Trojaner-Board - SSL Verbindungen nicht möglich, Werbeeinblendungen etc..

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. (https://www.trojaner-board.de/160741-ssl-verbindungen-moeglich-werbeeinblendungen-etc.html)

SSL Verbindungen nicht möglich, Werbeeinblendungen etc..

Nabend,

also bei ist neuerdings das Problem, dass ich keine SSL Seiten öffnen kann, also alles mit https. Habe nun eine Logdatei von Malwarebytes und Spybot gepostet, was kann man da denn draus erkennen?

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 13.11.2014
Scan Time: 22:55:44
Logfile:
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.13.09
Rootkit Database: v2014.11.12.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Neo

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 369018
Time Elapsed: 16 min, 28 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 2
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\CrashMon.exe, 5616, , [8bc2cd6e007c2b0b42742d3eaa59f50b]
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\UpdaterService.exe, 3836, , [8bc2cd6e007c2b0b42742d3eaa59f50b]

Modules: 0
(No malicious items detected)

Registry Keys: 14
PUP.Optional.Snapdo.T, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, , [440929126c10c670fcc133bf45bd728e],
PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\CLASSES\HD Streamer.ScriptHostObject, , [fb52cc6f96e6a690dca6437225ddb050],
PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\CLASSES\HD Streamer.ScriptHostObject.1, , [f65786b5522a60d6d6aca80d0ff3728e],
PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\HD Streamer.ScriptHostObject, , [f65786b5522a60d6d6aca80d0ff3728e],
PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\HD Streamer.ScriptHostObject.1, , [f65786b5522a60d6d6aca80d0ff3728e],
PUP.Optional.UniversalUpdater.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\UniversalUpdater, , [8bc2cd6e007c2b0b42742d3eaa59f50b],
PUP.Optional.Salus.A, HKLM\SOFTWARE\WOW6432NODE\Salus, , [b39a73c85e1eed49d87b40ff649f649c],
PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{FB385922-2E32-4462-A7DC-27159614A660}, , [113ceb50106c1c1a65b7e86e8c77c838],
PUP.Optional.Salus.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Salus, , [2e1ffa41532952e42bceaf90a45f817f],
PUP.Optional.ReMarkit.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, , [19347bc00379f73fbaa41623fa09aa56],
PUP.Optional.ReMarkit.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, , [44092912bdbfe74f7de121182ad9669a],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [68e534071d5ffc3a30d3f8770af93ac6],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [9ab352e98fedc57174c77213e3213cc4],
PUP.Optional.SuperFish.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, , [1f2e1e1dbbc163d3d7c2480323e06d93],

Registry Values: 5
PUP.Optional.Bundle, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Salus CrashMon, "C:\Program Files (x86)\f552dd4c52e3\a7d12b5975b4.exe" "b786bdb3c67d.exe" "hxxp://log.data-url.com/salus/crash", , [8dc0d6652557da5cd2651822c63feb15]
PUP.Optional.UniversalUpdater.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|CrashMon, "C:\Program Files (x86)\Universal Updater\CrashMon.exe" "UniversalUpdater", , [8bc2cd6e007c2b0b42742d3eaa59f50b]
PUP.Optional.UniversalUpdater.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\UNIVERSALUPDATER|ImagePath, C:\Program Files (x86)\Universal Updater\UpdaterService.exe, , [39143308bebed75fddda82e94fb46f91]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0R2Y1I1P1N0J1U1C, , [9ab352e98fedc57174c77213e3213cc4]
PUP.Optional.QuickStart.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, , [2e1f52e9c0bc78bef1b426272fd4b64a]

Registry Data: 8
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[81ccf348a2da0c2a9b61b195d2337987]
PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,),,[014c1d1e126a53e3ca7ba3988d787b85]
PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[0b426ad10577af87340f2b1016ef07f9]
PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[b697f84378045cda75cf44f753b26c94]
PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[e6676bd00e6e1422192d95a6f1148c74]
PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[9cb128134a32ad8948ffe8538184fc04]
PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[8fbe77c40676270fdb67f546b550ab55]
PUP.Optional.Spigot.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, https://de.search.yahoo.com/?type=501549&fr=spigot-yhp-ie, Good: (www.google.com), Bad: (https://de.search.yahoo.com/?type=501549&fr=spigot-yhp-ie),,[0647f14a611b8fa71b0c3ffd8f76ff01]

Folders: 5
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater, , [8bc2cd6e007c2b0b42742d3eaa59f50b],
PUP.Optional.HDStreamer.A, C:\Users\Neo\AppData\Local\HD Streamer, , [e36ac6750e6e70c681f70c1133d0867a],
PUP.Optional.HDStreamer, C:\Program Files (x86)\HD Streamer, , [b09df348621ac1758b4b66b837cc9d63],
PUP.Optional.PriceFountain.A, C:\Users\Neo\AppData\Local\PriceFountain, , [2825211a295357df56295eca2bd8768a],
PUP.Optional.PriceFountain.A, C:\Users\Neo\AppData\Local\PriceFountain\logs, , [2825211a295357df56295eca2bd8768a],

Files: 14
PUP.Optional.Bundle, C:\Program Files (x86)\f552dd4c52e3\a7d12b5975b4.exe, , [8dc0d6652557da5cd2651822c63feb15],
PUP.Optional.Salus.A, C:\Program Files (x86)\f552dd4c52e3\uninstall.exe, , [d07d8eadfe7ee551f0fb02b6fd045ea2],
PUP.Optional.Salus.A, C:\Windows\Temp\5762.tmp, , [dd7044f76c101026ea36a724e61b2dd3],
PUP.Optional.Salus.A, C:\Windows\Temp\8DCB.tmp, , [68e51526d5a7ed49be62705bf40d32ce],
PUP.Optional.Softonic.A, C:\Users\Neo\Downloads\SoftonicDownloader_fuer_usenext-by-tangysoft.exe, , [0f3e9aa118643501b77880b90ef37d83],
PUP.Optional.SnapDo.A, C:\Windows\Installer\3f13e2a.msi, , [103dee4d8af20f278e8d2d709c65f30d],
PUP.Optional.SmartBar, C:\Windows\Installer\3f13e2f.msi, , [f657df5cfb8171c5e76c114c20e0b24e],
PUP.Optional.SmartBar, C:\Windows\Installer\MSICE74.tmp, , [b19cd96218642c0ad47ce34b0ff16f91],
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\settings.json, , [8bc2cd6e007c2b0b42742d3eaa59f50b],
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\CrashMon.exe, , [8bc2cd6e007c2b0b42742d3eaa59f50b],
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\CrashMon.log, , [8bc2cd6e007c2b0b42742d3eaa59f50b],
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\UpdaterService.exe, , [8bc2cd6e007c2b0b42742d3eaa59f50b],
PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\UpdaterService.log, , [8bc2cd6e007c2b0b42742d3eaa59f50b],
PUP.Optional.PriceFountain.A, C:\Users\Neo\AppData\Local\PriceFountain\logs\installation.log, , [2825211a295357df56295eca2bd8768a],

Physical Sectors: 0
(No malicious items detected)

(end)

--------------------------------------------------------------------------------------
Search results from Spybot - Search & Destroy

13.11.2014 21:55:40
Scan took 00:54:27.
17 items found.

Salus: [SBI $02CA90FA] Uninstall settings (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Salus

Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Internet Explorer\TypedURLs

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Explorer: [SBI $85C2C910] Last Copy/MoveTo folder (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CopyMoveTo\LastFolder

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cookie: [SBI $49804B54] Browser: Cookie (71) (Browser: Cookie, nothing done)

Cache: [SBI $49804B54] Browser: Cache (4348) (Browser: Cache, nothing done)

Verlauf: [SBI $49804B54] Browser: History (595) (Browser: History, nothing done)

--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---

2013-09-20 blindman.exe (2.2.18.151)
2013-09-20 explorer.exe (2.2.18.177)
2013-09-20 SDBootCD.exe (2.2.18.109)
2013-09-20 SDCleaner.exe (2.2.18.110)
2013-09-20 SDDelFile.exe (2.2.18.94)
2013-06-18 SDDisableProxy.exe
2013-09-20 SDFiles.exe (2.2.18.135)
2013-09-20 SDFileScanHelper.exe (2.2.16.1)
2013-10-15 SDFSSvc.exe (2.2.25.211)
2013-10-10 SDHookHelper.exe (2.3.30.2)
2013-10-10 SDHookInst32.exe (2.3.30.2)
2013-10-10 SDHookInst64.exe (2.3.30.2)
2013-09-20 SDImmunize.exe (2.2.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-10-14 SDOnAccess.exe (2.2.25.4)
2013-09-20 SDPESetup.exe (2.2.18.3)
2013-09-20 SDPEStart.exe (2.2.18.86)
2013-09-20 SDPhoneScan.exe (2.2.18.28)
2013-09-20 SDPRE.exe (2.2.18.22)
2013-09-20 SDPrepPos.exe (2.2.18.10)
2013-09-20 SDQuarantine.exe (2.2.18.103)
2013-09-20 SDRootAlyzer.exe (2.2.18.116)
2013-09-20 SDSBIEdit.exe (2.2.18.39)
2013-09-20 SDScan.exe (2.2.18.177)
2013-09-20 SDScript.exe (2.2.18.53)
2013-10-15 SDSettings.exe (2.2.25.138)
2013-09-20 SDShell.exe (2.2.18.2)
2013-09-20 SDShred.exe (2.2.18.107)
2013-09-20 SDSysRepair.exe (2.2.18.101)
2013-09-20 SDTools.exe (2.2.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-09-20 SDUpdate.exe (2.2.18.91)
2013-09-20 SDUpdSvc.exe (2.2.18.76)
2013-09-20 SDWelcome.exe (2.2.21.129)
2013-09-13 SDWSCSvc.exe (2.2.22.2)
2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0)
2014-07-31 spybotsd2-translation-esx.exe
2013-06-19 spybotsd2-translation-frx.exe
2014-08-25 spybotsd2-translation-hux2.exe
2014-10-01 spybotsd2-translation-nlx2.exe
2014-11-05 spybotsd2-translation-ukx.exe
2014-03-18 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-10-14 SDFileScanLibrary.dll (2.2.25.14)
2013-10-10 SDHook32.dll (2.3.30.2)
2013-10-10 SDHook64.dll (2.3.30.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2014-03-05 Includes\Adware-000.sbi (*)
2014-01-08 Includes\Adware-001.sbi (*)
2014-11-11 Includes\Adware-C.sbi (*)
2014-01-13 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-01-08 Includes\Dialer-000.sbi (*)
2014-01-08 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-13 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2014-01-09 Includes\Fraud-000.sbi (*)
2014-01-09 Includes\Fraud-001.sbi (*)
2014-03-31 Includes\Fraud-002.sbi (*)
2014-01-09 Includes\Fraud-003.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2014-01-08 Includes\Hijackers-000.sbi (*)
2014-01-08 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-13 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-01-08 Includes\Keyloggers-000.sbi (*)
2014-09-24 Includes\Keyloggers-C.sbi (*)
2014-01-13 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2014-10-07 Includes\Malware-000.sbi (*)
2014-01-09 Includes\Malware-001.sbi (*)
2014-01-09 Includes\Malware-002.sbi (*)
2014-02-05 Includes\Malware-003.sbi (*)
2014-01-28 Includes\Malware-004.sbi (*)
2014-04-15 Includes\Malware-005.sbi (*)
2014-02-26 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2014-11-05 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2013-12-23 Includes\MalwareC.sbi (*)
2014-01-15 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2014-11-12 Includes\PUPS-C.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2014-01-07 Includes\PUPSC.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-21 Includes\Security.sbi (*)
2014-01-21 Includes\SecurityC.sbi (*)
2014-01-08 Includes\Spyware-000.sbi (*)
2014-01-08 Includes\Spyware-001.sbi (*)
2014-10-29 Includes\Spyware-C.sbi (*)
2014-01-21 Includes\Spyware.sbi (*)
2014-01-21 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2014-01-15 Includes\Trojans-000.sbi (*)
2014-01-15 Includes\Trojans-001.sbi (*)
2014-01-15 Includes\Trojans-002.sbi (*)
2014-01-15 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2014-03-19 Includes\Trojans-005.sbi (*)
2014-07-09 Includes\Trojans-006.sbi (*)
2014-01-15 Includes\Trojans-007.sbi (*)
2014-07-09 Includes\Trojans-008.sbi (*)
2014-07-09 Includes\Trojans-009.sbi (*)
2014-11-11 Includes\Trojans-C.sbi (*)
2014-01-15 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-15 Includes\Trojans-ZB-000.sbi (*)
2014-01-15 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2014-01-16 Includes\TrojansC-01.sbi (*)
2014-01-16 Includes\TrojansC-02.sbi (*)
2014-01-16 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-16 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)

--------------------------------------------------------------------------------------

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

so fertig.
Mir fällt grad auf dass die ganze Zeit ein Scrypt bei mir läuft, das ich ständig stoppen muss.

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-11-2014 02

Ran by Neo at 2014-11-13 23:42:34

Running from C:\Users\Neo\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)

Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)

AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5315 - AVG Technologies)

AVG 2015 (Version: 15.0.4213 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.5315 - AVG Technologies) Hidden

AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.1.9.799 - AVG Technologies)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)

Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)

CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)

CyberLink PowerDirector 11 (Version: 11.0.0.3215 - CyberLink Corp.) Hidden

CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)

CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)

Epson Easy Photo Print 2 (HKLM-x32\...\{94FA9FA6-5294-494D-A8F1-1E654CBB5736}) (Version: 2.2.3.1 - SEIKO EPSON CORPORATION)

Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)

EPSON-Drucker-Software (HKLM-x32\...\EPSON Printer and Utilities) (Version:  - )

Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

HandBrake 0.9.9.1 (HKLM-x32\...\HandBrake) (Version: 0.9.9.1 - )

HebRech HebRechw (HKLM-x32\...\{C63B768B-8B87-46F0-B56E-F863FD9E0870}) (Version: 0 - )

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3349 - Intel Corporation)

Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)

iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)

kwiksupport.me (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\kwiksupport.me) (Version: 12.0.36.1315 - pcvisit Software AG)

Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4667.1002 - Microsoft Corporation)

Microsoft SkyDrive (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)

PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0094 - Pegatron Corporation)

Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)

QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.093013 - REALTEK Semiconductor Corp.)

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7045 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0227 - REALTEK Semiconductor Corp.)

Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)

Snap.Do (HKLM-x32\...\{FB385922-2E32-4462-A7DC-27159614A660}) (Version: 10.213.1.15234 - ReSoft Ltd.) <==== ATTENTION

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)

TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Unity Web Player (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\UnityWebPlayer) (Version: 4.5.3f3 - Unity Technologies ApS)

UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)

ValueApps (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\ValueApps) (Version: 1.4.0.3 - Conduit) <==== ATTENTION

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

Windows Phone app for desktop (HKLM-x32\...\{9C4D79B6-238E-49D8-AEBC-26384EBDE6B3}) (Version: 1.0.1720.1 - Microsoft Corporation)

YTD Video Downloader 4.8.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.1 - GreenTree Applications SRL) <==== ATTENTION
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\FileSyncApi64.dll (Microsoft Corporation)
 

==================== Restore Points  =========================
 

29-10-2014 07:34:17 Installiert HebRech

01-11-2014 17:32:32 Windows Update

09-11-2014 12:16:09 Geplanter Prüfpunkt
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 14:25 - 2014-11-13 22:06 - 00450713 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com

127.0.0.1        www.0scan.com

127.0.0.1        0scan.com

127.0.0.1        1000gratisproben.com

127.0.0.1        www.1000gratisproben.com

127.0.0.1        1001namen.com

127.0.0.1        www.1001namen.com

127.0.0.1        100888290cs.com

127.0.0.1        www.100888290cs.com

127.0.0.1        www.100sexlinks.com

127.0.0.1        100sexlinks.com

127.0.0.1        10sek.com

127.0.0.1        www.10sek.com

127.0.0.1        www.1-2005-search.com

127.0.0.1        1-2005-search.com

127.0.0.1        123fporn.info

127.0.0.1        www.123fporn.info

127.0.0.1        123haustiereundmehr.com

127.0.0.1        www.123haustiereundmehr.com

127.0.0.1        123moviedownload.com
 

There are 1000 more lines.
 
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {01072E6C-C09D-4986-9538-5AB4A7BC5EE0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {2E4E5FB0-8196-4357-99FC-83CA1E6C56CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {3A5C66F6-D705-4625-B73A-76C548EAC52C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {3E3F5009-1629-4E68-873A-9B257B89535F} - \AmiUpdXp No Task File <==== ATTENTION

Task: {5361FB93-DA83-4C45-BC63-C968DC5054D4} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-10-22] (Microsoft Corporation)

Task: {63507F5D-2B25-4F2C-B91C-37AF27306AC8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-10-07] (Microsoft Corporation)

Task: {770BA74E-28E4-4E65-90B5-625D6C5C4010} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-11-01] (Microsoft Corporation)

Task: {8E16DB4C-8B87-4373-BD41-69A7C7308962} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rmv => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()

Task: {97DB4190-102B-4B17-BBA8-F2A377B3D6F7} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-14] (Synaptics Incorporated)

Task: {9AEA6DB9-8F05-4D7B-B764-225E14DAE2EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-12] (Adobe Systems Incorporated)

Task: {C8CAF07B-7DAC-47DF-AF3E-BFDA1E22560C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {DD1CB7F8-F551-4981-8AD1-DAD7C2C1DE18} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rel => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-03 07:30 - 2013-12-03 00:21 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe

2014-08-26 09:38 - 2014-08-26 09:38 - 00034304 _____ () C:\Windows\System32\ssd3clm.dll

2014-08-29 23:36 - 2014-08-29 23:36 - 02782744 _____ () C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

2013-11-18 17:35 - 2013-09-26 21:08 - 00061440 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe

2014-03-19 02:11 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2013-11-12 16:53 - 2013-03-06 15:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe

2014-06-18 14:51 - 2014-06-18 14:51 - 00606136 _____ () C:\Program Files (x86)\Universal Updater\UpdaterService.exe

2014-08-12 16:18 - 2014-08-12 16:18 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe

2013-12-03 07:30 - 2013-10-14 20:11 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe

2013-12-03 07:30 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe

2013-12-03 07:30 - 2013-10-14 18:09 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe

2014-07-24 19:26 - 2014-08-25 19:25 - 02640408 _____ () C:\Program Files (x86)\AVG Secure Search\vprot.exe

2014-11-05 17:20 - 2014-11-05 17:20 - 00997952 _____ () C:\Program Files (x86)\f552dd4c52e3\b786bdb3c67d.exe

2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-03-18 19:54 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-03-18 19:54 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-03-18 19:54 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-03-18 19:54 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-03-18 19:54 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2014-08-12 16:18 - 2014-08-12 16:18 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\log4cplusU.dll

2013-12-03 07:30 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll

2013-12-03 07:30 - 2013-09-18 00:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll

2014-07-24 19:26 - 2014-07-24 19:26 - 01645592 _____ () C:\Program Files (x86)\AVG Secure Search\TBAPI.dll

2014-04-04 09:25 - 2014-04-04 09:25 - 00102400 _____ () C:\Program Files (x86)\f552dd4c52e3\nfapi.dll

2014-06-05 05:41 - 2014-06-05 05:41 - 00331776 _____ () C:\Program Files (x86)\f552dd4c52e3\ProtocolFilters.dll

2014-11-11 00:05 - 2014-11-11 00:05 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2014-08-12 16:18 - 2014-08-12 16:18 - 00693784 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.1.9\NativeBrowserApi.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Users\Neo\SkyDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"

HKCU\...\StartupApproved\Run: => "AppLauncher"

HKCU\...\StartupApproved\Run: => "TomTomHOME.exe"
 

========================= Accounts: ==========================
 

admin (S-1-5-21-4021730028-2611376806-967486672-1004 - Limited - Enabled) => C:\Users\admin

Administrator (S-1-5-21-4021730028-2611376806-967486672-500 - Administrator - Disabled)

Gast (S-1-5-21-4021730028-2611376806-967486672-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-4021730028-2611376806-967486672-1003 - Limited - Enabled)

Neo (S-1-5-21-4021730028-2611376806-967486672-1001 - Administrator - Enabled) => C:\Users\Neo
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (11/13/2014 11:21:50 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (11/13/2014 11:21:39 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a

Name des fehlerhaften Moduls: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000fb87

ID des fehlerhaften Prozesses: 0x15f0

Startzeit der fehlerhaften Anwendung: 0xCrashMon.exe0

Pfad der fehlerhaften Anwendung: CrashMon.exe1

Pfad des fehlerhaften Moduls: CrashMon.exe2

Berichtskennung: CrashMon.exe3

Vollständiger Name des fehlerhaften Pakets: CrashMon.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CrashMon.exe5
 

Error: (11/13/2014 09:02:46 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a

Name des fehlerhaften Moduls: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000fb87

ID des fehlerhaften Prozesses: 0x1638

Startzeit der fehlerhaften Anwendung: 0xCrashMon.exe0

Pfad der fehlerhaften Anwendung: CrashMon.exe1

Pfad des fehlerhaften Moduls: CrashMon.exe2

Berichtskennung: CrashMon.exe3

Vollständiger Name des fehlerhaften Pakets: CrashMon.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CrashMon.exe5
 

Error: (11/13/2014 08:57:36 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm WWAHost.exe, Version 6.3.9600.17031 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: fa4
 

Startzeit: 01cfff7bf23336dd
 

Endzeit: 4294967295
 

Anwendungspfad: C:\Windows\System32\WWAHost.exe
 

Berichts-ID: 46b01ab9-6b6f-11e4-82bd-0c54a5f6bf74
 

Vollständiger Name des fehlerhaften Pakets: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy
 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Windows.Store
 

Error: (11/13/2014 08:57:20 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Angie)

Description: Das Paket „winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy+Windows.Store“ wurde beendet, da das Anhalten zu lange dauerte.
 

Error: (11/13/2014 08:41:50 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)

Description: There was an error with the Windows Location Provider database
 

Error: (11/13/2014 10:13:48 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (11/12/2014 00:02:04 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a

Name des fehlerhaften Moduls: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000fb87

ID des fehlerhaften Prozesses: 0x658

Startzeit der fehlerhaften Anwendung: 0xCrashMon.exe0

Pfad der fehlerhaften Anwendung: CrashMon.exe1

Pfad des fehlerhaften Moduls: CrashMon.exe2

Berichtskennung: CrashMon.exe3

Vollständiger Name des fehlerhaften Pakets: CrashMon.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CrashMon.exe5
 

Error: (11/12/2014 09:57:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (11/10/2014 11:37:39 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005
 
 

System errors:

=============

Error: (11/13/2014 05:58:01 PM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (11/13/2014 05:57:31 PM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (11/12/2014 11:01:16 AM) (Source: DCOM) (EventID: 10016) (User: Angie)

Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}AngieNeoS-1-5-21-4021730028-2611376806-967486672-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
 

Error: (11/12/2014 10:15:55 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (11/12/2014 10:15:25 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (11/11/2014 11:26:54 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (11/11/2014 11:26:24 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (11/11/2014 11:08:43 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 

Error: (11/11/2014 11:08:13 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 

Error: (11/11/2014 10:51:02 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
 

Microsoft Office Sessions:

=========================

Error: (11/13/2014 11:21:50 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (11/13/2014 11:21:39 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: CrashMon.exe0.0.0.053a1993aCrashMon.exe0.0.0.053a1993ac00000050000fb8715f001cfff87c37353ecC:\Program Files (x86)\Universal Updater\CrashMon.exeC:\Program Files (x86)\Universal Updater\CrashMon.exe6fcd5f25-6b83-11e4-82be-0c54a5f6bf74
 

Error: (11/13/2014 09:02:46 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: CrashMon.exe0.0.0.053a1993aCrashMon.exe0.0.0.053a1993ac00000050000fb87163801cfff745c2b1021C:\Program Files (x86)\Universal Updater\CrashMon.exeC:\Program Files (x86)\Universal Updater\CrashMon.exe087e339f-6b70-11e4-82bd-0c54a5f6bf74
 

Error: (11/13/2014 08:57:36 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: WWAHost.exe6.3.9600.17031fa401cfff7bf23336dd4294967295C:\Windows\System32\WWAHost.exe46b01ab9-6b6f-11e4-82bd-0c54a5f6bf74winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewyWindows.Store
 

Error: (11/13/2014 08:57:20 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Angie)

Description: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy+Windows.Store
 

Error: (11/13/2014 08:41:50 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)

Description: -2147024883
 

Error: (11/13/2014 10:13:48 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (11/12/2014 00:02:04 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: CrashMon.exe0.0.0.053a1993aCrashMon.exe0.0.0.053a1993ac00000050000fb8765801cffe5fa8f1b02fC:\Program Files (x86)\Universal Updater\CrashMon.exeC:\Program Files (x86)\Universal Updater\CrashMon.exe55575a60-6a5b-11e4-82bb-0c54a5f6bf74
 

Error: (11/12/2014 09:57:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )

Description: Subscription licensing service failed: -1073415161
 

Error: (11/10/2014 11:37:39 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80070005
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz

Percentage of memory in use: 51%

Total physical RAM: 3975.78 MB

Available physical RAM: 1923.46 MB

Total Pagefile: 6151.78 MB

Available Pagefile: 3693.02 MB

Total Virtual: 131072 MB

Available Virtual: 131071.79 MB
 

==================== Drives ================================
 

Drive c: (BOOT) (Fixed) (Total:869.8 GB) (Free:459.6 GB) NTFS

Drive d: (Recover) (Fixed) (Total:60 GB) (Free:44.39 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 0433B666)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2014 02

Ran by Neo (administrator) on ANGIE on 13-11-2014 23:41:11

Running from C:\Users\Neo\Downloads

Loaded Profile: Neo (Available profiles: Neo & admin)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe

(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe

(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

() C:\Program Files (x86)\Universal Updater\UpdaterService.exe

(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

() C:\Program Files (x86)\PHotkey\PHotkey.exe

(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe

() C:\Program Files (x86)\PHotkey\POsd.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files (x86)\PHotkey\GPMTray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

() C:\Program Files (x86)\AVG Secure Search\vprot.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

() C:\Program Files (x86)\f552dd4c52e3\b786bdb3c67d.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653720 2013-09-24] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353944 2013-09-16] (Realtek Semiconductor)

HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)

HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)

HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-10] (CyberLink Corp.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)

HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-08-01] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [CrashMon] => C:\Program Files (x86)\Universal Updater\CrashMon.exe [388096 2014-06-18] ()

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3593744 2014-09-05] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-08-25] ()

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

HKLM-x32\...\Run: [Salus CrashMon] => "C:\Program Files (x86)\f552dd4c52e3\a7d12b5975b4.exe" "b786bdb3c67d.exe" "hxxp://log.data-url.com/salus/crash"

HKLM-x32\...\Run: [Salus] => C:\Program Files (x86)\f552dd4c52e3\b786bdb3c67d.exe [997952 2014-11-05] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AVG-Secure-Search-Update_0814tb] => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2782744 2014-08-29] ()

BootExecute: autocheck autochk * sdnclean64.exe

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/?type=501549&fr=spigot-yhp-ie

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/search?q={searchTerms}

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {80000762-D5FE-434E-9FED-DDFEDDA3D72F} URL = hxxp://www.sm.de/?q={searchTerms}

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms}

SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3326313&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=5&UP=SPCA3FDFB3-3725-46F8-A30D-E19ECF8D739A&q={searchTerms}&SSPV=

SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

SearchScopes: HKCU - {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default

FF DefaultSearchEngine: Yahoo!

FF SelectedSearchEngine: Yahoo!

FF Homepage: https://www.google.de/

FF Keyword.URL: https://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=501549&p=

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()

FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File

FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Neo\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\ddg.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Cliqz Beta - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\cliqz@cliqz.com [2014-11-13]

FF Extension: Adblock Plus - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-26]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-11-11]

FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799

FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 [2014-08-25]

FF Extension: No Name - avg@toolbar [Not Found]
 

Chrome: 

=======

CHR Profile: C:\Users\Neo\AppData\Local\Google\Chrome\User Data\Default
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3364368 2014-09-05] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [293448 2014-09-05] (AVG Technologies CZ, s.r.o.)

R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)

R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)

R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)

R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2013-12-03] () [File not signed]

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

R2 UniversalUpdater; C:\Program Files (x86)\Universal Updater\UpdaterService.exe [606136 2014-06-18] ()

R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-12] (AVG Secure Search)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [247576 2014-07-24] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-20] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-12] (AVG Technologies)

R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [273176 2014-07-18] (AVG Technologies CZ, s.r.o.)

R1 b786bdb3c67d; C:\Windows\System32\drivers\b786bdb3c67d.sys [52016 2014-11-05] (Windows (R) Win 7 DDK provider)

S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-13] (Malwarebytes Corporation)

R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)

R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation                           )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)

R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)

S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)

S1 Salus; system32\drivers\Salus.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-11-13 23:41 - 2014-11-13 23:41 - 00021021 _____ () C:\Users\Neo\Downloads\FRST.txt

2014-11-13 23:40 - 2014-11-13 23:41 - 00000000 ____D () C:\FRST

2014-11-13 23:39 - 2014-11-13 23:39 - 02116608 _____ (Farbar) C:\Users\Neo\Downloads\FRST64.exe

2014-11-13 22:53 - 2014-11-13 22:53 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-11-13 22:51 - 2014-11-13 22:51 - 00001118 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-11-13 22:51 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-11-13 22:51 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-11-13 22:51 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-11-13 22:49 - 2014-11-13 22:49 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Cliqz

2014-11-13 22:49 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-11-13 22:49 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-11-13 22:47 - 2014-11-13 22:47 - 01125200 _____ () C:\Users\Neo\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

2014-11-13 22:16 - 2014-11-13 22:16 - 00000000 ____D () C:\Windows\softwaredistribution.bak2

2014-11-13 22:06 - 2013-08-22 14:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141113-220659.backup

2014-11-13 21:55 - 2014-11-13 21:55 - 00009839 _____ () C:\Users\Neo\Desktop\Scan Results.141113-2155.txt

2014-11-13 18:14 - 2014-11-13 18:14 - 00000000 ____D () C:\Program Files (x86)\f552dd4c52e3

2014-11-11 00:05 - 2014-11-11 00:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\ProgramData\Samsung

2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate

2014-11-05 18:36 - 2014-11-05 18:36 - 00052016 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\b786bdb3c67d.sys

2014-10-24 12:57 - 2014-10-24 13:24 - 614846156 _____ () C:\Users\Neo\Desktop\Freunde fürs Leben.mp4

2014-10-24 12:52 - 2014-10-24 12:57 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\HandBrake

2014-10-24 12:51 - 2014-10-24 12:51 - 14298467 _____ () C:\Users\Neo\Downloads\HandBrake-0.9.9-1_x86_64-Win_GUI.exe

2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\Neo\Desktop\Handbrake.lnk

2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\admin\Desktop\Handbrake.lnk

2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Handbrake

2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake

2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Program Files\Handbrake

2014-10-24 12:34 - 2014-10-24 12:34 - 00001171 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk

2014-10-24 12:34 - 2014-10-24 12:34 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk

2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Canneverbe Limited

2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\ProgramData\Canneverbe Limited

2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP

2014-10-24 12:33 - 2014-10-24 12:33 - 05402840 _____ (Canneverbe Limited ) C:\Users\Neo\Downloads\cdbxp_setup_4.5.4.5143_minimal.exe

2014-10-21 20:46 - 2014-10-21 20:46 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\AVG2015

2014-10-21 20:45 - 2014-10-21 20:45 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk

2014-10-21 20:43 - 2014-10-30 23:35 - 00000000 ____D () C:\ProgramData\AVG2015

2014-10-21 20:43 - 2014-10-21 20:43 - 00000000 ____D () C:\Users\admin\AppData\Local\Avg

2014-10-21 20:39 - 2014-10-22 14:42 - 00000000 ____D () C:\Users\Neo\AppData\Local\Avg2015

2014-10-15 19:55 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-15 19:55 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-15 19:55 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-15 19:55 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 19:55 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 19:55 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll

2014-10-15 19:55 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-15 19:55 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-15 19:55 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-15 19:55 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-15 19:55 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-15 19:38 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 19:38 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-10-15 19:38 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-10-15 19:38 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-10-15 19:38 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-10-15 19:38 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-10-15 19:38 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-10-15 19:38 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-10-15 19:38 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-10-15 19:38 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-10-15 19:38 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-10-15 19:38 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-10-15 19:38 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-10-15 19:38 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-10-15 19:38 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-10-15 19:37 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 19:37 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 19:36 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 19:36 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 19:36 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 19:36 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 19:36 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 19:36 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 19:36 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 19:36 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 19:36 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 19:36 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 19:36 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 19:36 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 19:36 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 19:36 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 19:36 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 19:36 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 19:36 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 19:36 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 19:36 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 19:36 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 19:36 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 19:36 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 19:36 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 19:36 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 19:36 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 19:36 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 19:36 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 19:36 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 19:36 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 19:36 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 19:36 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 19:36 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 19:36 - 2014-08-16 05:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-15 19:36 - 2014-08-16 04:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-15 19:36 - 2014-08-16 04:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-15 19:36 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-15 19:36 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-15 19:36 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-15 19:36 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-15 19:36 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-15 19:36 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-15 19:35 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-15 19:35 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-15 19:35 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-15 19:35 - 2014-08-16 04:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-15 19:35 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-15 19:35 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-15 19:35 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-15 19:35 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-15 19:35 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-15 19:35 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-15 19:35 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-15 19:35 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-15 19:35 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-15 19:35 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-15 19:35 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-15 19:35 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-15 19:35 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 19:35 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-15 19:35 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-15 19:35 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 19:35 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-15 19:35 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-15 19:35 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-15 19:35 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-15 19:35 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-15 19:35 - 2014-08-01 00:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-11-13 23:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru

2014-11-13 22:58 - 2014-01-15 19:52 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4021730028-2611376806-967486672-1001

2014-11-13 22:51 - 2014-03-16 15:52 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-11-13 22:45 - 2014-03-15 20:48 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-11-13 22:43 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF

2014-11-13 22:31 - 2014-01-15 19:45 - 01351603 _____ () C:\Windows\WindowsUpdate.log

2014-11-13 22:28 - 2013-11-12 12:57 - 00793160 _____ () C:\Windows\system32\perfh010.dat

2014-11-13 22:28 - 2013-11-12 12:57 - 00156082 _____ () C:\Windows\system32\perfc010.dat

2014-11-13 22:28 - 2013-11-12 12:32 - 00765582 _____ () C:\Windows\system32\perfh007.dat

2014-11-13 22:28 - 2013-11-12 12:32 - 00159366 _____ () C:\Windows\system32\perfc007.dat

2014-11-13 22:28 - 2013-11-12 12:09 - 02726338 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-11-13 22:20 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job

2014-11-13 22:20 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job

2014-11-13 22:20 - 2014-08-16 19:44 - 00042398 _____ () C:\Windows\PFRO.log

2014-11-13 22:20 - 2014-01-15 19:46 - 00400956 _____ () C:\Users\Neo\AppData\Local\BTServer.log

2014-11-13 22:20 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-11-13 22:09 - 2014-07-23 18:47 - 00000000 ____D () C:\ProgramData\MFAData

2014-11-13 20:50 - 2014-03-18 19:54 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-11-13 19:58 - 2014-01-17 17:17 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-11-13 19:36 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-11-13 17:40 - 2014-08-25 22:51 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9D5DDB08-682D-474D-B8F1-06065B577A40}

2014-11-13 17:40 - 2014-08-24 13:49 - 00000220 _____ () C:\Users\Neo\BullseyeCoverageError.txt

2014-11-13 12:28 - 2014-01-15 22:19 - 00000000 ____D () C:\HebRechw

2014-11-12 11:00 - 2014-03-22 13:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-11-12 10:57 - 2014-07-31 16:44 - 00010763 _____ () C:\Windows\setupact.log

2014-11-12 10:45 - 2014-03-15 20:48 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-11-12 10:02 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-11-08 19:31 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2014-11-05 23:06 - 2014-09-02 21:03 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Skype

2014-11-02 13:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache

2014-11-01 19:04 - 2014-01-22 18:55 - 00000000 ___RD () C:\Users\Neo\SkyDrive

2014-11-01 19:03 - 2013-08-22 15:44 - 00515072 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sl-SI

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\en-GB

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sl-SI

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\en-GB

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera

2014-11-01 18:40 - 2014-01-20 00:12 - 00000000 ____D () C:\Windows\system32\MRT

2014-11-01 18:34 - 2013-11-12 13:49 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-11-01 18:33 - 2014-07-24 20:16 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-30 23:42 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\LiveKernelReports

2014-10-29 08:35 - 2013-11-12 16:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-10-24 15:34 - 2014-02-09 13:03 - 00411648 ___SH () C:\Users\Neo\Desktop\Thumbs.db

2014-10-24 15:30 - 2014-01-17 18:27 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\vlc

2014-10-21 20:46 - 2014-07-23 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ___HD () C:\$AVG

2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ____D () C:\Program Files (x86)\AVG

2014-10-20 09:04 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
 

Some content of TEMP:

====================

C:\Users\Neo\AppData\Local\Temp\AppLauncher.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-11-09 12:52
 

==================== End Of Log ============================

--- --- ---

Dann bitte jetzt Combofix ausführen:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Fehlermeldung:

System not supportet, könnte daran liegen das ich Windows 8.1 habe

Jup, jetzt seh ich es auch, dachte CF unterstützt 8.1 mittlerweile...

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Code:

# AdwCleaner v4.101 - Bericht erstellt am 14/11/2014 um 00:36:59

# Aktualisiert 09/11/2014 von Xplode

# Database : 2014-11-13.1 [Live]

# Betriebssystem : Windows 8.1  (64 bits)

# Benutzername : Neo - ANGIE

# Gestartet von : C:\Users\Neo\Downloads\AdwCleaner_4.101.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

Dienst Gelöscht : UniversalUpdater

Dienst Gelöscht : vToolbarUpdater18.1.9

Dienst Gelöscht : salus
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\AVG Secure Search

Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar

Ordner Gelöscht : C:\Program Files (x86)\AVG Secure Search

Ordner Gelöscht : C:\Program Files (x86)\GreenTree Applications

Ordner Gelöscht : C:\Program Files (x86)\HD Streamer

Ordner Gelöscht : C:\Program Files (x86)\Universal Updater

Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search

Ordner Gelöscht : C:\Users\admin\AppData\Local\AVG Secure Search

Ordner Gelöscht : C:\Users\admin\AppData\LocalLow\AVG Secure Search

Ordner Gelöscht : C:\Users\Neo\AppData\Local\AVG Secure Search

Ordner Gelöscht : C:\Users\Neo\AppData\Local\HD Streamer

Ordner Gelöscht : C:\Users\Neo\AppData\Local\PriceFountain

Ordner Gelöscht : C:\Users\Neo\AppData\LocalLow\AVG Secure Search

Datei Gelöscht : C:\Users\Neo\Favorites\Startfenster.lnk

Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Startfenster.lnk

Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Startfenster.lnk

Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Opera Software\Opera Stable\Local Storage\hxxp_www.superfish.com_0.localstorage

Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Opera Software\Opera Stable\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
 

***** [ Tasks ] *****
 

Task Gelöscht : AmiUpdXp
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Schlüssel Gelöscht : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.BackgroundHostObject

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.BackgroundHostObject.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Navbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Navbar.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.ScriptHostObject

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.ScriptHostObject.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Tool

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Tool.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BackgroundHost.EXE

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [CrashMon]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Salus]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Salus CrashMon]

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginService

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{33E06582-221E-400F-809B-30D3984DB355}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3868E0C2-3E75-445F-B748-C97BB82300AC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CACBAC2D-FDC3-4608-A289-6F281F471B83}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5375FB9F-DF09-444B-9DC0-C6ED079C2577}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6D697641-4C65-49F0-8CED-FE8180B5E37E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{73BB74C6-8886-4245-BCDA-448137D75D42}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E7ABCD91-74F6-45AD-968B-A45EB265072C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{33E06582-221E-400F-809B-30D3984DB355}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{3868E0C2-3E75-445F-B748-C97BB82300AC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CACBAC2D-FDC3-4608-A289-6F281F471B83}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{80000762-D5FE-434E-9FED-DDFEDDA3D72F}

Schlüssel Gelöscht : HKCU\Software\AVG Secure Search

Schlüssel Gelöscht : HKCU\Software\InstallCore

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\SecuredDownload

Schlüssel Gelöscht : HKCU\Software\SmartBar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit

Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Secure Search

Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Security Toolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Salus

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\ValueApps

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\portaldosites.com
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17344
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
 

-\\ Mozilla Firefox v33.1 (x86 de)
 

[jy54wylz.default\prefs.js] - Zeile gelöscht : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\18.1.9.799");

[jy54wylz.default\prefs.js] - Zeile gelöscht : user_pref("avg.userPreferences.URLBarFocus.whiteList", "bing\\.comgoogle\\.\\w+yahoo\\.\\w+gmail\\.\\w+hotmail\\.\\w+live\\.\\w+isearch\\.avg\\.commysearch\\.avg\\.com");
 

-\\ Google Chrome v
 
 

-\\ Opera v0.0.0.0
 
 

*************************
 

AdwCleaner[R0].txt - [15027 octets] - [23/05/2014 12:22:57]

AdwCleaner[R1].txt - [1012 octets] - [24/05/2014 22:42:04]

AdwCleaner[R2].txt - [9533 octets] - [14/11/2014 00:34:24]

AdwCleaner[S0].txt - [13516 octets] - [23/05/2014 12:26:00]

AdwCleaner[S1].txt - [1073 octets] - [24/05/2014 22:43:48]

AdwCleaner[S2].txt - [9001 octets] - [14/11/2014 00:36:59]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [9061 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.3.7 (11.08.2014:1)

OS: Windows 8.1 x64

Ran by Neo on 14.11.2014 at  0:43:59,54

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 

Successfully deleted: [File] "C:\Users\Neo\favorites\links\startfenster.lnk"

Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPC-STANDALONE-SETUP.-F6245FA5.pf

Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPC.TMP-473CCC3F.pf

Successfully deleted: [File] "C:\Windows\wininit.ini"
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Neo\AppData\Roaming\mozilla\firefox\profiles\jy54wylz.default\minidumps [7 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 14.11.2014 at  0:49:09,44

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2014 02

Ran by Neo (administrator) on ANGIE on 14-11-2014 00:59:19

Running from C:\Users\Neo\Downloads

Loaded Profile: Neo (Available profiles: Neo & admin)

Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe

(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe

(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

() C:\Program Files\CyberLink\Shared files\RichVideo64.exe

(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe

() C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

() C:\Program Files (x86)\PHotkey\PHotkey.exe

(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

() C:\Program Files (x86)\PHotkey\POsd.exe

() C:\Program Files (x86)\PHotkey\GPMTray.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

() C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653720 2013-09-24] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353944 2013-09-16] (Realtek Semiconductor)

HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)

HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)

HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-10] (CyberLink Corp.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)

HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-08-01] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3593744 2014-09-05] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]

HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)

HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AVG-Secure-Search-Update_0814tb] => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2782744 2014-08-29] ()

BootExecute: autocheck autochk * sdnclean64.exe

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/search?q={searchTerms}

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms}

SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3326313&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=5&UP=SPCA3FDFB3-3725-46F8-A30D-E19ECF8D739A&q={searchTerms}&SSPV=

SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}

SearchScopes: HKCU - {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default

FF DefaultSearchEngine: Yahoo!

FF SelectedSearchEngine: Yahoo!

FF Homepage: https://www.google.de/

FF Keyword.URL: https://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=501549&p=

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()

FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File

FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Neo\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF SearchPlugin: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\searchplugins\google-maps.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\ddg.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Cliqz Beta - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\cliqz@cliqz.com [2014-11-13]

FF Extension: Adblock Plus - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-26]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-11-11]
 

Chrome: 

=======

CHR Profile: C:\Users\Neo\AppData\Local\Google\Chrome\User Data\Default
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3364368 2014-09-05] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [293448 2014-09-05] (AVG Technologies CZ, s.r.o.)

R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)

R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)

R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)

S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)

R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2013-12-03] () [File not signed]

R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)

S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)

S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [247576 2014-07-24] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-20] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-12] (AVG Technologies)

R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [273176 2014-07-18] (AVG Technologies CZ, s.r.o.)

R1 b786bdb3c67d; C:\Windows\System32\drivers\b786bdb3c67d.sys [52016 2014-11-05] (Windows (R) Win 7 DDK provider)

S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)

R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)

R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation                           )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)

R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)

S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-11-14 00:49 - 2014-11-14 00:49 - 00001294 _____ () C:\Users\Neo\Desktop\JRT.txt

2014-11-14 00:43 - 2014-11-14 00:43 - 00000000 ____D () C:\Windows\ERUNT

2014-11-14 00:42 - 2014-11-14 00:42 - 01706808 _____ (Thisisu) C:\Users\Neo\Downloads\JRT.exe

2014-11-14 00:39 - 2014-11-14 00:39 - 00009189 _____ () C:\Users\Neo\Desktop\AdwCleaner[S2].txt

2014-11-14 00:32 - 2014-11-14 00:32 - 02140160 _____ () C:\Users\Neo\Downloads\AdwCleaner_4.101.exe

2014-11-14 00:19 - 2014-11-14 00:19 - 05597734 _____ (Swearware) C:\Users\Neo\Downloads\ComboFix.exe

2014-11-13 23:42 - 2014-11-13 23:43 - 00029599 _____ () C:\Users\Neo\Downloads\Addition.txt

2014-11-13 23:41 - 2014-11-14 00:59 - 00018954 _____ () C:\Users\Neo\Downloads\FRST.txt

2014-11-13 23:40 - 2014-11-14 00:59 - 00000000 ____D () C:\FRST

2014-11-13 23:39 - 2014-11-13 23:39 - 02116608 _____ (Farbar) C:\Users\Neo\Downloads\FRST64.exe

2014-11-13 22:53 - 2014-11-13 22:53 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-11-13 22:51 - 2014-11-13 22:51 - 00001118 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-11-13 22:51 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-11-13 22:51 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-11-13 22:51 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-11-13 22:49 - 2014-11-13 22:49 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Cliqz

2014-11-13 22:49 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll

2014-11-13 22:49 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll

2014-11-13 22:47 - 2014-11-13 22:47 - 01125200 _____ () C:\Users\Neo\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe

2014-11-13 22:16 - 2014-11-13 22:16 - 00000000 ____D () C:\Windows\softwaredistribution.bak2

2014-11-13 22:06 - 2013-08-22 14:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141113-220659.backup

2014-11-13 21:55 - 2014-11-13 21:55 - 00009839 _____ () C:\Users\Neo\Desktop\Scan Results.141113-2155.txt

2014-11-13 18:14 - 2014-11-13 18:14 - 00000000 ____D () C:\Program Files (x86)\f552dd4c52e3

2014-11-11 00:05 - 2014-11-11 00:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\ProgramData\Samsung

2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate

2014-11-05 18:36 - 2014-11-05 18:36 - 00052016 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\b786bdb3c67d.sys

2014-10-24 12:57 - 2014-10-24 13:24 - 614846156 _____ () C:\Users\Neo\Desktop\Freunde fürs Leben.mp4

2014-10-24 12:52 - 2014-10-24 12:57 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\HandBrake

2014-10-24 12:51 - 2014-10-24 12:51 - 14298467 _____ () C:\Users\Neo\Downloads\HandBrake-0.9.9-1_x86_64-Win_GUI.exe

2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\Neo\Desktop\Handbrake.lnk

2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\admin\Desktop\Handbrake.lnk

2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Handbrake

2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake

2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Program Files\Handbrake

2014-10-24 12:34 - 2014-10-24 12:34 - 00001171 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk

2014-10-24 12:34 - 2014-10-24 12:34 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk

2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Canneverbe Limited

2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\ProgramData\Canneverbe Limited

2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP

2014-10-24 12:33 - 2014-10-24 12:33 - 05402840 _____ (Canneverbe Limited ) C:\Users\Neo\Downloads\cdbxp_setup_4.5.4.5143_minimal.exe

2014-10-21 20:46 - 2014-10-21 20:46 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\AVG2015

2014-10-21 20:45 - 2014-10-21 20:45 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk

2014-10-21 20:43 - 2014-10-30 23:35 - 00000000 ____D () C:\ProgramData\AVG2015

2014-10-21 20:43 - 2014-10-21 20:43 - 00000000 ____D () C:\Users\admin\AppData\Local\Avg

2014-10-21 20:39 - 2014-10-22 14:42 - 00000000 ____D () C:\Users\Neo\AppData\Local\Avg2015

2014-10-15 19:55 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-15 19:55 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-15 19:55 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-15 19:55 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 19:55 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-10-15 19:55 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll

2014-10-15 19:55 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll

2014-10-15 19:55 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll

2014-10-15 19:55 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2014-10-15 19:55 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-10-15 19:55 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-10-15 19:38 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 19:38 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-10-15 19:38 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-10-15 19:38 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-10-15 19:38 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-10-15 19:38 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-10-15 19:38 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-10-15 19:38 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-10-15 19:38 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-10-15 19:38 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-10-15 19:38 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-10-15 19:38 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-10-15 19:38 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-10-15 19:38 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-10-15 19:38 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-10-15 19:37 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 19:37 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll

2014-10-15 19:36 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 19:36 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-10-15 19:36 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-10-15 19:36 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-10-15 19:36 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-10-15 19:36 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 19:36 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 19:36 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-10-15 19:36 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 19:36 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 19:36 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 19:36 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 19:36 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-10-15 19:36 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 19:36 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-10-15 19:36 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 19:36 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-10-15 19:36 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 19:36 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-10-15 19:36 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 19:36 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 19:36 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 19:36 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 19:36 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-10-15 19:36 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-10-15 19:36 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 19:36 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-10-15 19:36 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 19:36 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-10-15 19:36 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-10-15 19:36 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 19:36 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll

2014-10-15 19:36 - 2014-08-16 05:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-15 19:36 - 2014-08-16 04:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2014-10-15 19:36 - 2014-08-16 04:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-10-15 19:36 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll

2014-10-15 19:36 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll

2014-10-15 19:36 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll

2014-10-15 19:36 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-15 19:36 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll

2014-10-15 19:36 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-10-15 19:35 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll

2014-10-15 19:35 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2014-10-15 19:35 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2014-10-15 19:35 - 2014-08-16 04:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2014-10-15 19:35 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll

2014-10-15 19:35 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2014-10-15 19:35 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2014-10-15 19:35 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll

2014-10-15 19:35 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll

2014-10-15 19:35 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll

2014-10-15 19:35 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll

2014-10-15 19:35 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll

2014-10-15 19:35 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll

2014-10-15 19:35 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll

2014-10-15 19:35 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll

2014-10-15 19:35 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll

2014-10-15 19:35 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 19:35 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll

2014-10-15 19:35 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll

2014-10-15 19:35 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-10-15 19:35 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll

2014-10-15 19:35 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll

2014-10-15 19:35 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll

2014-10-15 19:35 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe

2014-10-15 19:35 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll

2014-10-15 19:35 - 2014-08-01 00:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-11-14 00:56 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job

2014-11-14 00:56 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job

2014-11-14 00:56 - 2014-08-16 19:44 - 00043296 _____ () C:\Windows\PFRO.log

2014-11-14 00:56 - 2014-01-15 19:46 - 00403207 _____ () C:\Users\Neo\AppData\Local\BTServer.log

2014-11-14 00:56 - 2014-01-15 19:45 - 01369221 _____ () C:\Windows\WindowsUpdate.log

2014-11-14 00:56 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-11-14 00:55 - 2014-05-23 12:22 - 00000000 ____D () C:\AdwCleaner

2014-11-14 00:51 - 2014-01-15 19:52 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4021730028-2611376806-967486672-1001

2014-11-14 00:45 - 2014-03-15 20:48 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-11-14 00:43 - 2013-11-12 12:57 - 00793160 _____ () C:\Windows\system32\perfh010.dat

2014-11-14 00:43 - 2013-11-12 12:57 - 00156082 _____ () C:\Windows\system32\perfc010.dat

2014-11-14 00:43 - 2013-11-12 12:32 - 00765582 _____ () C:\Windows\system32\perfh007.dat

2014-11-14 00:43 - 2013-11-12 12:32 - 00159366 _____ () C:\Windows\system32\perfc007.dat

2014-11-14 00:43 - 2013-11-12 12:09 - 02726338 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-11-14 00:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru

2014-11-13 23:56 - 2014-08-25 22:51 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9D5DDB08-682D-474D-B8F1-06065B577A40}

2014-11-13 22:51 - 2014-03-16 15:52 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-11-13 22:43 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF

2014-11-13 22:09 - 2014-07-23 18:47 - 00000000 ____D () C:\ProgramData\MFAData

2014-11-13 20:50 - 2014-03-18 19:54 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-11-13 19:58 - 2014-01-17 17:17 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-11-13 19:36 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-11-13 17:40 - 2014-08-24 13:49 - 00000220 _____ () C:\Users\Neo\BullseyeCoverageError.txt

2014-11-13 12:28 - 2014-01-15 22:19 - 00000000 ____D () C:\HebRechw

2014-11-12 11:00 - 2014-03-22 13:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-11-12 10:57 - 2014-07-31 16:44 - 00010763 _____ () C:\Windows\setupact.log

2014-11-12 10:45 - 2014-03-15 20:48 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-11-12 10:02 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp

2014-11-08 19:31 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2014-11-05 23:06 - 2014-09-02 21:03 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Skype

2014-11-02 13:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache

2014-11-01 19:04 - 2014-01-22 18:55 - 00000000 ___RD () C:\Users\Neo\SkyDrive

2014-11-01 19:03 - 2013-08-22 15:44 - 00515072 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sl-SI

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\en-GB

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sl-SI

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\en-GB

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager

2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera

2014-11-01 18:40 - 2014-01-20 00:12 - 00000000 ____D () C:\Windows\system32\MRT

2014-11-01 18:34 - 2013-11-12 13:49 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-11-01 18:33 - 2014-07-24 20:16 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-30 23:42 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\LiveKernelReports

2014-10-29 08:35 - 2013-11-12 16:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-10-24 15:34 - 2014-02-09 13:03 - 00411648 ___SH () C:\Users\Neo\Desktop\Thumbs.db

2014-10-24 15:30 - 2014-01-17 18:27 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\vlc

2014-10-21 20:46 - 2014-07-23 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ___HD () C:\$AVG

2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ____D () C:\Program Files (x86)\AVG

2014-10-20 09:04 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
 

Some content of TEMP:

====================

C:\Users\Neo\AppData\Local\Temp\AppLauncher.exe

C:\Users\Neo\AppData\Local\Temp\Quarantine.exe

C:\Users\Neo\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-11-09 12:52
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-11-2014 02

Ran by Neo at 2014-11-14 01:00:34

Running from C:\Users\Neo\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)

Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)

AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5315 - AVG Technologies)

AVG 2015 (Version: 15.0.4213 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.5315 - AVG Technologies) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)

Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)

CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)

CyberLink PowerDirector 11 (Version: 11.0.0.3215 - CyberLink Corp.) Hidden

CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)

CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)

Epson Easy Photo Print 2 (HKLM-x32\...\{94FA9FA6-5294-494D-A8F1-1E654CBB5736}) (Version: 2.2.3.1 - SEIKO EPSON CORPORATION)

Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)

EPSON-Drucker-Software (HKLM-x32\...\EPSON Printer and Utilities) (Version:  - )

Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

HandBrake 0.9.9.1 (HKLM-x32\...\HandBrake) (Version: 0.9.9.1 - )

HebRech HebRechw (HKLM-x32\...\{C63B768B-8B87-46F0-B56E-F863FD9E0870}) (Version: 0 - )

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3349 - Intel Corporation)

Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)

iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)

Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)

kwiksupport.me (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\kwiksupport.me) (Version: 12.0.36.1315 - pcvisit Software AG)

Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4667.1002 - Microsoft Corporation)

Microsoft SkyDrive (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden

OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)

PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0094 - Pegatron Corporation)

Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)

QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden

REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.093013 - REALTEK Semiconductor Corp.)

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7045 - Realtek Semiconductor Corp.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0227 - REALTEK Semiconductor Corp.)

Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)

Snap.Do (HKLM-x32\...\{FB385922-2E32-4462-A7DC-27159614A660}) (Version: 10.213.1.15234 - ReSoft Ltd.) <==== ATTENTION

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)

TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Unity Web Player (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\UnityWebPlayer) (Version: 4.5.3f3 - Unity Technologies ApS)

UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)

Windows Phone app for desktop (HKLM-x32\...\{9C4D79B6-238E-49D8-AEBC-26384EBDE6B3}) (Version: 1.0.1720.1 - Microsoft Corporation)

YTD Video Downloader 4.8.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.1 - GreenTree Applications SRL) <==== ATTENTION
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\FileSyncApi64.dll (Microsoft Corporation)
 

==================== Restore Points  =========================
 

29-10-2014 07:34:17 Installiert HebRech

01-11-2014 17:32:32 Windows Update

09-11-2014 12:16:09 Geplanter Prüfpunkt
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2013-08-22 14:25 - 2014-11-13 22:06 - 00450713 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com

127.0.0.1        www.0scan.com

127.0.0.1        0scan.com

127.0.0.1        1000gratisproben.com

127.0.0.1        www.1000gratisproben.com

127.0.0.1        1001namen.com

127.0.0.1        www.1001namen.com

127.0.0.1        100888290cs.com

127.0.0.1        www.100888290cs.com

127.0.0.1        www.100sexlinks.com

127.0.0.1        100sexlinks.com

127.0.0.1        10sek.com

127.0.0.1        www.10sek.com

127.0.0.1        www.1-2005-search.com

127.0.0.1        1-2005-search.com

127.0.0.1        123fporn.info

127.0.0.1        www.123fporn.info

127.0.0.1        123haustiereundmehr.com

127.0.0.1        www.123haustiereundmehr.com

127.0.0.1        123moviedownload.com
 

There are 1000 more lines.
 
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {01072E6C-C09D-4986-9538-5AB4A7BC5EE0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {2E4E5FB0-8196-4357-99FC-83CA1E6C56CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {3A5C66F6-D705-4625-B73A-76C548EAC52C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {5361FB93-DA83-4C45-BC63-C968DC5054D4} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-10-22] (Microsoft Corporation)

Task: {63507F5D-2B25-4F2C-B91C-37AF27306AC8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-10-07] (Microsoft Corporation)

Task: {770BA74E-28E4-4E65-90B5-625D6C5C4010} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-11-01] (Microsoft Corporation)

Task: {8E16DB4C-8B87-4373-BD41-69A7C7308962} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rmv => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()

Task: {97DB4190-102B-4B17-BBA8-F2A377B3D6F7} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-14] (Synaptics Incorporated)

Task: {9AEA6DB9-8F05-4D7B-B764-225E14DAE2EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-12] (Adobe Systems Incorporated)

Task: {C8CAF07B-7DAC-47DF-AF3E-BFDA1E22560C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {DD1CB7F8-F551-4981-8AD1-DAD7C2C1DE18} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rel => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-03 07:30 - 2013-12-03 00:21 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe

2014-08-26 09:38 - 2014-08-26 09:38 - 00034304 _____ () C:\Windows\System32\ssd3clm.dll

2013-11-18 17:35 - 2013-09-26 21:08 - 00061440 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe

2014-03-19 02:11 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2013-11-12 16:53 - 2013-03-06 15:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe

2014-08-29 23:36 - 2014-08-29 23:36 - 02782744 _____ () C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe

2013-12-03 07:30 - 2013-10-14 20:11 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe

2013-12-03 07:30 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe

2013-12-03 07:30 - 2013-10-14 18:09 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe

2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2014-03-18 19:54 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll

2014-03-18 19:54 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2014-03-18 19:54 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl

2014-03-18 19:54 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl

2014-03-18 19:54 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

2013-12-03 07:30 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll

2013-12-03 07:30 - 2013-09-18 00:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll

2014-11-11 00:05 - 2014-11-11 00:05 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\Users\Neo\SkyDrive:ms-properties
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"

HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"

HKCU\...\StartupApproved\Run: => "AppLauncher"

HKCU\...\StartupApproved\Run: => "TomTomHOME.exe"
 

========================= Accounts: ==========================
 

admin (S-1-5-21-4021730028-2611376806-967486672-1004 - Limited - Enabled) => C:\Users\admin

Administrator (S-1-5-21-4021730028-2611376806-967486672-500 - Administrator - Disabled)

Gast (S-1-5-21-4021730028-2611376806-967486672-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-4021730028-2611376806-967486672-1003 - Limited - Enabled)

Neo (S-1-5-21-4021730028-2611376806-967486672-1001 - Administrator - Enabled) => C:\Users\Neo
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============

Error: (11/14/2014 00:53:29 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (11/14/2014 00:52:59 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 

Error: (11/14/2014 00:52:29 AM) (Source: DCOM) (EventID: 10010) (User: Angie)

Description: {9AA46009-3CE0-458A-A354-715610A075E6}
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Processor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz

Percentage of memory in use: 41%

Total physical RAM: 3975.78 MB

Available physical RAM: 2325.92 MB

Total Pagefile: 6151.78 MB

Available Pagefile: 4445.21 MB

Total Virtual: 131072 MB

Available Virtual: 131071.83 MB
 

==================== Drives ================================
 

Drive c: (BOOT) (Fixed) (Total:869.8 GB) (Free:459.55 GB) NTFS

Drive d: (Recover) (Fixed) (Total:60 GB) (Free:44.39 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 0433B666)
 

Partition: GPT Partition Type.
 

==================== End Of Log ============================

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

C:\Program Files (x86)\f552dd4c52e3

C:\Windows\system32\Drivers\b786bdb3c67d.sys

EmptyTemp:

Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-11-2014 02

Ran by Neo at 2014-11-14 01:35:08 Run:1

Running from C:\Users\Neo\Downloads

Loaded Profile: Neo (Available profiles: Neo & admin)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

C:\Program Files (x86)\f552dd4c52e3

C:\Windows\system32\Drivers\b786bdb3c67d.sys

EmptyTemp:

Hosts:

         

*****************
 

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.

C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.

C:\Program Files (x86)\f552dd4c52e3 => Moved successfully.

C:\Windows\system32\Drivers\b786bdb3c67d.sys => Moved successfully.

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.

Hosts was reset successfully.

EmptyTemp: => Removed 421 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog ====

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Moin moin,

mir ist da wohl ein Fehler unterlaufen gestern nacht.
Habe den mbam durchlaufen lassen, alles gut.
Dann den Eset, der hat 36 Ergebnisse gefunden und auch gecleant, hier habe ich dann aber blöderweise erst eset gelöscht und wollte dann die logdatei sichern, was wohl eine ziemlich blöde idee war :headbang:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 14.11.2014

Suchlauf-Zeit: 01:46:35

Logdatei: Verlaufsprotokoll MBAM 14.11. um 01-46.txt

Administrator: Ja
 

Version: 2.00.3.1025

Malware Datenbank: v2014.11.13.11

Rootkit Datenbank: v2014.11.12.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 8.1

CPU: x64

Dateisystem: NTFS

Benutzer: Neo
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 368052

Verstrichene Zeit: 14 Min, 13 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente erkannt)
 

Module: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsschlüssel: 3

PUP.Optional.Snapdo.T, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [69e695a63b4148eefcd2965cd13135cb], 

PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{FB385922-2E32-4462-A7DC-27159614A660}, In Quarantäne, [f25d63d8770576c0202a1b3b50b333cd], 

PUP.Optional.ReMarkit.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, In Quarantäne, [db74b8839edef34394f80435956e5fa1], 
 

Registrierungswerte: 1

PUP.Optional.QuickStart.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, In Quarantäne, [28270e2daeceb08621b2d67734cfa35d]
 

Registrierungsdaten: 7

PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[89c640fb92eafe3856d46ddafd08bf41]

PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,),Ersetzt,[3b143605710b1422b1c2e754f0150ef2]

PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[e56ad06b6616f541363bf2497b8a1ce4]

PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[074806355725b38384ee6bd04cb97c84]

PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[450ac8738cf0c5717ff585b63acb1fe1]

PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[88c78dae631974c27cf9c17a5da8d030]

PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[a6a92f0cdba1cd6996da14273dc838c8]
 

Ordner: 0

(Keine schädliche Elemente erkannt)
 

Dateien: 4

PUP.Optional.Softonic.A, C:\Users\Neo\Downloads\SoftonicDownloader_fuer_usenext-by-tangysoft.exe, In Quarantäne, [c986d5660676da5cde5289b02fd2b050], 

PUP.Optional.SnapDo.A, C:\Windows\Installer\3f13e2a.msi, In Quarantäne, [a8a7093281fb290d4cd0d5c8d928ec14], 

PUP.Optional.SmartBar, C:\Windows\Installer\3f13e2f.msi, In Quarantäne, [f35cf843d2aa69cd0e45e974768ae917], 

PUP.Optional.SmartBar, C:\Windows\Installer\MSICE74.tmp, In Quarantäne, [07489c9f344877bf53fdc06e3ac6b64a], 
 

Physische Sektoren: 0

(Keine schädliche Elemente erkannt)
 
 

(end)

Nachsehen ob das Log noch da ist => C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt

die Logdatei ist nicht enthalten, aber der Quarantäneordner

also wenn es jetzt grad nicht passt, komme ich gern später nochmal vorbei

Dann poste mal was im Q-Ordner so drin ist.

BTW: beim nächsten Mal Anleitungen sorgfältiger lesen und umsetzen! Es war nämlich auch nirgends davon die Rede, gleich alle Funde von ESET entfernen/qurantänisieren zu lassen.

Code:

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\0F2D328D247CA15F94E213F9CE672C26CA38D1CB.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\0F2D328D247CA15F94E213F9CE672C26CA38D1CB.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\02EE6953C42E00D8537F9D4EE4FC17FBC585A977.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\02EE6953C42E00D8537F9D4EE4FC17FBC585A977.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\3E8819650A18C03766FC2E3BE41229F5A8714A2D.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\3E8819650A18C03766FC2E3BE41229F5A8714A2D.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\4B260C65E134BD727DCB64C6714E1FFB254CB530.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\4B260C65E134BD727DCB64C6714E1FFB254CB530.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\5EDE20FC0EA1624A137C1BF287B92652D9FA66E1.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\5EDE20FC0EA1624A137C1BF287B92652D9FA66E1.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\6BF3E641CE0003E395A0A0D98AFB3F025334F695.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\6BF3E641CE0003E395A0A0D98AFB3F025334F695.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8AB15733E80D0AE684F54EB075FC220DF1BD5721.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8AB15733E80D0AE684F54EB075FC220DF1BD5721.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8BC417D84335C8A2984292D841C3006F4AA33F19.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8BC417D84335C8A2984292D841C3006F4AA33F19.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9F0EA35160926E4942A6BC111D875996998C4FD6.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9F0EA35160926E4942A6BC111D875996998C4FD6.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\10F9842480E87690836752FCBA2B6E344D0E054D.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\10F9842480E87690836752FCBA2B6E344D0E054D.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\014F23F5E81D3CC85A71475CA1B02E8A3731FAAC.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\014F23F5E81D3CC85A71475CA1B02E8A3731FAAC.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\31CE21FE36C11E107A6E315EFE1875743809B4CC.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\31CE21FE36C11E107A6E315EFE1875743809B4CC.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36A651B5F6A5FB5D5A745EECCD12DEAEAB11AE8A.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36A651B5F6A5FB5D5A745EECCD12DEAEAB11AE8A.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36BCD3D0EE6EF331F04718C7CED07A334D81552D.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36BCD3D0EE6EF331F04718C7CED07A334D81552D.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\86FD2D88F3C4675471D14644D2A2D8A0B08BA2F4.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\86FD2D88F3C4675471D14644D2A2D8A0B08BA2F4.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\95D8C7F2851240F836D46EBD0DCB0BBAE3C9C3C8.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\95D8C7F2851240F836D46EBD0DCB0BBAE3C9C3C8.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\110D3E4159E6C7B402007177EE69E327FA0AC162.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\110D3E4159E6C7B402007177EE69E327FA0AC162.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\189FC4DEFBF3AF52775F7A922789A0CA6A8FF6F8.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\189FC4DEFBF3AF52775F7A922789A0CA6A8FF6F8.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\464FD963183897BB987030A2097E759ED613A79C.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\464FD963183897BB987030A2097E759ED613A79C.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8092C608B4E086365D99AC1EA8AF340C95A6B1B2.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8092C608B4E086365D99AC1EA8AF340C95A6B1B2.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8774AA195A698576B83AF82BE29B362AF8C0B512.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8774AA195A698576B83AF82BE29B362AF8C0B512.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9645D8A917BFFE50ED3F525480EFE951FDE8E146.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9645D8A917BFFE50ED3F525480EFE951FDE8E146.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\A277DF5632CC598D56A87ACEAC6E7C5FC07E3644.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\A277DF5632CC598D56A87ACEAC6E7C5FC07E3644.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\B310E48B006E13F32CF85BD62F52BB75F2A6C239.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\B310E48B006E13F32CF85BD62F52BB75F2A6C239.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\C1FE3F6968B84F8ACA156B5A6F421D9A09893B3F.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\C1FE3F6968B84F8ACA156B5A6F421D9A09893B3F.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\D1AC909FA3DA3ACE7120A10116A2172DE0FCA1ED.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\D1AC909FA3DA3ACE7120A10116A2172DE0FCA1ED.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E4D52A13B9D9F3D5BE0C4653857250D633223518.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E4D52A13B9D9F3D5BE0C4653857250D633223518.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E262DCB663133609DD976740F886911FD404FEE1.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E262DCB663133609DD976740F886911FD404FEE1.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\F94B61AC9BAA10B3CF6B6016E30DB718667FD14C.NDF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\F94B61AC9BAA10B3CF6B6016E30DB718667FD14C.NQF"

"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\INFO.NQI"

Bringt so nix...egal

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Erst einmal danke ich dir für deine umfangreiche Hilfe!
Hast du super gemacht, wenn ich eins hasse dann sind es Viren und Co, die ich nicht in den Griff bekomme. Es wird immer schlimmer.
Tatsächlich speicher ich keine Passwörter mehr auf dem Rechner und lasse den Firefox alles resetten bei Schließen. Mir ist zwar noch nie ernsthaft etwas passiert aber ich kenne einige, denen z.B. auch schon die Kreditkarte belastet wurde oder der Rechner hin war..

Eine Spende ist soeben rausgegangen ;-)

Zitat:

Tatsächlich speicher ich keine Passwörter mehr auf dem Rechner und lasse den Firefox alles resetten bei Schließen

Das ist eine durchaus gesunde Einstellung...du solltest dir Passwörter aber notieren, vernünftiger Notizblock, alles aufschreiben und/oder KeePass einsetzen

Dann wären wir durch! :daumenhoc

Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Es empfiehlt sich Malwarebytes Anti-Malware zu behalten und damit wöchentlich nach Malware zu scannen.

Helfen kann dir dabei delfix:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.