| Pacman27 | 01.02.2014 12:29 |
Hier schonmal das Malwarebytes Logfile Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org
Datenbank Version: v2014.02.01.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Hannes :: HANNES-VAIO [Administrator]
Schutz: Aktiviert
01.02.2014 11:38:51
mbam-log-2014-02-01 (11-38-51).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 216053
Laufzeit: 7 Minute(n), 45 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 1
C:\Users\Hannes\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Löschen bei Neustart.
Infizierte Registrierungsschlüssel: 6
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\InstalledBrowserExtensions\installdaddy (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NextLive (PUP.Optional.NextLive.A) -> Daten: C:\Windows\SysWOW64\rundll32.exe "C:\Users\Hannes\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 3
C:\Program Files (x86)\IminentToolbar (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hannes\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Löschen bei Neustart.
C:\Users\Hannes\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateien: 7
C:\Users\Hannes\Downloads\FreeYouTubeToMP3Converter31212.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hannes\Downloads\kitchen_2_664.exe (PUP.Optional.OneClickDownloader.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hannes\Downloads\RebeDee-Lace_Pearls_226.exe (PUP.Optional.OneClickDownloader.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hannes\AppData\Roaming\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} (PUP.Optional.Searchqu.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hannes\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Löschen bei Neustart.
C:\Users\Hannes\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Hannes\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
Die anderen folgen, Grüße
Hier die AdwCleaner Logdatei Code:
# AdwCleaner v3.018 - Bericht erstellt am 01/02/2014 um 12:03:28
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Hannes - HANNES-VAIO
# Gestartet von : C:\Users\Hannes\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Program Files (x86)\FTDownloader.com
Ordner Gelöscht : C:\Program Files (x86)\goforfiles
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\Hannes\AppData\Local\cool_mirage
Ordner Gelöscht : C:\Users\Hannes\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Hannes\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Hannes\AppData\LocalLow\Searchqutoolbar
Ordner Gelöscht : C:\Users\Hannes\AppData\Roaming\goforfiles
Ordner Gelöscht : C:\Users\Hannes\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FTDownloader.com
Ordner Gelöscht : C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default\Searchqutoolbar
Ordner Gelöscht : C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default\Extensions\toolbar@ask.com
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
Datei Gelöscht : C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default\searchplugins\iminent.xml
Datei Gelöscht : C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\GoforFilesUpdate
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "14352365320daa1f571acf18a81864a0");
*************************
AdwCleaner[R0].txt - [6092 octets] - [01/02/2014 12:02:20]
AdwCleaner[S0].txt - [5843 octets] - [01/02/2014 12:03:28]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5903 octets] ##########
Und der JRT Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Hannes on 01.02.2014 at 12:11:14,40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{31CED18A-BFAD-42D1-B950-91183EC646D6}
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\shoCA9E.tmp
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{0B6C4791-477A-45D8-81CC-5915FBD3E2C3}
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{1A49338F-3D10-4B65-946E-D49895E2DBF8}
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{26E0795B-F660-45D2-BBF8-39EE4C38B5A3}
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{6FEC42EB-7A0D-4275-8BD9-A71192B8100C}
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{7B6F936E-34D0-4462-967E-4A00D4631546}
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{836E5C98-4DBC-408D-A30F-99C3A72C6AAC}
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{9023BE23-DB5D-4D9E-A044-4154C0ADF7B1}
Successfully deleted: [Empty Folder] C:\Users\Hannes\appdata\local\{A2D54FD4-9E01-431E-A674-C48A11AC44D4}
~~~ FireFox
Successfully deleted: [Folder] C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\45dmze7u.default\extensions\cf7c3171-a228-46e6-872e-0ce5cd488f65@26856adc-3092-4439-91e4-b8f9b988d0d9.com
Successfully deleted the following from C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\45dmze7u.default\prefs.js
user_pref("extensions.iminent.admin", false);
user_pref("extensions.iminent.aflt", "orgnl");
user_pref("extensions.iminent.appId", "{0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}");
user_pref("extensions.iminent.autoRvrt", "false");
user_pref("extensions.iminent.dfltLng", "");
user_pref("extensions.iminent.excTlbr", false);
user_pref("extensions.iminent.ffxUnstlRst", false);
user_pref("extensions.iminent.id", "3239f2c70000000000009439e5b14765");
user_pref("extensions.iminent.instlDay", "16072");
user_pref("extensions.iminent.instlRef", "");
user_pref("extensions.iminent.newTab", false);
user_pref("extensions.iminent.prdct", "iminent");
user_pref("extensions.iminent.prtnrId", "iminent");
user_pref("extensions.iminent.rvrt", "false");
user_pref("extensions.iminent.smplGrp", "none");
user_pref("extensions.iminent.tlbrId", "YBCPCSTIPO");
user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");
user_pref("extensions.iminent.vrsn", "1.8.28.3");
user_pref("extensions.iminent.vrsnTs", "1.8.28.310:08:48");
user_pref("extensions.iminent.vrsni", "1.8.28.3");
user_pref("iminent.LayoutId", "1");
user_pref("iminent.adapters", "{\"ft-download\":{\"CountryCode\":\"DE\",\"NoAds\":false,\"Status\":2,\"expireTime\":\"1388653730014259200\"},\"iminent\":{\"CountryCode\":\"DE\
user_pref("iminent.enabledAds", "false");
user_pref("iminent.version", "7.51.3.1");
user_pref("iminent.versioning", "{\"CurrentVersion\":\"7.51.3.1\",\"InstallEventCTime\":1388653728483,\"InstallEvent\":\"True\"}");
Emptied folder: C:\Users\Hannes\AppData\Roaming\mozilla\firefox\profiles\45dmze7u.default\minidumps [394 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.02.2014 at 12:18:51,32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Noch ein neuer FRST
FRST Logfile:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 03
Ran by Hannes (administrator) on HANNES-VAIO on 01-02-2014 12:25:01
Running from C:\Users\Hannes\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Dropbox, Inc.) C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\Sony\VAIO Care\VCPerfService.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\Hannes\Desktop\FRST64(1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [518784 2011-03-29] (Conexant Systems, Inc.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [790688 2011-04-29] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [657568 2011-04-29] (Atheros Commnucations)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [226672 2011-02-17] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [2757312 2011-02-15] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-26] (Sony Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-12] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Hannes\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {5AF86F4A-6085-4290-A5BF-6530936890D5} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
SearchScopes: HKCU - {9F8DC443-4795-4816-A1C1-76BB32574993} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll No File
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Hannes\AppData\Roaming\Mozilla\Firefox\Profiles\45dmze7u.default
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-30] (Avira Operations GmbH & Co. KG)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-04-29] (Atheros)
S3 DCDhcpService; C:\Program Files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [104096 2011-07-19] (Atheros Communication Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.0.271\McCHSvc.exe [237328 2012-03-30] (McAfee, Inc.)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1368624 2013-08-01] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-01 12:25 - 2014-02-01 12:25 - 00015407 _____ () C:\Users\Hannes\Desktop\FRST.txt
2014-02-01 12:24 - 2014-02-01 12:24 - 02080256 _____ (Farbar) C:\Users\Hannes\Desktop\FRST64(1).exe
2014-02-01 12:18 - 2014-02-01 12:18 - 00003822 _____ () C:\Users\Hannes\Desktop\JRT.txt
2014-02-01 12:11 - 2014-02-01 12:11 - 00000000 ____D () C:\Windows\ERUNT
2014-02-01 12:10 - 2014-02-01 12:10 - 01037068 _____ (Thisisu) C:\Users\Hannes\Desktop\JRT.exe
2014-02-01 12:05 - 2014-02-01 12:05 - 00000000 ___RD () C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-02-01 12:02 - 2014-02-01 12:03 - 00000000 ____D () C:\AdwCleaner
2014-02-01 12:01 - 2014-02-01 12:01 - 01166132 _____ () C:\Users\Hannes\Desktop\adwcleaner.exe
2014-02-01 11:35 - 2014-02-01 11:35 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-01 11:35 - 2014-02-01 11:35 - 00000000 ____D () C:\Users\Hannes\AppData\Roaming\Malwarebytes
2014-02-01 11:35 - 2014-02-01 11:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-01 11:35 - 2014-02-01 11:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-01 11:35 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-01 11:33 - 2014-02-01 11:34 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannes\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-31 12:43 - 2014-01-31 12:43 - 00100162 _____ () C:\ComboFix.txt
2014-01-31 12:26 - 2014-01-31 12:43 - 00000000 ____D () C:\ComboFix
2014-01-31 12:24 - 2014-01-31 12:43 - 00000000 ____D () C:\Qoobox
2014-01-31 12:24 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-01-31 12:24 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-01-31 12:24 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-31 12:24 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-31 12:24 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-31 12:24 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-01-31 12:24 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-01-31 12:24 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-01-31 12:23 - 2014-01-31 12:41 - 00000000 ____D () C:\Windows\erdnt
2014-01-31 12:21 - 2014-01-31 12:21 - 05177551 ____R (Swearware) C:\Users\Hannes\Desktop\ComboFix.exe
2014-01-30 14:03 - 2014-01-30 14:04 - 00034638 _____ () C:\Users\Hannes\Downloads\Addition.txt
2014-01-30 14:02 - 2014-02-01 12:25 - 00000000 ____D () C:\FRST
2014-01-30 14:02 - 2014-01-30 14:04 - 00028581 _____ () C:\Users\Hannes\Downloads\FRST.txt
2014-01-30 14:01 - 2014-01-30 14:01 - 02079744 _____ (Farbar) C:\Users\Hannes\Downloads\FRST64.exe
2014-01-23 23:48 - 2014-01-24 22:30 - 00000000 ____D () C:\Users\Hannes\Desktop\Mond
2014-01-21 00:14 - 2004-03-16 12:00 - 58828524 _____ () C:\Users\Hannes\Desktop\Dazwischen 200114.WAV
2014-01-20 23:38 - 2004-03-16 12:00 - 41875756 _____ () C:\Users\Hannes\Desktop\Matilda 200114.WAV
2014-01-20 23:21 - 2004-03-16 12:00 - 50222124 _____ () C:\Users\Hannes\Desktop\Funkloch 200114.WAV
2014-01-20 18:17 - 2014-01-20 17:42 - 63139737 _____ () C:\Users\Hannes\Desktop\KopfhörerrausdasistKlausurrelevant_ep7_A1355CDUCDUK06.aax
2014-01-19 02:20 - 2014-01-18 23:07 - 100486455 _____ () C:\Users\Hannes\Desktop\Full Set 18.01.14.m4a
2014-01-15 10:26 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:26 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:26 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:26 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:26 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:26 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:26 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:26 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:26 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-08 17:38 - 2014-01-08 17:38 - 00000000 ____D () C:\Users\Hannes\Desktop\Rehan Songs
2014-01-06 22:24 - 2014-01-06 22:24 - 00005830 _____ () C:\Users\Hannes\Downloads\Re_Kracht-Referat Rezensieren am 10_11.1.zip
2014-01-02 10:11 - 2014-01-02 10:19 - 00000000 ____D () C:\Users\Hannes\AppData\Local\Mobogenie
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\Documents\Mobogenie
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\AppData\Local\genienext
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\AppData\Local\cache
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\.android
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 _____ () C:\Users\Hannes\daemonprocess.txt
2014-01-02 10:10 - 2014-01-02 10:10 - 00000000 ____D () C:\Users\Hannes\AppData\Local\BeamriseUninstall
2014-01-02 10:08 - 2014-02-01 12:05 - 00001334 _____ () C:\Windows\Tasks\FTdownloader V6.0-updater.job
2014-01-02 10:08 - 2014-01-02 10:28 - 00004364 _____ () C:\Windows\System32\Tasks\FTdownloader V6.0-updater
2014-01-02 10:07 - 2014-02-01 12:05 - 00002138 _____ () C:\Windows\Tasks\FTdownloader V6.0-firefoxinstaller.job
2014-01-02 10:07 - 2014-01-02 10:08 - 00000000 ____D () C:\Program Files (x86)\FTdownloader V6.0
==================== One Month Modified Files and Folders =======
2014-02-01 12:25 - 2014-02-01 12:25 - 00015407 _____ () C:\Users\Hannes\Desktop\FRST.txt
2014-02-01 12:25 - 2014-01-30 14:02 - 00000000 ____D () C:\FRST
2014-02-01 12:24 - 2014-02-01 12:24 - 02080256 _____ (Farbar) C:\Users\Hannes\Desktop\FRST64(1).exe
2014-02-01 12:20 - 2013-01-19 09:38 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-01 12:18 - 2014-02-01 12:18 - 00003822 _____ () C:\Users\Hannes\Desktop\JRT.txt
2014-02-01 12:13 - 2009-07-14 05:45 - 00020928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-01 12:13 - 2009-07-14 05:45 - 00020928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-01 12:11 - 2014-02-01 12:11 - 00000000 ____D () C:\Windows\ERUNT
2014-02-01 12:10 - 2014-02-01 12:10 - 01037068 _____ (Thisisu) C:\Users\Hannes\Desktop\JRT.exe
2014-02-01 12:10 - 2012-01-16 13:15 - 02076375 _____ () C:\Windows\WindowsUpdate.log
2014-02-01 12:05 - 2014-02-01 12:05 - 00000000 ___RD () C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2014-02-01 12:05 - 2014-01-02 10:08 - 00001334 _____ () C:\Windows\Tasks\FTdownloader V6.0-updater.job
2014-02-01 12:05 - 2014-01-02 10:07 - 00002138 _____ () C:\Windows\Tasks\FTdownloader V6.0-firefoxinstaller.job
2014-02-01 12:05 - 2012-01-31 14:30 - 00000000 ___RD () C:\Users\Hannes\Dropbox
2014-02-01 12:05 - 2012-01-31 14:28 - 00000000 ____D () C:\Users\Hannes\AppData\Roaming\Dropbox
2014-02-01 12:04 - 2011-09-06 04:40 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-01 12:04 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-01 12:04 - 2009-07-14 05:51 - 00137476 _____ () C:\Windows\setupact.log
2014-02-01 12:03 - 2014-02-01 12:02 - 00000000 ____D () C:\AdwCleaner
2014-02-01 12:01 - 2014-02-01 12:01 - 01166132 _____ () C:\Users\Hannes\Desktop\adwcleaner.exe
2014-02-01 11:54 - 2010-11-21 04:47 - 00322810 _____ () C:\Windows\PFRO.log
2014-02-01 11:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-01 11:35 - 2014-02-01 11:35 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-01 11:35 - 2014-02-01 11:35 - 00000000 ____D () C:\Users\Hannes\AppData\Roaming\Malwarebytes
2014-02-01 11:35 - 2014-02-01 11:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-01 11:35 - 2014-02-01 11:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-01 11:34 - 2014-02-01 11:33 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannes\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-31 23:18 - 2012-01-16 14:35 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{71451E4B-A621-45D6-AF39-4F4B7545F0D6}
2014-01-31 23:05 - 2012-05-17 18:03 - 00000000 ____D () C:\Users\Hannes\AppData\Local\CrashDumps
2014-01-31 12:43 - 2014-01-31 12:43 - 00100162 _____ () C:\ComboFix.txt
2014-01-31 12:43 - 2014-01-31 12:26 - 00000000 ____D () C:\ComboFix
2014-01-31 12:43 - 2014-01-31 12:24 - 00000000 ____D () C:\Qoobox
2014-01-31 12:41 - 2014-01-31 12:23 - 00000000 ____D () C:\Windows\erdnt
2014-01-31 12:39 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-01-31 12:21 - 2014-01-31 12:21 - 05177551 ____R (Swearware) C:\Users\Hannes\Desktop\ComboFix.exe
2014-01-30 14:04 - 2014-01-30 14:03 - 00034638 _____ () C:\Users\Hannes\Downloads\Addition.txt
2014-01-30 14:04 - 2014-01-30 14:02 - 00028581 _____ () C:\Users\Hannes\Downloads\FRST.txt
2014-01-30 14:01 - 2014-01-30 14:01 - 02079744 _____ (Farbar) C:\Users\Hannes\Downloads\FRST64.exe
2014-01-30 11:35 - 2012-04-18 19:43 - 00000000 ____D () C:\Users\Hannes\Desktop\Uni
2014-01-29 22:34 - 2012-01-16 14:26 - 00000000 ____D () C:\Users\Hannes
2014-01-29 22:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-01-28 14:28 - 2013-12-04 21:59 - 00000000 ____D () C:\Users\Hannes\AppData\Roaming\Audacity
2014-01-28 14:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-01-24 22:30 - 2014-01-23 23:48 - 00000000 ____D () C:\Users\Hannes\Desktop\Mond
2014-01-23 23:50 - 2011-09-06 14:17 - 00697534 _____ () C:\Windows\system32\perfh007.dat
2014-01-23 23:50 - 2011-09-06 14:17 - 00148540 _____ () C:\Windows\system32\perfc007.dat
2014-01-23 23:50 - 2009-07-14 06:13 - 01614892 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-21 12:46 - 2012-01-16 14:30 - 00000000 ____D () C:\Users\Hannes\Documents\Bluetooth Folder
2014-01-20 17:42 - 2014-01-20 18:17 - 63139737 _____ () C:\Users\Hannes\Desktop\KopfhörerrausdasistKlausurrelevant_ep7_A1355CDUCDUK06.aax
2014-01-18 23:07 - 2014-01-19 02:20 - 100486455 _____ () C:\Users\Hannes\Desktop\Full Set 18.01.14.m4a
2014-01-16 11:10 - 2012-01-31 14:30 - 00001023 _____ () C:\Users\Hannes\Desktop\Dropbox.lnk
2014-01-16 11:10 - 2012-01-31 14:29 - 00000000 ____D () C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-16 11:10 - 2012-01-16 14:29 - 00000000 ___RD () C:\Users\Hannes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-16 11:07 - 2009-07-14 05:45 - 00442320 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 00:02 - 2009-07-14 03:34 - 00000499 _____ () C:\Windows\win.ini
2014-01-16 00:01 - 2013-08-14 23:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 23:59 - 2012-01-30 18:30 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-08 17:38 - 2014-01-08 17:38 - 00000000 ____D () C:\Users\Hannes\Desktop\Rehan Songs
2014-01-06 22:24 - 2014-01-06 22:24 - 00005830 _____ () C:\Users\Hannes\Downloads\Re_Kracht-Referat Rezensieren am 10_11.1.zip
2014-01-04 23:28 - 2012-01-16 23:15 - 00000000 ____D () C:\Users\Hannes\Desktop\Kartell und Sonstiges
2014-01-02 10:28 - 2014-01-02 10:08 - 00004364 _____ () C:\Windows\System32\Tasks\FTdownloader V6.0-updater
2014-01-02 10:19 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\AppData\Local\Mobogenie
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\Documents\Mobogenie
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\AppData\Local\genienext
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\AppData\Local\cache
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 ____D () C:\Users\Hannes\.android
2014-01-02 10:11 - 2014-01-02 10:11 - 00000000 _____ () C:\Users\Hannes\daemonprocess.txt
2014-01-02 10:10 - 2014-01-02 10:10 - 00000000 ____D () C:\Users\Hannes\AppData\Local\BeamriseUninstall
2014-01-02 10:08 - 2014-01-02 10:07 - 00000000 ____D () C:\Program Files (x86)\FTdownloader V6.0
Some content of TEMP:
====================
C:\Users\Hannes\AppData\Local\Temp\avgnt.exe
C:\Users\Hannes\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-19 02:41
==================== End Of Log ============================
--- --- ---
--- --- ---
--- --- ---
Das Problem mit der Werbung ist jetzt grade nicht mehr da (war aber in den letzten Tagen schon mehrfach kurzzeitig weg). Aber langsamer ist er glaub ich immernoch...
Grüße |
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
