall-updater40826630.exe

C:\Users\***\AppData\Local\Temp\uninstall39996032.exe

C:\Users\***\AppData\Local\Temp\uninstall40009989.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-28 10:54
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Und hier die Addition:

FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-07-2014

Ran by *** at 2014-07-05 01:04:15

Running from C:\Users\***\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 2.0.0.0 - Adobe Systems Incorporated)

Acrobat.com (x32 Version: 2.0.0 - Adobe Systems Incorporated) Hidden

Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{C23EE7CE-C1A3-4F94-A8F0-9E0AC9C6DE6E}) (Version: 1.1 - Eyeo GmbH)

Adblock Plus for IE (HKLM-x32\...\{fd97d1e2-368a-4cd9-af63-8eeff938044a}) (Ver-sion: 1.1 - )

Adobe Acrobat 9 Pro - Italiano, Español, Nederlands, Português (HKLM-x32\...\{AC76BA86-1040-7D70-7760-000000000004}{AC76BA86-1040-7D70-7760-000000000004}) (Version: 9.0.0 - Adobe Systems)

Adobe Acrobat 9 Pro - Italiano, Español, Nederlands, Português (x32 Version: 9.0.0 - Adobe Systems) Hidden

Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)

Adobe Download Assistant (x32 Version: 1.2.6 - Adobe Systems Incorporated) Hid-den

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)

Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version:  - ASRock Inc.)

ASRock eXtreme Tuner v0.1.77 (HKLM-x32\...\ASRock eXtreme Tuner_is1) (Version:  - )

ASRock InstantBoot v1.26 (HKLM-x32\...\ASRock InstantBoot_is1) (Version:  - )

avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software)

Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )

Canon iP4200 (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4200) (Version:  - )

Canon MG3100 series Benutzerregistrierung (HKLM-x32\...\Canon MG3100 series Benutzerregistrierung) (Version:  - )

Canon MG3100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3100_series) (Version:  - )

Canon MG3100 series On-screen Manual (HKLM-x32\...\Canon MG3100 series On-screen Manual) (Version:  - )

Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version:  - )

Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )

Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )

Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{CA75CBF9-B078-47CB-ABA3-74EFD4FC9A43}) (Version:  - Microsoft)

Dragon NaturallySpeaking 12 (HKLM-x32\...\{D5D422B9-6976-4E98-8DDF-9632CB515D7E}) (Version: 12.50.000 - Nuance Communications Inc.)

Feature Update Service (YFD) (HKCU\...\YourFileDownloaderUpdater) (Version: 2.14.27 - ) <==== ATTENTION

Free Studio version 2014 (HKLM-x32\...\Free Studio_is1) (Version: 6.3.3.528 - DVDVideoSoft Ltd.)

FreeTorrentViewer (HKLM-x32\...\FreeTorrentViewer) (Version: 1.0.0.1 - Free Torrent Viewer)

Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Ver-sion: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)

Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)

Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Access MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Access MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Access MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Language Pack 2010 - Portuguese/Português (Brasil) (HKLM-x32\...\Office14.OMUI.pt-br) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Language Pack 2010 - Portuguese/Português (HKLM-x32\...\Office14.OMUI.pt-pt) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Language Pack 2010 - Spanish/Español (HKLM-x32\...\Office14.OMUI.es-es) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office O MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office O MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office O MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Ver-sion: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Basque) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Cor-poration) Hidden

Microsoft Office Proof (Catalan) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Cor-poration) Hidden

Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Cor-poration) Hidden

Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Cor-poration) Hidden

Microsoft Office Proof (Galician) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Cor-poration) Hidden

Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Cor-poration) Hidden

Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corpo-ration) Hidden

Microsoft Office Proof (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Proof (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Cor-poration) Hidden

Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (Portuguese (Brazil)) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (Portuguese (Portugal)) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (Spanish) 2010 (Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office Shared MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Mi-crosoft Corporation) Hidden

Microsoft Office SharePoint Designer MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office SharePoint Designer MUI (Portuguese (Portugal)) 2010 (x32 Ver-sion: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office SharePoint Designer MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office X MUI (Portuguese (Brazil)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office X MUI (Portuguese (Portugal)) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office X MUI (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Ver-sion: 5.1.30214.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Mi-crosoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Mi-crosoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Mi-crosoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{cde5fd82-4a8f-483e-adf0-ca7343d00433}) (Version: 11.0.51106.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden

Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

Nero 12 (HKLM-x32\...\{80836C86-1305-40C9-B7C9-F3A75266070D}) (Version: 12.5.01900 - Nero AG)

Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0 - Nero AG) Hidden

Nero BackItUp (x32 Version: 12.5.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.13000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.20014 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.9000 - Nero AG) Hidden

Nero Burning ROM (x32 Version: 12.5.5001 - Nero AG) Hidden

Nero Burning ROM Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.15600 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.20200 - Nero AG) Hidden

Nero Disc Menus Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Effects Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Express (x32 Version: 12.5.5002 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.13000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.20100 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero PiP Effects Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Recode (x32 Version: 12.5.6000 - Nero AG) Hidden

Nero Recode Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.10002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

Nero Video (x32 Version: 12.5.2001 - Nero AG) Hidden

Nero Video Help (CHM) (x32 Version: 12.0.12000 - Nero AG) Hidden

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Office-Bibliothek (HKLM-x32\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.00.4 - Bibliographisches Institut & F.A. Brockhaus AG)

Opera Stable 22.0.1471.70 (HKLM-x32\...\Opera 22.0.1471.70) (Version: 22.0.1471.70 - Opera Software ASA)

ORFO 9.0 (HKLM-x32\...\InstallShield_{FDEA11CF-BAF9-4EFE-AF7C-58EAB614A407}) (Version: 9.0 - Informatic)

ORFO 9.0 (HKLM-x32\...\Orfo) (Version:  - )

ORFO 9.0 (x32 Version: 9.0 - Informatic) Hidden

Platform (x32 Version: 1.36 - VIA Technologies, Inc.) Hidden

Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Versi-on: 7.75.80.95 - Apple Inc.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.41.216.2011 - Realtek)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden

Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (HKLM-x32\...\{90140000-0100-0416-0000-0000000FF1CE}_Office14.OMUI.pt-br_{1C7BD792-204F-49EB-BF0B-A0F9C904128D}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (HKLM-x32\...\{90140000-0100-0816-0000-0000000FF1CE}_Office14.OMUI.pt-pt_{95604CB2-E3F3-40FD-B90D-2DB0F144F4A2}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (HKLM-x32\...\{90140000-0100-0C0A-0000-0000000FF1CE}_Office14.OMUI.es-es_{18B9CFE9-6DD6-4C09-8146-F443DBBD62CF}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 Language Pack (KB2687449) 32-Bit Edition (x32 Version:  - Microsoft) Hidden

Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Ver-sion: 6.16.105 - Skype Technologies S.A.)

Sound Blaster X-Fi MB (HKLM-x32\...\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}) (Version: 1.0 - Creative Technology Limited)

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Tele2 Internet (x32 Version: 1.0 - Tele2UTA Telecommunication GmbH) Hidden

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0100-0416-0000-0000000FF1CE}_Office14.OMUI.pt-br_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0100-0816-0000-0000000FF1CE}_Office14.OMUI.pt-pt_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0100-0C0A-0000-0000000FF1CE}_Office14.OMUI.es-es_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.OMUI.es-es_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.OMUI.pt-pt_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.OMUI.es-es_{5E8EB600-8B94-429E-873E-98369C6DC1BC}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.OMUI.pt-br_{5E8EB600-8B94-429E-873E-98369C6DC1BC}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.OMUI.pt-pt_{5E8EB600-8B94-429E-873E-98369C6DC1BC}) (Version:  - Microsoft)

Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0416-0000-0000000FF1CE}_Office14.OMUI.pt-br_{956FF6E4-8BBB-4B9A-9279-8A34D8C1FF9D}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0816-0000-0000000FF1CE}_Office14.OMUI.pt-pt_{3552349D-C975-406D-84B8-BA298D01D5F7}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0C0A-0000-0000000FF1CE}_Office14.OMUI.es-es_{A57A9AE3-09A9-44A0-AA78-458C71DA6FDE}) (Version:  - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0416-0000-0000000FF1CE}_Office14.OMUI.pt-br_{27F43FC3-052A-41B5-9F39-68514C0AABC2}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0816-0000-0000000FF1CE}_Office14.OMUI.pt-pt_{44E3400B-C404-4656-8D25-EBEC0E6A5222}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0C0A-0000-0000000FF1CE}_Office14.OMUI.es-es_{837C1EAC-6A89-44A0-8C45-E655AAFD8CE1}) (Version:  - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)

Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)

Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)

Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version:  - Microsoft)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.36 - VIA Technologies, Inc.)

VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)

Welcome App (Start-up experience) (x32 Version: 12.0.15000 - Nero AG) Hidden

WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

XFastUsb (HKLM-x32\...\XFastUsb) (Version:  - )
 

==================== Restore Points  =========================
 

04-07-2014 11:20:27 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 04:34 - 2014-05-12 11:11 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {03783D24-AA74-4CDE-B9F4-D3ABE357AA53} - Sys-tem32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-04] (Google Inc.)

Task: {096FEDF5-8579-4831-B7BC-462F5EBFD18F} - Sys-tem32\Tasks\{8EFD28B5-5E1F-4DE6-96B8-F7CF102255A3} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-05-08] (Skype Technologies S.A.)

Task: {1248B4FD-7AE0-4B42-B790-866611FFEA14} - \DealPlyUpdate No Task File <==== ATTENTION

Task: {13BA7AE6-F9FE-4346-A602-5F929F560903} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-12] (Adobe Systems Incorporated)

Task: {13CB59E9-9BE8-4C54-B915-88CC0A9CB39B} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

Task: {70D49EDE-CC31-45B2-BD2A-80FA3521CD8C} - System32\Tasks\Opera scheduled Autoupdate 1403717996 => C:\Program Files (x86)\Opera\launcher.exe [2014-06-16] (Opera Software)

Task: {7737FC9A-D9B2-456E-9E71-76F57B240B37} - \YourFile DownloaderUpdate No Task File <==== ATTENTION

Task: {825D6925-CBE2-468F-AA1B-2C6AEDA58972} - Sys-tem32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {85218FCB-9AF2-4874-B6FF-742282D14F92} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-04-26] (AVAST Software)

Task: {A3D367F9-DF1F-4D7A-9C93-2A55841D67C0} - Sys-tem32\Tasks\RealUpgradeLogonTaskS-1-5-21-4118839908-2255762619-2302489997-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-06-21] (RealNetworks, Inc.)

Task: {AA1CF60E-851D-4740-B83A-F128B4B22DB2} - Sys-tem32\Tasks\RealUpgradeScheduledTaskS-1-5-21-4118839908-2255762619-2302489997-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-06-21] (RealNetworks, Inc.)

Task: {B4F34596-E14C-4B4B-8A0E-D14F6D3D477D} - System32\Tasks\Java Up-date Scheduler => C:\Program Files (x86)\Common Files\Java\Java Up-date\jusched.exe

Task: {D17E44B3-BF5E-4467-9E04-32B24F519B31} - Sys-tem32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {E39552D0-681F-4E9D-8E67-6DFAA77FBF39} - Sys-tem32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-04] (Google Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2012-04-18 18:22 - 2011-01-27 02:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-04-18 18:23 - 2011-02-22 08:03 - 00078448 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll

2012-04-18 18:23 - 2011-02-22 08:03 - 00386160 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll

2012-04-18 18:23 - 2011-02-22 08:03 - 00621168 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll

2014-07-04 21:18 - 2014-07-04 21:18 - 02789888 _____ () C:\Program Files\AVAST Software\Avast\defs\14070401\algo.dll

2012-04-18 18:27 - 2009-02-06 18:52 - 00073728 _____ () C:\Windows\SysWOW64\CmdRtr.DLL

2012-04-18 18:27 - 2009-04-20 11:55 - 00148480 _____ () C:\Windows\SysWOW64\APOMngr.DLL

2014-03-22 22:35 - 2014-03-22 22:35 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-06-10 23:44 - 2014-06-10 23:44 - 03022960 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll

2014-06-10 23:44 - 2014-06-10 23:44 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll

2014-06-10 23:44 - 2014-06-10 23:44 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll

2014-06-13 00:36 - 2014-06-13 00:37 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2014-06-12 21:07 - 2014-06-12 21:08 - 17024688 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll

2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== EXE Association (whitelisted) =============
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

MSCONFIG\Services: NAUpdate => 2

MSCONFIG\Services: VIAKaraokeService => 2

MSCONFIG\Services: WSearch => 2

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon

MSCONFIG\startupreg: VoipCheapCom => "E:\VoipCheapCom\VoipCheapCom.exe" -nosplash -minimized
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (07/05/2014 00:58:57 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm FRST64.exe, Version 17.5.2014.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 138c
 

Startzeit: 01cf97db7d4f4dd1
 

Endzeit: 6
 

Anwendungspfad: E:\Utilities\2014\FRST64.exe
 

Berichts-ID: c250d896-03ce-11e4-9d31-002522ce01c6
 

Error: (07/05/2014 00:49:45 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND Target-Instance.LoadPercentage > 990x80041003
 

Error: (07/05/2014 00:37:55 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (07/05/2014 00:35:06 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233

Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393

Ausnahmecode: 0x80000003

Fehleroffset: 0x0000141b

ID des fehlerhaften Prozesses: 0x1480

Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0

Pfad der fehlerhaften Anwendung: plugin-container.exe1

Pfad des fehlerhaften Moduls: plugin-container.exe2

Berichtskennung: plugin-container.exe3
 

Error: (07/05/2014 00:22:19 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233

Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393

Ausnahmecode: 0x80000003

Fehleroffset: 0x0000141b

ID des fehlerhaften Prozesses: 0x1b64

Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0

Pfad der fehlerhaften Anwendung: plugin-container.exe1

Pfad des fehlerhaften Moduls: plugin-container.exe2

Berichtskennung: plugin-container.exe3
 

Error: (07/05/2014 00:22:11 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233

Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393

Ausnahmecode: 0x80000003

Fehleroffset: 0x0000141b

ID des fehlerhaften Prozesses: 0xe80

Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0

Pfad der fehlerhaften Anwendung: plugin-container.exe1

Pfad des fehlerhaften Moduls: plugin-container.exe2

Berichtskennung: plugin-container.exe3
 

Error: (07/04/2014 11:19:22 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233

Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393

Ausnahmecode: 0x80000003

Fehleroffset: 0x0000141b

ID des fehlerhaften Prozesses: 0xc04

Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0

Pfad der fehlerhaften Anwendung: plugin-container.exe1

Pfad des fehlerhaften Moduls: plugin-container.exe2

Berichtskennung: plugin-container.exe3
 

Error: (07/04/2014 01:44:41 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (07/04/2014 01:16:18 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND Target-Instance.LoadPercentage > 990x80041003
 

Error: (07/03/2014 11:15:56 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
 

System errors:

=============

Error: (07/05/2014 00:35:09 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Update Adanak" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/25/2014 09:30:55 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)

Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
 

Error: (06/21/2014 02:08:28 AM) (Source: Service Control Manager) (EventID: 7043) (User: )

Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
 

Error: (06/15/2014 06:19:41 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 

Error: (06/15/2014 06:19:41 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 

Error: (06/15/2014 06:19:40 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 

Error: (06/15/2014 06:19:40 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 

Error: (06/14/2014 09:44:29 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 

Error: (06/14/2014 09:42:41 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 

Error: (06/14/2014 09:42:40 PM) (Source: Disk) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR2 gefunden.
 
 

Microsoft Office Sessions:

=========================

Error: (07/05/2014 00:58:57 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: FRST64.exe17.5.2014.0138c01cf97db7d4f4dd16E:\Utilities\2014\FRST64.exec250d896-03ce-11e4-9d31-002522ce01c6
 

Error: (07/05/2014 00:49:45 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND Target-Instance.LoadPercentage > 990x80041003
 

Error: (07/05/2014 00:37:55 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-con-trols_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-con-trols_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestE:\Utilities\2014\esetsmartinstaller_deu.exe
 

Error: (07/05/2014 00:35:06 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: plugin-contain-er.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b148001cf97d79988fde3C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll723b3d6d-03cb-11e4-9de8-002522ce01c6
 

Error: (07/05/2014 00:22:19 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: plugin-contain-er.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b1b6401cf97d6683e483fC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlla8d6c30b-03c9-11e4-9de8-002522ce01c6
 

Error: (07/05/2014 00:22:11 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: plugin-contain-er.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141be8001cf97cda4cb72b8C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlla44d806b-03c9-11e4-9de8-002522ce01c6
 

Error: (07/04/2014 11:19:22 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: plugin-contain-er.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141bc0401cf9779d123c49fC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllddd9f39b-03c0-11e4-9de8-002522ce01c6
 

Error: (07/04/2014 01:44:41 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-con-trols_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-con-trols_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestE:\Dragon Naturally Speaking 12 Deutsch\Program\dragon_support_packager.exe
 

Error: (07/04/2014 01:16:18 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND Target-Instance.LoadPercentage > 990x80041003
 

Error: (07/03/2014 11:15:56 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-con-trols_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-con-trols_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestE:\Dragon Naturally Speaking 12 Deutsch\Program\dragon_support_packager.exe
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-05-12 11:10:53.249

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Da-teihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-05-12 11:10:53.156

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Da-teihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 48%

Total physical RAM: 3816.75 MB

Available physical RAM: 1975.46 MB

Total Pagefile: 7631.67 MB

Available Pagefile: 5796.19 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:59.53 GB) (Free:9.72 GB) NTFS

Drive d: (Digui_01) (CDROM) (Total:0.37 GB) (Free:0 GB) UDF

Drive e: (Volume) (Fixed) (Total:931.51 GB) (Free:621.78 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 36DE7CD4)

Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 60 GB) (Disk ID: 5B478C15)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=60 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Könnt ihr mir weiterhelfen und mir sagen, wie ich das wieder entfernen kann?
Vielen Dank im Voraus.

PS: Ich wollte meinen Beitrag eigentlich in das Forum "Plagegeister" stellen, habe mich aber anscheinend verklickt.. Entschuldigung!

hi,

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo,

vielen Dank!!

Ich poste nach und nach die Logfiles:

MBAM:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 05.07.2014

Suchlauf-Zeit: 14:09:22

Logdatei: 

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.07.05.04

Rootkit Datenbank: v2014.07.03.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: ***
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 311530

Verstrichene Zeit: 6 Min, 22 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 1

PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, In Quarantäne, [3dab980381fa6cca776035d9dc28c43c], 
 

Registrierungswerte: 1

PUP.Optional.FastStart.A, HKU\S-1-5-21-4118839908-2255762619-2302489997-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, In Quarantäne, [46a2dac1e7941e18d8b68132986a2dd3]
 

Registrierungsdaten: 3

PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EX-PLORER\SEARCH|CustomizeSearch, hxxp://istart.webssearches.com/web/?type=ds&ts=1404512531&from=exp&uid=M4-CT064M4SSD2_0000000012040903D76B&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1404512531&from=exp&uid=M4-CT064M4SSD2_0000000012040903D76B&q={searchTerms}),Ersetzt,[e305f7a4c2b9eb4bdff5d1b84abaea16]

PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EX-PLORER\SEARCH|SearchAssistant, hxxp://istart.webssearches.com/web/?type=ds&ts=1404512531&from=exp&uid=M4-CT064M4SSD2_0000000012040903D76B&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1404512531&from=exp&uid=M4-CT064M4SSD2_0000000012040903D76B&q={searchTerms}),Ersetzt,[b038a1fac1ba6ec8c016a5e4c34152ae]

PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLOR-ER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[3bada4f7d8a3c57118e9940061a3a25e]
 

Ordner: 3

PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, In Quarantäne, [b434811a116a61d5b07ddcd53dc540c0], 

PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\log, In Quarantäne, [b434811a116a61d5b07ddcd53dc540c0], 

PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, In Quarantäne, [b434811a116a61d5b07ddcd53dc540c0], 
 

Dateien: 7

PUP.Optional.Bandoo, C:\$RECYCLE.BIN\S-1-5-21-4118839908-2255762619-2302489997-1000\$RTTP6FW.exe, In Quarantäne, [9355b6e5cdaec1754aaf36d9629f9967], 

PUP.Optional.SearchHijacker.A, C:\Users\***\AppData\Local\Temp\toolbar39933689.exe, In Quarantäne, [3aaea9f27ffc0036e6b597fdc140a25e], 

PUP.Optional.YourFileDownloader, C:\Users\***\AppData\Local\Temp\uninstall-updater40826630.exe, In Quarantäne, [cb1d9cffdc9fc76f50d21d01f20e6799], 

PUP.Optional.YourFileDownloader, C:\Users\***\AppData\Local\Temp\uninstall39996032.exe, In Quarantäne, [f5f3405baad19b9b24feb26cc739d22e], 

PUP.Optional.YourFileDownloader, C:\Users\***\AppData\Local\Temp\uninstall40009989.exe, In Quarantäne, [02e6ff9cb2c96ccad34f859978880af6], 

PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\log\ProtectWindowsManager_2014-07-05[00-22-53-270].log, In Quarantäne, [b434811a116a61d5b07ddcd53dc540c0], 

PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, In Quarantäne, [b434811a116a61d5b07ddcd53dc540c0], 
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

AdwCleaner

AdwCleaner Logfile:

Code:

# AdwCleaner v3.214 - Bericht erstellt am 05/07/2014 um 14:30:11

# Aktualisiert 29/06/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : *** - PC

# Gestartet von : C:\Users\***\Desktop\adwcleaner_3.214.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17126
 
 

-\\ Mozilla Firefox v30.0 (de)
 

[ Datei : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\prefs.js ]
 
 

-\\ Google Chrome v
 

*************************
 

AdwCleaner[R0].txt - [14807 octets] - [13/05/2014 11:37:10]

AdwCleaner[R1].txt - [2926 octets] - [14/06/2014 00:55:41]

AdwCleaner[R2].txt - [5913 octets] - [05/07/2014 00:47:20]

AdwCleaner[R3].txt - [5973 octets] - [05/07/2014 00:48:29]

AdwCleaner[R4].txt - [1269 octets] - [05/07/2014 14:28:24]

AdwCleaner[S0].txt - [14528 octets] - [13/05/2014 11:44:53]

AdwCleaner[S1].txt - [2767 octets] - [14/06/2014 00:56:39]

AdwCleaner[S2].txt - [4761 octets] - [05/07/2014 00:49:02]

AdwCleaner[S3].txt - [1191 octets] - [05/07/2014 14:30:11]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1251 octets] ##########

--- --- ---

Und hier JRT.txt

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by *** on 05.07.2014 at 14:34:31,67

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\ztgcxzx1.default-1401185900815\minidumps [5 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 05.07.2014 at 14:42:04,80

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hier kommt noch das neue FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-07-2014

Ran by *** (administrator) on PC on 05-07-2014 14:53:13

Running from C:\Users\***\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Informatic Ltd.) C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe

(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe

(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Pan-el\VolPanlu.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Adobe Systems Inc.) E:\Programme\Acrobat 9.0\Acrobat\acrotray.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office 2010\Office14\WINWORD.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [3019376 2011-02-22] (VIA)

HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2012-04-18] (FNet Co., Ltd.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office 2010\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Soft-ware\Avast\AvastUI.exe [4086432 2014-07-05] (AVAST Software)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => E:\Programme\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] => E:\Programme\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2008-06-11] (Adobe Systems Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-4118839908-2255762619-2302489997-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2068856 2011-10-12] (Flexera Software LLC.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ORFO Agent.lnk

ShortcutTarget: ORFO Agent.lnk -> C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe (Informatic Ltd.)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache Accept-Langs = de-AT

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://at.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x02F4BAE30888CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://de.pons.com/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explor-er\iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope value is missing.

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corpora-tion)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Mi-crosoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Dragon NaturallySpeaking Rich Internet Application Support - Extension - {73A89C60-CF59-4EC7-9215-9B7EF05ECEA4} - E:\Dragon Naturally Speaking 12 Deutsch\Program\ieShim.dll (Nuance Communications, Inc.)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
 

FireFox:

========

FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815

FF NewTab: chrome://quick_start/content/index.html

FF Homepage: www.google.at | hxxp://de.pons.com/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silver-light\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()

FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @real.com/nprpjplug;version=12.0.1.669 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: nuance.com/DragonRIAPlugin - E:\DRAGON~4\Program\npDgnRia.dll (Nuance Communications Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\yahoo-de.xml

FF Extension: Classic Theme Restorer - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-27]

FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-27]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: No Name - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-06-24]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Soft-ware\Avast\WebRep\FF [2012-04-19]

FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi

FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi [2013-02-11]

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-05-29]
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-05]

CHR HKLM-x32\...\Chrome\Extension: [mikhcaiakabeeokmenglcdebplfdjicn] - E:\Dragon Naturally Speaking 12 Deutsch\Program\chromeShim.crx [2013-02-11]
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-05] (AVAST Software)

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-04-18] (Crea-tive Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2014-06-29] (Macro-vision Europe Ltd.) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S4 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-02-17] (VIA Technologies, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-05] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-05] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-05] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-05] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-05] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-05] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-05] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-05] ()

S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2012-04-18] (FNet Co., Ltd.)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-04-18] (FNet Co., Ltd.)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-05] (Malwarebytes Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-07-05 14:53 - 2014-07-05 14:53 - 00019395 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-05 14:53 - 2014-07-05 14:53 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion

2014-07-05 14:42 - 2014-07-05 14:42 - 00000774 _____ () C:\Users\***\Desktop\JRT.txt

2014-07-05 14:34 - 2014-07-05 14:34 - 01016261 _____ (Thisisu) C:\Users\***\Desktop\JRT.exe

2014-07-05 14:18 - 2014-07-05 14:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-07-05 14:08 - 2014-07-05 14:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-05 14:08 - 2014-07-05 14:08 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-05 14:08 - 2014-07-05 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-05 14:08 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-05 14:08 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-05 14:08 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-05 00:59 - 2014-07-05 14:53 - 02084352 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 00:47 - 2014-07-05 14:26 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-04 21:41 - 2014-07-04 21:46 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00001119 _____ () C:\Users\***\Desktop\Free Torrent Viewer.lnk

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-06-29 22:08 - 2008-04-07 05:38 - 00024416 ____R (Adobe Systems Inc.) C:\Windows\system32\AdobePDFUI.dll

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-13 16:54 - 2014-06-29 22:12 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 00:36 - 2014-06-13 00:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:07 - 2014-07-05 14:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-12 21:07 - 2014-06-12 21:08 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:07 - 2014-06-12 21:08 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:07 - 2014-06-12 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-11 07:26 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-11 07:26 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-11 07:26 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-11 07:26 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-11 07:26 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-11 07:26 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-11 07:26 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-11 07:26 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-11 07:26 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-11 07:26 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-11 07:26 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-11 07:26 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-11 07:26 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-11 07:26 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-11 07:26 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-11 07:26 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-11 07:26 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-11 07:26 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-11 07:26 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-11 07:26 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-11 07:25 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-11 07:25 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-10 23:44 - 2014-06-11 07:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
 

==================== One Month Modified Files and Folders =======
 

2014-07-05 14:53 - 2014-07-05 14:53 - 00019395 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-05 14:53 - 2014-07-05 14:53 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion

2014-07-05 14:53 - 2014-07-05 00:59 - 02084352 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 14:53 - 2014-05-11 18:53 - 00000000 ____D () C:\FRST

2014-07-05 14:42 - 2014-07-05 14:42 - 00000774 _____ () C:\Users\***\Desktop\JRT.txt

2014-07-05 14:37 - 2014-06-12 21:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-05 14:37 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-05 14:37 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-05 14:36 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat

2014-07-05 14:36 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat

2014-07-05 14:36 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-05 14:34 - 2014-07-05 14:34 - 01016261 _____ (Thisisu) C:\Users\***\Desktop\JRT.exe

2014-07-05 14:33 - 2014-05-13 11:37 - 00000000 ____D () C:\AdwCleaner

2014-07-05 14:30 - 2013-03-04 22:40 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-05 14:30 - 2012-07-17 22:28 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-07-05 14:30 - 2012-04-18 22:45 - 01915209 _____ () C:\Windows\WindowsUpdate.log

2014-07-05 14:30 - 2010-11-21 05:47 - 00918900 _____ () C:\Windows\PFRO.log

2014-07-05 14:30 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-05 14:30 - 2009-07-14 06:51 - 00172061 _____ () C:\Windows\setupact.log

2014-07-05 14:26 - 2014-07-05 00:47 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-05 14:23 - 2014-07-05 14:08 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-05 14:18 - 2014-07-05 14:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-07-05 14:18 - 2014-04-26 17:51 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-07-05 14:18 - 2014-03-22 22:35 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-07-05 14:18 - 2013-03-21 15:18 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-07-05 14:18 - 2013-03-21 15:18 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-07-05 14:18 - 2012-04-19 14:20 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-07-05 14:17 - 2013-03-04 22:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-05 14:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\TAPI

2014-07-05 14:08 - 2014-07-05 14:08 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-05 14:08 - 2014-07-05 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-05 14:08 - 2014-05-13 11:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-05 12:53 - 2012-09-08 14:45 - 00000000 ____D () C:\Users\***\AppData\Roaming\Skype

2014-07-05 00:49 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-07-05 00:35 - 2012-05-12 21:03 - 00000000 ____D () C:\Users\***\AppData\Local\CrashDumps

2014-07-05 00:33 - 2014-05-17 15:06 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-07-05 00:33 - 2012-04-18 16:36 - 00001425 _____ () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-07-04 21:46 - 2014-07-04 21:41 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:46 - 2012-04-18 16:36 - 00000000 ____D () C:\Users\***

2014-07-04 21:41 - 2012-04-18 23:36 - 00103928 _____ () C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-04 21:40 - 2014-07-04 21:40 - 00001119 _____ () C:\Users\***\Desktop\Free Torrent Viewer.lnk

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-06-30 22:56 - 2012-06-24 16:12 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc

2014-06-30 10:19 - 2009-07-14 06:45 - 00404344 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-06-29 22:12 - 2014-06-13 16:54 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-29 22:12 - 2013-05-31 23:53 - 00000000 ____D () C:\ProgramData\FLEXnet

2014-06-29 22:12 - 2012-04-18 18:26 - 00000000 ____D () C:\Users\***\AppData\Roaming\Adobe

2014-06-29 22:08 - 2012-04-18 18:26 - 00000000 ____D () C:\ProgramData\Adobe

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-28 14:09 - 2013-08-08 15:26 - 00000000 ____D () C:\ProgramData\Package Cache

2014-06-27 19:44 - 2012-04-22 14:10 - 00000000 ____D () C:\Users\***\Desktop\***

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-27 14:35 - 2012-04-18 23:36 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-21 21:12 - 2013-03-04 22:40 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-21 21:12 - 2013-03-04 22:40 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-14 21:56 - 2013-12-11 02:17 - 00014820 _____ () C:\Windows\IE11_main.log

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 09:53 - 2012-05-03 11:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-13 00:37 - 2014-06-13 00:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:08 - 2014-06-12 21:07 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:08 - 2014-06-12 21:07 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:08 - 2014-06-12 21:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-12 14:13 - 2013-06-13 16:03 - 00000000 ____D () C:\Windows\rescache

2014-06-11 10:08 - 2013-07-25 11:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-11 10:07 - 2012-05-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-11 10:07 - 2012-04-19 13:54 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-11 10:06 - 2014-04-30 10:52 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-11 07:36 - 2014-06-10 23:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-06-08 11:13 - 2014-06-11 07:25 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 11:08 - 2014-06-11 07:25 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
 

Files to move or delete:

====================

C:\ProgramData\ezsid.dat
 
 

Some content of TEMP:

====================

C:\Users\***\AppData\Local\Temp\htmlayout.dll

C:\Users\***\AppData\Local\Temp\ochelper.exe

C:\Users\***\AppData\Local\Temp\toolbar39931093.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-28 10:54
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Nach Abschluss aller Scans habe ich jetzt noch einmal neu gestartet - wenn ich im Firefox einen neuen Tab aufmache, steht leider immer noch dieser Eintrag in der Eingabezeile.
Was sagen dir denn die Logs?

Vielen herzlichen Dank!

Wir haben schon mal jede Menge Adware gekillt.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

FF NewTab: chrome://quick_start/content/index.html

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo,

vielen Dank!!

Ich poste im folgenden die Logs. Den ersten Schritt, den du mir beschrieben hast (das mit Fix), habe ich nicht gemacht, ich habe nämlich heute den PC eingeschaltet und im Firefox war wieder alles normal - keine komische Anzeige mehr, wenn ich einen neuen Tab öffne. Was meinst du, soll ich es so lassen?

Hier der Eset Scan, es gab 32 Funde:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7587

# api_version=3.0.2

# EOSSerial=a6bcec977effcd4a913ae78ed3c960e7

# engine=19046

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-07-06 05:09:46

# local_time=2014-07-06 07:09:46 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='avast! Antivirus'

# compatibility_mode=783 16777213 100 97 103770 169087076 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 0 156296436 0 0

# scanned=238428

# found=32

# cleaned=0

# scan_time=12504

sh=81FBC911F6F39943B5A508257ED317C6A388CA54 ft=1 fh=f881a71255879118 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"

sh=6F4FD559E82ECD0E9BF238374A8AE7763D9AF88F ft=1 fh=0fe3e64a55eab364 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"

sh=09975ED04166B761DC1CED0B15BAE6D37DCC0560 ft=1 fh=919d2464905062de vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"

sh=CC7735B51ACFC778DAFCE7B9C25798C1149059CA ft=1 fh=bdcf262ba56c13e6 vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"

sh=E07AC00C609A9096EFEDCF5839D77AD91C96BD2D ft=1 fh=a44174895411af10 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"

sh=3AE79DE1D9A3C56075DB1B53DF9D7880AE03A5F6 ft=1 fh=bd390a3911fc5a39 vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"

sh=0F00EB8310C851AAD8AE9C7C17EF5F0D81617D3A ft=1 fh=1090c94a8e08b65e vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"

sh=C7C0F42A23562AA6DCCD60326FD8CC2AA41B5448 ft=1 fh=c053642cee9f3def vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"

sh=125B1C393F2104CBA08183E495C0907BFF7EDA22 ft=1 fh=ea25908c8365106f vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"

sh=8E85792765D0E0BF52107CFF4A6620995DB19BB0 ft=1 fh=627da500ea2e265f vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir"

sh=6043D1ACD51FD373472020FBB748C405AAF22397 ft=1 fh=4c716dbbae6c21b9 vn="Win32/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"

sh=FF431CD8693F4045BD7BD87DBCE54B820F000FC0 ft=1 fh=16c2e1bd3fd6b7e2 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"

sh=5836A5DF3860241F6B69F2292ABCE592A13689B6 ft=1 fh=a3db04555f559ea8 vn="Variante von Win32/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv32.dll.vir"

sh=9DC13DB9C123270C2356ED410128E11D5ADF7C6E ft=1 fh=023ab782f0a9b07d vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"

sh=4C1EF5C7384EDAAD07C51075D05637EEDB01A1E6 ft=1 fh=863a021b2c41c49f vn="Variante von Win32/ExpressDownloader.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\YourFileDownloader Updater\uninstall.exe.vir"

sh=E08768927A8308883FC868F4845012E17922812E ft=1 fh=b69fe3e5f4e8b00c vn="Variante von Win32/YourFileDownloader.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\YourFileDownloader Updater\YourFileUpdater.exe.vir"

sh=56659F7FF1F1FA7906A77228E315F65F38BCEF73 ft=1 fh=0ff759dfc352fd03 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"

sh=08A0C25B0BF40535697C1C584ACCDA490D6BC882 ft=1 fh=dbe7f66a50ce49ed vn="Variante von Win32/DownloadSponsor.A evtl. uner-wünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\***\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"

sh=C4420C6E94B8CAACCB3811384280D8A93CB0A37D ft=1 fh=25f111c507a31a21 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwen-dung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\***\AppData\Roaming\OpenCandy\3743FA00659E4E77BE9FA8997222B791\sp-downloader.exe.vir"

sh=4C1EF5C7384EDAAD07C51075D05637EEDB01A1E6 ft=1 fh=863a021b2c41c49f vn="Variante von Win32/ExpressDownloader.I evtl. uner-wünschte Anwendung" ac=I fn="E:\Downloads Program-me\digui_digui_kursbuch_curs_de_catalÀ_per_a_estrangers_downloader.exe"

sh=A96F1247F7BECCCDD405FFC68495E659EF429AE1 ft=1 fh=12b07f950a12f973 vn="Variante von Win32/DownloadSponsor.A evtl. uner-wünschte Anwendung" ac=I fn="E:\Downloads Programme\Malwarebytes Anti Mal-ware.exe"

sh=095DF1429E4F8DBE71EE72AEE04090E6A8F35931 ft=1 fh=749ee4b2bcea0726 vn="Variante von Win32/DownloadSponsor.A evtl. uner-wünschte Anwendung" ac=I fn="E:\Downloads Programme\PDF24 Creator.exe"

sh=49892F2B31FDE87333BA9AD84222DA7493E6AC98 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.F evtl. uner-wünschte Anwendung" ac=I fn="E:\PC\Backup Set 2012-04-23 110626\Backup Files 2012-06-01 121107\Backup files 1.zip"

sh=C6BC5D1905E0D1708C558B868AD764E1B6FF3DFB ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="E:\PC\Backup Set 2012-04-23 110626\Backup Files 2012-09-01 131437\Backup files 3.zip"

sh=F966F62E111A5C3E7A15687419EE8D2A71B6A7C4 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="E:\PC\Backup Set 2012-10-01 113843\Backup Files 2012-10-01 113843\Backup files 5.zip"

sh=0B81499A6E75C8860868AEA41018272A33FCEB48 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="E:\PC\Backup Set 2013-06-01 102200\Backup Files 2013-06-01 102200\Backup files 1.zip"

sh=E7063D47F1D2936DF344F039F1C9FA4857C3E8C1 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="E:\PC\Backup Set 2013-09-01 122740\Backup Files 2013-09-01 122740\Backup files 1.zip"

sh=276C8018079581296B484C1E25E483F437C6D7C9 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="E:\PC\Backup Set 2013-11-01 123144\Backup Files 2013-11-01 123144\Backup files 1.zip"

sh=7CAABE77E57FF26D357C22279B91FD926BA4B0CC ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="E:\PC\Backup Set 2014-01-01 125203\Backup Files 2014-01-01 125203\Backup files 1.zip"

sh=8FBA19CF36F8D7440DB7EB21DB3A147DA0E6DEF8 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="E:\PC\Backup Set 2014-03-01 102548\Backup Files 2014-03-01 102548\Backup files 1.zip"

sh=C9FD395FFDA8587F0656929505273AF55AA25A1F ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="E:\PC\Backup Set 2014-05-01 120325\Backup Files 2014-05-01 120325\Backup files 2.zip"

sh=15F3D12234250EFFDE4C992ECDC050B70A7B40BE ft=0 fh=0000000000000000 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwen-dung" ac=I fn="E:\PC\Backup Set 2014-05-01 120325\Backup Files 2014-06-01 112653\Backup files 1.zip"

Und hier Security Check:

Code:

Results of screen317's Security Check version 0.99.83  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

avast! Antivirus   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Spybot - Search & Destroy 

 Adobe Flash Player 14.0.0.125  

 Mozilla Firefox (30.0) 

 Mozilla Thunderbird (24.6.0) 
 ````````Process Check: objlist.exe by Laurent````````  

 Spybot Teatimer.exe is disabled! 

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast AvastUI.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Bei Security Check gab es Probleme mit dem Download des von dir angegebenen Links (Filepony), meine Virensoftware (Avast) ließ es mich zuerst äußerst ungerne downloaden und machte dann endgültig Schluss, als ich es installieren wollte. Ich hatte noch eine Version vom 20. 5. auf meinem PC, mit der habe ich jetzt den Scan gemacht. Ist das ok so oder ist das veraltet?

Haben Eset und Security Check das, was gefunden wurde, jetzt eigentlich auch gelöscht/repariert (?) oder "nur" gescannt und aufgelistet (und es muss jetzt erst noch repariert werden?)?

Vielen Dank! :-)

-------
Hier füge ich noch das FRST-log hinzu, das habe ich vorher vergessen:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-07-2014

Ran by *** (administrator) on PC on 07-07-2014 01:16:14

Running from C:\Users\***\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Informatic Ltd.) C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Pan-el\VolPanlu.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Adobe Systems Inc.) E:\Programme\Acrobat 9.0\Acrobat\acrotray.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [3019376 2011-02-22] (VIA)

HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2012-04-18] (FNet Co., Ltd.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office 2010\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Soft-ware\Avast\AvastUI.exe [4086432 2014-07-05] (AVAST Software)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => E:\Programme\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] => E:\Programme\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2008-06-11] (Adobe Systems Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-4118839908-2255762619-2302489997-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2068856 2011-10-12] (Flexera Software LLC.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ORFO Agent.lnk

ShortcutTarget: ORFO Agent.lnk -> C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe (Informatic Ltd.)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache Accept-Langs = de-AT

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x02F4BAE30888CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://de.pons.com/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explor-er\iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope value is missing.

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corpora-tion)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Mi-crosoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Dragon NaturallySpeaking Rich Internet Application Support - Extension - {73A89C60-CF59-4EC7-9215-9B7EF05ECEA4} - E:\Dragon Naturally Speaking 12 Deutsch\Program\ieShim.dll (Nuance Communications, Inc.)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
 

FireFox:

========

FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815

FF NewTab: user_pref("browser.newtab.url", "");

FF Homepage: www.google.at | hxxp://de.pons.com/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silver-light\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()

FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @real.com/nprpjplug;version=12.0.1.669 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: nuance.com/DragonRIAPlugin - E:\DRAGON~4\Program\npDgnRia.dll (Nuance Communications Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\yahoo-de.xml

FF Extension: Classic Theme Restorer - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-27]

FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-27]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: No Name - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-06-24]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Soft-ware\Avast\WebRep\FF [2012-04-19]

FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi

FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi [2013-02-11]

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-05-29]
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-05]

CHR HKLM-x32\...\Chrome\Extension: [mikhcaiakabeeokmenglcdebplfdjicn] - E:\Dragon Naturally Speaking 12 Deutsch\Program\chromeShim.crx [2013-02-11]
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-05] (AVAST Software)

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-04-18] (Crea-tive Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2014-06-29] (Macro-vision Europe Ltd.) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S4 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-02-17] (VIA Technologies, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-05] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-05] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-05] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-05] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-05] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-05] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-05] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-05] ()

S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2012-04-18] (FNet Co., Ltd.)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-04-18] (FNet Co., Ltd.)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-05] (Malwarebytes Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-07-07 01:16 - 2014-07-07 01:16 - 00019434 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-05 14:53 - 2014-07-05 14:53 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion

2014-07-05 14:34 - 2014-07-05 14:34 - 01016261 _____ (Thisisu) C:\Users\***\Desktop\JRT.exe

2014-07-05 14:18 - 2014-07-05 14:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-07-05 14:08 - 2014-07-05 14:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-05 14:08 - 2014-07-05 14:08 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-05 14:08 - 2014-07-05 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-05 14:08 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-05 14:08 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-05 14:08 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-05 00:59 - 2014-07-05 14:53 - 02084352 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 00:47 - 2014-07-05 14:26 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-04 21:41 - 2014-07-04 21:46 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00001119 _____ () C:\Users\***\Desktop\Free Torrent Viewer.lnk

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-06-29 22:08 - 2008-04-07 05:38 - 00024416 ____R (Adobe Systems Inc.) C:\Windows\system32\AdobePDFUI.dll

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-13 16:54 - 2014-06-29 22:12 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 00:36 - 2014-06-13 00:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:07 - 2014-07-07 00:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-12 21:07 - 2014-06-12 21:08 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:07 - 2014-06-12 21:08 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:07 - 2014-06-12 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-11 07:26 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-11 07:26 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-11 07:26 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-11 07:26 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-11 07:26 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-11 07:26 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-11 07:26 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-11 07:26 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-11 07:26 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-11 07:26 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-11 07:26 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-11 07:26 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-11 07:26 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-11 07:26 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-11 07:26 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-11 07:26 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-11 07:26 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-11 07:26 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-11 07:26 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-11 07:26 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-11 07:25 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-11 07:25 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-10 23:44 - 2014-06-11 07:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
 

==================== One Month Modified Files and Folders =======
 

2014-07-07 01:16 - 2014-07-07 01:16 - 00019434 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-07 01:16 - 2014-05-11 18:53 - 00000000 ____D () C:\FRST

2014-07-07 00:37 - 2014-06-12 21:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-07 00:17 - 2013-03-04 22:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-06 22:40 - 2012-09-08 14:45 - 00000000 ____D () C:\Users\***\AppData\Roaming\Skype

2014-07-06 21:17 - 2013-03-04 22:40 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-06 12:09 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-06 12:09 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-06 12:07 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat

2014-07-06 12:07 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat

2014-07-06 12:07 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-06 12:06 - 2012-04-18 22:45 - 01936244 _____ () C:\Windows\WindowsUpdate.log

2014-07-06 12:02 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-06 12:02 - 2009-07-14 06:51 - 00172173 _____ () C:\Windows\setupact.log

2014-07-05 23:44 - 2012-05-12 21:03 - 00000000 ____D () C:\Users\***\AppData\Local\CrashDumps

2014-07-05 14:56 - 2012-07-17 22:28 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-07-05 14:53 - 2014-07-05 14:53 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion

2014-07-05 14:53 - 2014-07-05 00:59 - 02084352 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 14:34 - 2014-07-05 14:34 - 01016261 _____ (Thisisu) C:\Users\***\Desktop\JRT.exe

2014-07-05 14:33 - 2014-05-13 11:37 - 00000000 ____D () C:\AdwCleaner

2014-07-05 14:30 - 2010-11-21 05:47 - 00918900 _____ () C:\Windows\PFRO.log

2014-07-05 14:26 - 2014-07-05 00:47 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-05 14:23 - 2014-07-05 14:08 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-05 14:18 - 2014-07-05 14:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-07-05 14:18 - 2014-04-26 17:51 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-07-05 14:18 - 2014-03-22 22:35 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-07-05 14:18 - 2013-03-21 15:18 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-07-05 14:18 - 2013-03-21 15:18 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-07-05 14:18 - 2012-04-19 14:20 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-07-05 14:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\TAPI

2014-07-05 14:08 - 2014-07-05 14:08 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-05 14:08 - 2014-07-05 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-05 14:08 - 2014-05-13 11:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-05 00:49 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-07-05 00:33 - 2014-05-17 15:06 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-07-05 00:33 - 2012-04-18 16:36 - 00001425 _____ () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-07-04 21:46 - 2014-07-04 21:41 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:46 - 2012-04-18 16:36 - 00000000 ____D () C:\Users\***

2014-07-04 21:41 - 2012-04-18 23:36 - 00103928 _____ () C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-04 21:40 - 2014-07-04 21:40 - 00001119 _____ () C:\Users\***\Desktop\Free Torrent Viewer.lnk

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-06-30 22:56 - 2012-06-24 16:12 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc

2014-06-30 10:19 - 2009-07-14 06:45 - 00404344 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-06-29 22:12 - 2014-06-13 16:54 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-29 22:12 - 2013-05-31 23:53 - 00000000 ____D () C:\ProgramData\FLEXnet

2014-06-29 22:12 - 2012-04-18 18:26 - 00000000 ____D () C:\Users\***\AppData\Roaming\Adobe

2014-06-29 22:08 - 2012-04-18 18:26 - 00000000 ____D () C:\ProgramData\Adobe

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-28 14:09 - 2013-08-08 15:26 - 00000000 ____D () C:\ProgramData\Package Cache

2014-06-27 19:44 - 2012-04-22 14:10 - 00000000 ____D () C:\Users\***\Desktop\***

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-27 14:35 - 2012-04-18 23:36 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-21 21:12 - 2013-03-04 22:40 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-21 21:12 - 2013-03-04 22:40 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-14 21:56 - 2013-12-11 02:17 - 00014820 _____ () C:\Windows\IE11_main.log

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 09:53 - 2012-05-03 11:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-13 00:37 - 2014-06-13 00:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:08 - 2014-06-12 21:07 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:08 - 2014-06-12 21:07 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:08 - 2014-06-12 21:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-12 14:13 - 2013-06-13 16:03 - 00000000 ____D () C:\Windows\rescache

2014-06-11 10:08 - 2013-07-25 11:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-11 10:07 - 2012-05-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-11 10:07 - 2012-04-19 13:54 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-11 10:06 - 2014-04-30 10:52 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-11 07:36 - 2014-06-10 23:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-06-08 11:13 - 2014-06-11 07:25 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 11:08 - 2014-06-11 07:25 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
 

Files to move or delete:

====================

C:\ProgramData\ezsid.dat
 
 

Some content of TEMP:

====================

C:\Users\***\AppData\Local\Temp\htmlayout.dll

C:\Users\***\AppData\Local\Temp\ochelper.exe

C:\Users\***\AppData\Local\Temp\toolbar39931093.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-28 10:54
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Mach den Fix bitte, dann ein frisches FRST log. Backup auf E löschen, restliche Funde von ESET sind schon in Quarantäne.

Hallo,

vielen Dank! Hier das Ergebnis vom Fixlog:

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-07-2014

Ran by *** at 2014-07-07 19:38:39 Run:1

Running from C:\Users\***\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

FF NewTab: chrome://quick_start/content/index.html

*****************
 

Firefox newtab deleted successfully.
 

==== End of Fixlog ====

Welches Backup auf E meinst du denn?

Hier kommt noch das aktuelle Log von FRST:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-07-2014

Ran by *** (administrator) on PC on 07-07-2014 19:42:09

Running from C:\Users\***\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe

(Informatic Ltd.) C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe

(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

(FNet Co., Ltd.) C:\Program Files (x86)\XFastUsb\XFastUsb.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Pan-el\VolPanlu.exe

(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Adobe Systems Inc.) E:\Programme\Acrobat 9.0\Acrobat\acrotray.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Compo-nents\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [3019376 2011-02-22] (VIA)

HKLM-x32\...\Run: [XFastUsb] => C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2012-04-18] (FNet Co., Ltd.)

HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office 2010\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Soft-ware\Avast\AvastUI.exe [4086432 2014-07-05] (AVAST Software)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => E:\Programme\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-12] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Acrobat Assistant 8.0] => E:\Programme\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2008-06-11] (Adobe Systems Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-4118839908-2255762619-2302489997-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2068856 2011-10-12] (Flexera Software LLC.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ORFO Agent.lnk

ShortcutTarget: ORFO Agent.lnk -> C:\Program Files (x86)\Informatic\ORFO 9.0\orfagent.exe (Informatic Ltd.)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Of-fice\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache Accept-Langs = de-AT

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://at.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x02F4BAE30888CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://de.pons.com/

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explor-er\iexplore.exe

SearchScopes: HKLM-x32 - DefaultScope value is missing.

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corpora-tion)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Mi-crosoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Dragon NaturallySpeaking Rich Internet Application Support - Extension - {73A89C60-CF59-4EC7-9215-9B7EF05ECEA4} - E:\Dragon Naturally Speaking 12 Deutsch\Program\ieShim.dll (Nuance Communications, Inc.)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Cor-poration)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
 

FireFox:

========

FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815

FF Homepage: www.google.at | hxxp://de.pons.com/

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silver-light\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()

FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @real.com/nprpjplug;version=12.0.1.669 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: nuance.com/DragonRIAPlugin - E:\DRAGON~4\Program\npDgnRia.dll (Nuance Communications Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla fire-fox\browser\searchplugins\yahoo-de.xml

FF Extension: Classic Theme Restorer - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-27]

FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ztgcxzx1.default-1401185900815\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-27]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: No Name - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-06-24]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Soft-ware\Avast\WebRep\FF [2012-04-19]

FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi

FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - E:\Dragon Naturally Speaking 12 Deutsch\Program\ffShim.xpi [2013-02-11]

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-05-29]
 

Chrome: 

=======

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-05]

CHR HKLM-x32\...\Chrome\Extension: [mikhcaiakabeeokmenglcdebplfdjicn] - E:\Dragon Naturally Speaking 12 Deutsch\Program\chromeShim.crx [2013-02-11]
 

==================== Services (Whitelisted) =================
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-05] (AVAST Software)

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-04-18] (Crea-tive Labs) [File not signed]

R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2014-06-29] (Macro-vision Europe Ltd.) [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S3 Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office 2010\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)

R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & De-stroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2012-04-18] (Creative Labs) [File not signed]

S4 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-02-17] (VIA Technologies, Inc.)
 

==================== Drivers (Whitelisted) ====================
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-05] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-05] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-05] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-05] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-05] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-05] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-05] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-05] ()

S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [31808 2012-04-18] (FNet Co., Ltd.)

R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-04-18] (FNet Co., Ltd.)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-05] (Malwarebytes Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-07-07 19:42 - 2014-07-07 19:42 - 00019385 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-05 14:53 - 2014-07-05 14:53 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion

2014-07-05 14:34 - 2014-07-05 14:34 - 01016261 _____ (Thisisu) C:\Users\***\Desktop\JRT.exe

2014-07-05 14:18 - 2014-07-05 14:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-07-05 14:08 - 2014-07-05 14:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-05 14:08 - 2014-07-05 14:08 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-05 14:08 - 2014-07-05 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-05 14:08 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-05 14:08 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-05 14:08 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-05 00:59 - 2014-07-05 14:53 - 02084352 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 00:47 - 2014-07-05 14:26 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-04 21:41 - 2014-07-04 21:46 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-06-29 22:08 - 2008-04-07 05:38 - 00024416 ____R (Adobe Systems Inc.) C:\Windows\system32\AdobePDFUI.dll

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-13 16:54 - 2014-06-29 22:12 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 00:36 - 2014-06-13 00:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:07 - 2014-07-07 19:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-06-12 21:07 - 2014-06-12 21:08 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:07 - 2014-06-12 21:08 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:07 - 2014-06-12 21:08 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-11 07:26 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-06-11 07:26 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-06-11 07:26 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-06-11 07:26 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-06-11 07:26 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-06-11 07:26 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-06-11 07:26 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-06-11 07:26 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-06-11 07:26 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-06-11 07:26 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-06-11 07:26 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-06-11 07:26 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-06-11 07:26 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-06-11 07:26 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-06-11 07:26 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-06-11 07:26 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-06-11 07:26 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-06-11 07:26 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-06-11 07:26 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-06-11 07:26 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-06-11 07:26 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-06-11 07:26 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-06-11 07:26 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-11 07:26 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-06-11 07:26 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-06-11 07:26 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-06-11 07:26 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-06-11 07:26 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-06-11 07:26 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-06-11 07:26 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-06-11 07:26 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-06-11 07:26 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-06-11 07:26 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-06-11 07:26 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll

2014-06-11 07:26 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2014-06-11 07:26 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-06-11 07:26 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-06-11 07:26 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2014-06-11 07:26 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll

2014-06-11 07:26 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-06-11 07:25 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-11 07:25 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-06-10 23:44 - 2014-06-11 07:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
 

==================== One Month Modified Files and Folders =======
 

2014-07-07 19:42 - 2014-07-07 19:42 - 00019385 _____ () C:\Users\***\Desktop\FRST.txt

2014-07-07 19:42 - 2014-05-11 18:53 - 00000000 ____D () C:\FRST

2014-07-07 19:38 - 2012-05-12 21:03 - 00000000 ____D () C:\Users\***\AppData\Local\CrashDumps

2014-07-07 19:37 - 2014-06-12 21:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-07 19:17 - 2013-03-04 22:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-07 15:06 - 2012-09-08 14:45 - 00000000 ____D () C:\Users\***\AppData\Roaming\Skype

2014-07-07 11:10 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-07 11:10 - 2009-07-14 06:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-07 11:09 - 2011-04-12 09:43 - 00699432 _____ () C:\Windows\system32\perfh007.dat

2014-07-07 11:09 - 2011-04-12 09:43 - 00149572 _____ () C:\Windows\system32\perfc007.dat

2014-07-07 11:09 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-07 11:03 - 2013-03-04 22:40 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-07 11:03 - 2010-11-21 05:47 - 00919718 _____ () C:\Windows\PFRO.log

2014-07-07 11:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-07 11:03 - 2009-07-14 06:51 - 00172229 _____ () C:\Windows\setupact.log

2014-07-07 01:48 - 2012-04-18 22:45 - 01955740 _____ () C:\Windows\WindowsUpdate.log

2014-07-05 14:56 - 2012-07-17 22:28 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-07-05 14:53 - 2014-07-05 14:53 - 00000000 ____D () C:\Users\***\Desktop\FRST-OlderVersion

2014-07-05 14:53 - 2014-07-05 00:59 - 02084352 _____ (Farbar) C:\Users\***\Desktop\FRST64.exe

2014-07-05 14:34 - 2014-07-05 14:34 - 01016261 _____ (Thisisu) C:\Users\***\Desktop\JRT.exe

2014-07-05 14:33 - 2014-05-13 11:37 - 00000000 ____D () C:\AdwCleaner

2014-07-05 14:26 - 2014-07-05 00:47 - 01346519 _____ () C:\Users\***\Desktop\adwcleaner_3.214.exe

2014-07-05 14:23 - 2014-07-05 14:08 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-05 14:18 - 2014-07-05 14:18 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-07-05 14:18 - 2014-04-26 17:51 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-07-05 14:18 - 2014-03-22 22:35 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-07-05 14:18 - 2013-03-21 15:18 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-07-05 14:18 - 2013-03-21 15:18 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-07-05 14:18 - 2012-04-19 14:20 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-07-05 14:18 - 2012-04-19 14:20 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-07-05 14:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\TAPI

2014-07-05 14:08 - 2014-07-05 14:08 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-05 14:08 - 2014-07-05 14:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-05 14:08 - 2014-05-13 11:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-05 00:49 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-07-05 00:33 - 2014-05-17 15:06 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-07-05 00:33 - 2012-04-18 16:36 - 00001425 _____ () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-07-04 21:46 - 2014-07-04 21:41 - 00000000 ____D () C:\Users\***\AppData\Roaming\FreeTorrentViewer

2014-07-04 21:46 - 2012-04-18 16:36 - 00000000 ____D () C:\Users\***

2014-07-04 21:41 - 2012-04-18 23:36 - 00103928 _____ () C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTorrentViewer

2014-07-04 21:40 - 2014-07-04 21:40 - 00000000 ____D () C:\Program Files (x86)\FreeTorrentViewer

2014-06-30 22:56 - 2012-06-24 16:12 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc

2014-06-30 10:19 - 2009-07-14 06:45 - 00404344 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-06-29 22:12 - 2014-06-13 16:54 - 00000000 ____D () C:\Users\***\AppData\Local\Adobe

2014-06-29 22:12 - 2013-05-31 23:53 - 00000000 ____D () C:\ProgramData\FLEXnet

2014-06-29 22:12 - 2012-04-18 18:26 - 00000000 ____D () C:\Users\***\AppData\Roaming\Adobe

2014-06-29 22:08 - 2012-04-18 18:26 - 00000000 ____D () C:\ProgramData\Adobe

2014-06-29 22:07 - 2014-06-29 22:07 - 00002465 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Distiller 9.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00002453 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat 9 Pro.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001778 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle Designer ES 8.2.lnk

2014-06-29 22:07 - 2014-06-29 22:07 - 00001660 _____ () C:\Users\Public\Desktop\Adobe Acrobat 9 Pro.lnk

2014-06-28 14:09 - 2014-06-28 14:09 - 04741136 _____ () C:\Users\***\Downloads\adblockplusie-1.1.exe

2014-06-28 14:09 - 2014-06-28 14:09 - 00000000 ____D () C:\Program Files\Adblock Plus for IE

2014-06-28 14:09 - 2013-08-08 15:26 - 00000000 ____D () C:\ProgramData\Package Cache

2014-06-27 19:44 - 2012-04-22 14:10 - 00000000 ____D () C:\Users\***\Desktop\***

2014-06-27 19:42 - 2014-06-27 19:42 - 00000688 _____ () C:\Users\***\Desktop\Utilities.lnk

2014-06-27 14:35 - 2012-04-18 23:36 - 00000000 ____D () C:\Windows\System32\Tasks\Games

2014-06-25 19:39 - 2014-06-25 19:39 - 00003832 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1403717996

2014-06-25 19:39 - 2014-06-25 19:39 - 00001133 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Roaming\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Users\***\AppData\Local\Opera Software

2014-06-25 19:39 - 2014-06-25 19:39 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-06-21 21:12 - 2013-03-04 22:40 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-21 21:12 - 2013-03-04 22:40 - 00003856 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-14 21:56 - 2013-12-11 02:17 - 00014820 _____ () C:\Windows\IE11_main.log

2014-06-13 15:45 - 2014-06-13 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\***\Desktop\OTL.exe

2014-06-13 09:53 - 2012-05-03 11:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-06-13 00:37 - 2014-06-13 00:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-06-12 21:08 - 2014-06-12 21:07 - 00699056 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-12 21:08 - 2014-06-12 21:07 - 00071344 _____ (Adobe Systems Incorpo-rated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-12 21:08 - 2014-06-12 21:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-12 14:13 - 2013-06-13 16:03 - 00000000 ____D () C:\Windows\rescache

2014-06-11 10:08 - 2013-07-25 11:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-06-11 10:07 - 2012-05-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-06-11 10:07 - 2012-04-19 13:54 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-06-11 10:06 - 2014-04-30 10:52 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-06-11 07:36 - 2014-06-10 23:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-06-08 11:13 - 2014-06-11 07:25 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-06-08 11:08 - 2014-06-11 07:25 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
 

Files to move or delete:

====================

C:\ProgramData\ezsid.dat
 
 

Some content of TEMP:

====================

C:\Users\***\AppData\Local\Temp\htmlayout.dll

C:\Users\***\AppData\Local\Temp\ochelper.exe

C:\Users\***\AppData\Local\Temp\toolbar39931093.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-28 10:54
 

==================== End Of Log ============================

--- --- ---

Dankeschön!! :-)

Zitat:

E:\PC\Backup Set 2013-06-01 102200

und alle anderen, siehst du im ESET Logfile am Schluss.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo schrauber,

vielen Dank für die ganzen Infos, ich werde mir das ansehen und mich spätestens ins 3 Tagen melden, falls ich mit einem Programm nicht zurechtkommen sollte - gebe dir aber auf jeden Fall Bescheid, damit du mich aus deinen Abos löschen kannst.

Ich habe jetzt noch eine Frage zu den Backups, die ich löschen soll: wenn ich auf E:\PC zugreifen möchte, kommt folgende Meldung:

Windows-Sicherung
Wählen Sie unten eine Option für die ausgewählte Sicherung aus.

- Eigene Dateien aus dieser Sicherung wiederherstellen
- Dateien für alle Benutzer dieses Computers wiederherstellen
- Speicherplatz verwalten, der von dieser Sicherung belegt wird

Welches soll ich denn auswählen? Ich habe es zwar schon probiert, da öffnet sich dann ein eigenes Fenster... Ich dachte, ich könnte das wie einen Ordner im Windows Explorer öffnen und dann die Dateien einfach löschen...?

Danke und viele Grüße!

Wenn auf E nur Sicherungen sind, formatier E einfach und dann leg neue Sicherungen an :)

Hallo!

Nein, auf E sind nicht nur Sicherungen, da sind meine ganzen Daten drauf, das kann ich nicht formatieren. Warum kann ich denn auf E:\PC nicht zugreifen, ist das normal? Die Meldung, die bei mir erscheint, taucht die normalerweise nicht auf?

Danke und viele Grüße :-)

Zeig mal nen Screenshot vom Windows Explorer von E und der Meldung.

Hallo,

hier kommt der Screenshot - das passiert, wenn ich auf E:\PC klicke:
http://www.directupload.net/file/d/3...wofs4f_jpg.htm

Diese Fenster erscheint, wenn ich eine der ersten beiden Optionen auswähle:
http://www.directupload.net/file/d/3...fz8dqe_jpg.htm

Und dieses Meldung hier kommt bei der dritten Option:
http://www.directupload.net/file/d/3...gadmfu_jpg.htm

Sollte diese Meldung eigentlich nicht kommen, oder?
Wird "PC" auf E:\ eigentlich bei der Vorinstallation (vor dem Kauf) automatisch angelegt? Ich habe diesen Ordner/diese Datei (?) nämlich nicht erstellt..?

Dankeschön und viele Grüße!

Windows Backup legt das glaube ich an. Mach die dritte Option, dann Datendateisicherung, der zweite Button.

Dann solltest Du Backups zum Löschen auswählen können.

Hallo,

entschuldige bitte die verspätete Antwort!

Es hat funktioniert, ich habe jetzt alle alten Sicherungen gelöscht und eine neue angelegt! :-)

Ich hätte jetzt noch ein paar Fragen, zu den Tipps, die mir gegeben hast:

- Zu der Secunia Online Software: wo muss ich denn da klicken, um den Online-Scan machen zu können? Wenn ich hier auf dieser Seite http://tools.trojaner-board.de/secunia.html auf "Secunia Online Scan" klicke, passiert nichts, nur die Seite lädt sich erneut...

- MalwareBytes Anti Malware: wenn ich hier einen Fund habe, kann ich das dann einfach immer in Quarantäne schieben, so wie wir das gemacht haben? Oder könnte ich damit irgendetwas am System ruinieren?
Wird das Problem dann behoben oder werden die Funde nur in einen Quarantäne-Ordner geschoben und lauern dort auf eine eventuelle Aktivierungsmöglichkeit?

- WinPatrol: Habe ich mir installiert - soll ich den jetzt einfach immer im Hintergrund laufen lassen oder ist das nicht nötig (ist automatisch so eingestellt)?

- SpywareBlaster habe ich mir ebenfalls installiert (den Snapshot habe ich wie in der Anleitung gemacht) - allerdings ist mir nicht ganz klar, wie ich das Programm nun am Besten verwenden soll (läuft nicht im Hintergrund). Soll ich das Programm zum Beispiel einmal in der Woche starten? Habe es heute erneut geöffnet und direkt nach dem Öffnen kam dieses Fenster:
http://www.directupload.net/file/d/3...nq4g3a_jpg.htm
Was sollen mir denn diese 18 Einträge bei Firefox nun genau sagen und wie soll ich auf solche Meldungen reagieren? Muss ich irgendetwas löschen/reparieren..?
Soll ich außerdem mit dem Programm dann irgendeinen Scan machen (so, wie du es im Screenshot sieht, kam es ja automatisch nach dem Start, ich habe da nirgends draufgeklickt)?

- WOT: wie wird das genau installiert? Wenn ich das downloade, ist das ja eine zip-Datei. Aber es handelt sich ja eigentlich um ein Add-on, oder? Wird das nicht einfach so in FF installiert (wie zB Adblock)? Wie bzw. wohin soll ich das entpacken, damit das dann auch für Firefox installiert wird?

So, ich hoffe, das sind jetzt nicht zu viele Fragen...
Vielen herzlichen Dank für deine Hilfe!
Viele Grüße