Lästige Werbepopups wenn man mit der Maus über farbig unterstrichene Wörter fährt

Garfield- · 11.10.2013, 18:41

Hallo,

ist das eigentlich ein Virus? Ich habe seit einiger Zeit bei fast allen I-Net-Seiten die ich gerne besuche das Problem, dass viele Wörter farbig unterstrichen sind und sich wenn ich mit der Maus drüber fahre ein Werbepopup öffnet. Das nervt langsam tierisch.

Jetzt habe ich recherchiert und festgestellt, dass es sich um "Intellitxt" handeln könnte. Daraufhin habe ich versucht das irgendwie abzuschalten, aber bin damit kläglich gescheitert.

Ich verwende eigentlich Firefox 24.0. Sämtliche Erklärungen wie man "Intellitxt" durch deaktivieren von Javascript abschalten kann stimmen aber nicht. Die Beschriebenen Punkte gibt es in Firefox aber nicht. Habe darauf hin versucht das Ganze beim IE 10 zu deaktivieren und das hat funktioniert, hat aber als Nebenwirkung das viele I-Net-Seiten nur noch eingeschränkt nutzbar sind.

Darauf hin habe ich versucht AdBlock+ in Firefox 24.0 zu installieren was zwar funktioniert hat, aber leider nichts gebracht hat.

Alle Anleitungen die ich im gefunden Habe funktionieren nicht, da sie sich offfensichtlich auf ältere Versionen von Firefox beziehen.

Langsam bin ich ratlos und ziemlich frustriert.

Meine Softwarekonfiguration: Win 7 Home 32 Bit (autom. Aktualisierung); Firefox 24.0 (autom. Aktualisierung); Avira free (autom. Aktualisierung) und natürlich vieles mehr. Ich weiß nicht recht was noch wichtig ist.

Viele Grüße

Uwe

M-K-D-B · 11.10.2013, 21:21

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Garfield- · 11.10.2013, 21:43

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Papa (administrator) on TOWER-PAPA on 11-10-2013 22:35:33
Running from C:\Users\Papa\Downloads
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
(AMD) C:\Program Files\AMD\RAIDXpert\bin\RAIDXpert.exe
() C:\Megatech\MProtect\MPSERV.EXE
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(1und1 Mail und Media GmbH) C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(FNet Co., Ltd.) C:\Program Files\XFastUSB\XFastUsb.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(sw4you, Siegfried Weckmann) C:\Program Files\Hardcopy\hardcopy.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(AMD) C:\Windows\system32\WinMsgBalloonServer.exe
(AMD) C:\Windows\system32\WinMsgBalloonClient.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(RealNetworks, Inc.) C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [606208 2009-10-13] ()
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [LWS] - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [MailCheck IE Broker] - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-06-27] (1und1 Mail und Media GmbH)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [XFastUSB] - C:\Program Files\XFastUSB\XFastUsb.exe [5019360 2013-07-23] (FNet Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11992792 2013-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-03-09] (AMD)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [ASRockIES] - [x]
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-06-12] (Google Inc.)
MountPoints2: K - K:\LaunchU3.exe
MountPoints2: {c04974ed-e796-11de-ac53-806e6f6e6963} - D:\Autorun.exe
HKU\Administrator\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-06-12] (Google Inc.)
HKU\Administrator\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2011-03-09] (AMD)
HKU\Administrator\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)
HKU\Administrator\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-05-23] (Samsung)
HKU\Administrator\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Administrator\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-05-23] (Samsung)
HKU\Administrator\...\Run: [ASRockIES] - [x]
HKU\Gast\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-06-12] (Google Inc.)
HKU\Gast\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2011-03-09] (AMD)
HKU\Gast\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)
HKU\Gast\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-05-23] (Samsung)
HKU\Gast\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Gast\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-05-23] (Samsung)
HKU\Gast\...\Run: [ASRockIES] - [x]
HKU\Gast\...\RunOnce: [spchecker] - "C:\Program Files\AVG\AVG10\Notification\SPCheckerTE.exe"
AppInit_DLLs:   [ ] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2E4238DD797BCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: (No Name) - {78e516ef-11de-47a1-8364-a99b917ec5ee} -  No File
SearchScopes: HKLM - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: LyricsContainer - {77e880b5-cae7-4928-8507-ec2e5007e73e} - C:\Program Files\LyricsContainer\128.dll No File
BHO: Lyrics-Monkey - {8ebc4cf8-3ac2-498a-add4-39f3fb5d3fa1} - C:\Program Files\Lyrics_Monkey\128.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM -  No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} -  No File
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} -  No File
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU -WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKCU - No Name - {78E516EF-11DE-47A1-8364-A99B917EC5EE} -  No File
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: {631396C3-108B-46FE-9888-680694D242C6} hxxp://login.vivicom.de/Files/client/SHWebManager.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553530000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 32 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: SuchMaschine
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: SuchMaschine
FF Keyword.URL: hxxp://www.sm.de/?q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @protectdisc.com/NPPDLicenseHelper - C:\Program Files\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: LyricsContainer - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\128
FF Extension: No Name - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\49ef6b77-d546-42d3-a3a1-82912137df82@350ffb92-f05e-4412-b199-7a670953a747.com
FF Extension: toolbar - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\toolbar@web.de.xpi
FF Extension: No Name - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files\Lyrics_Monkey\128.xpi

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-03-28] (Advanced Micro Devices, Inc.)
R2 AMD_RAIDXpert; C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe [131320 2011-12-14] (AMD)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
S4 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
S4 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [44576 2010-02-03] (NOS Microsystems Ltd.)
R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()
S4 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277544 2009-01-19] (Protect Software GmbH)
R0 ahcix86s; C:\Windows\System32\DRIVERS\ahcix86s.sys [184120 2009-12-12] (Advanced Micro Devices, Inc)
R0 aic78xx; C:\Windows\System32\DRIVERS\aic78xx.sys [64000 2006-07-06] (Windows (R) Codename Longhorn DDK provider)
R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [33104 2012-08-09] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-12-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [101248 2011-03-07] (AVM Berlin)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-03-25] (Samsung Electronics Co., Ltd.)
S3 ENTECH; C:\Windows\system32\DRIVERS\ENTECH.sys [27672 2007-08-20] (EnTech Taiwan)
R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [686872 2011-07-09] (www.ext2fsd.com)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [29760 2013-10-01] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [14656 2013-07-23] (FNet Co., Ltd.)
S3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2008-01-19] (Microsoft Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-12-13] ()
S4 RsFx0105; C:\Windows\System32\DRIVERS\RsFx0105.sys [238696 2011-09-22] (Microsoft Corporation)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2011-08-08] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61696 2012-06-04] (Silicon Laboratories)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-07] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-08-13] (Samsung Electronics)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [121600 2013-08-09] (WinISO.com)
S3 amdiox86; system32\DRIVERS\amdiox86.sys [x]
S3 AODDriver4.0; \??\C:\Program Files\ATI\ATI.ACE\Fuel\i386\AODDriver2.sys [x]
S3 cpuz130; \??\C:\Users\Papa\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
S3 motccgp; system32\DRIVERS\motccgp.sys [x]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [x]
S3 MotDev; system32\DRIVERS\motodrv.sys [x]
S3 motmodem; system32\DRIVERS\motmodem.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-11 22:35 - 2013-10-11 22:35 - 00000000 ____D C:\FRST
2013-10-11 22:34 - 2013-10-11 22:34 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00753504 _____ C:\Users\Papa\Downloads\ZipExtractorSetup.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00001146 _____ C:\Users\Papa\Desktop\Continue Zip Extractor Installation.lnk
2013-10-11 18:50 - 2013-10-11 18:50 - 00597352 _____ C:\Users\Papa\Downloads\adblock-plus.exe
2013-10-11 18:50 - 2013-10-11 18:50 - 00001121 _____ C:\Users\Papa\Desktop\Die Installation von Adblock Plus für Firefox fortsetzen.lnk
2013-10-09 11:39 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-09 11:39 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-09 11:39 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-09 11:39 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-09 11:39 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-09 11:39 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-09 10:55 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 10:55 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 10:55 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 10:55 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-09 10:55 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 10:55 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 10:55 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 10:55 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 10:55 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 10:54 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 10:54 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 10:54 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 10:54 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 10:54 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 10:54 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 10:54 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 10:54 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 10:54 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 10:54 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 10:54 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 10:54 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 10:54 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 10:54 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 10:54 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 10:54 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 10:54 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 10:54 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-02 11:40 - 2013-10-02 11:40 - 01045226 _____ C:\Users\Papa\Downloads\adwcleaner_3.0.0.6.exe
2013-10-02 11:38 - 2013-10-02 11:38 - 00000000 ____D C:\Users\Papa\AppData\Roaming\vlc
2013-10-02 11:35 - 2013-10-02 11:36 - 25132744 _____ C:\Users\Papa\Downloads\vlc-2.1.0-win32.exe
2013-10-01 18:33 - 2013-10-01 18:33 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Papa\Downloads\Shockwave_Installer_Slim.exe
2013-10-01 18:29 - 2013-10-02 11:37 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-01 18:26 - 2013-10-01 18:27 - 22240760 _____ (Mozilla) C:\Users\Papa\Downloads\Firefox_23.0.1_german.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\ProgramData\Oracle
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-01 18:20 - 2013-10-01 18:19 - 00913832 _____ (Oracle Corporation) C:\Users\Papa\Downloads\jre-7u40-windows-i586-iftw.exe
2013-09-18 19:30 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-18 19:30 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-18 19:30 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-18 19:30 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-18 19:30 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-18 19:30 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-18 19:30 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

==================== One Month Modified Files and Folders =======

2013-10-11 22:35 - 2013-10-11 22:35 - 00000000 ____D C:\FRST
2013-10-11 22:34 - 2013-10-11 22:34 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00753504 _____ C:\Users\Papa\Downloads\ZipExtractorSetup.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00001146 _____ C:\Users\Papa\Desktop\Continue Zip Extractor Installation.lnk
2013-10-11 22:15 - 2012-12-20 12:46 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Skype
2013-10-11 22:03 - 2013-03-14 10:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-11 21:55 - 2009-12-14 19:26 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-11 19:52 - 2013-08-30 19:47 - 00001804 _____ C:\Windows\Tasks\Plus-HD-3.2-firefoxinstaller.job
2013-10-11 19:47 - 2013-08-30 19:47 - 00001880 _____ C:\Windows\Tasks\Plus-HD-3.2-chromeinstaller.job
2013-10-11 19:47 - 2013-08-30 19:47 - 00001184 _____ C:\Windows\Tasks\Plus-HD-3.2-codedownloader.job
2013-10-11 19:47 - 2013-08-30 19:47 - 00001180 _____ C:\Windows\Tasks\Plus-HD-3.2-updater.job
2013-10-11 19:47 - 2013-08-30 19:47 - 00001084 _____ C:\Windows\Tasks\Plus-HD-3.2-enabler.job
2013-10-11 18:50 - 2013-10-11 18:50 - 00597352 _____ C:\Users\Papa\Downloads\adblock-plus.exe
2013-10-11 18:50 - 2013-10-11 18:50 - 00001121 _____ C:\Users\Papa\Desktop\Die Installation von Adblock Plus für Firefox fortsetzen.lnk
2013-10-11 18:49 - 2009-12-13 05:30 - 01825569 _____ C:\Windows\WindowsUpdate.log
2013-10-11 16:55 - 2009-12-14 19:26 - 00001090 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-11 14:15 - 2009-07-14 06:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-11 14:15 - 2009-07-14 06:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-11 14:08 - 2009-07-14 06:39 - 00581231 _____ C:\Windows\setupact.log
2013-10-11 14:07 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-09 23:42 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-09 21:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-09 18:50 - 2009-12-12 22:31 - 00006682 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-09 18:43 - 2009-07-14 06:33 - 00357520 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 18:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-09 11:42 - 2013-07-13 20:36 - 00000000 ____D C:\Windows\system32\MRT
2013-10-09 11:40 - 2009-12-13 04:07 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 11:39 - 2010-09-12 17:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-08 23:03 - 2012-04-01 18:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-08 23:03 - 2011-05-14 10:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-06 11:54 - 2009-12-13 03:25 - 00206162 _____ C:\Windows\PFRO.log
2013-10-06 01:02 - 2012-10-11 10:03 - 00000000 ____D C:\Users\Papa\AppData\Local\Google
2013-10-02 23:59 - 2013-09-01 14:53 - 00000000 ____D C:\AdwCleaner
2013-10-02 11:40 - 2013-10-02 11:40 - 01045226 _____ C:\Users\Papa\Downloads\adwcleaner_3.0.0.6.exe
2013-10-02 11:38 - 2013-10-02 11:38 - 00000000 ____D C:\Users\Papa\AppData\Roaming\vlc
2013-10-02 11:37 - 2013-10-01 18:29 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-02 11:36 - 2013-10-02 11:35 - 25132744 _____ C:\Users\Papa\Downloads\vlc-2.1.0-win32.exe
2013-10-02 11:32 - 2012-06-19 20:06 - 00000000 ____D C:\Program Files\Microsoft SDKs
2013-10-02 11:02 - 2013-08-16 11:35 - 00000000 ____D C:\Users\Papa\AppData\Local\Akamai
2013-10-02 01:58 - 2013-08-12 19:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-02 01:54 - 2009-12-12 23:34 - 00000000 ____D C:\c
2013-10-01 18:33 - 2013-10-01 18:33 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Papa\Downloads\Shockwave_Installer_Slim.exe
2013-10-01 18:27 - 2013-10-01 18:26 - 22240760 _____ (Mozilla) C:\Users\Papa\Downloads\Firefox_23.0.1_german.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\ProgramData\Oracle
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-01 18:24 - 2012-06-23 21:50 - 00868264 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2013-10-01 18:24 - 2010-06-13 13:39 - 00790440 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-10-01 18:19 - 2013-10-01 18:20 - 00913832 _____ (Oracle Corporation) C:\Users\Papa\Downloads\jre-7u40-windows-i586-iftw.exe
2013-10-01 14:51 - 2013-08-12 19:06 - 00000000 ____D C:\Users\Papa\AppData\Local\Mozilla
2013-10-01 14:50 - 2013-09-01 01:03 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-01 14:41 - 2013-08-02 18:02 - 00029760 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2013-10-01 12:34 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-01 12:18 - 2013-08-07 11:13 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-23 01:28 - 2013-10-09 11:39 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:28 - 2013-10-09 11:39 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-09 11:39 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:27 - 2013-10-09 11:39 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-21 05:30 - 2013-10-09 11:39 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-09 11:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-14 02:48 - 2013-10-09 10:55 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

Files to move or delete:
====================
C:\Users\Papa\cnmss Canon Inkjet PIXMA iP4000R (Local).dll


Some content of TEMP:
====================
C:\Users\Papa\AppData\Local\Temp\avgnt.exe
C:\Users\Papa\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Papa\AppData\Local\Temp\ICReinstall_adblock-plus.exe
C:\Users\Papa\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Papa\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Papa\AppData\Local\Temp\sqlite3.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-10-11 14:59

==================== End Of Log ============================

--- --- ---

--- --- ---

Richtig so?

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Papa at 2013-10-11 22:36:32
Running from C:\Users\Papa\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7 Wonders of the Ancient World (Version: )
7-Zip 9.20
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.4.144)
AeroFly 5 (HKCU Version: 5.00.01.12)
AeroFly Professional Deluxe (HKCU Version: 1.11.0701)
aha² 1.00
Amazon MP3-Downloader 1.0.9
Amazonia
AMD Accelerated Video Transcoding (Version: 12.10.100.30328)
AMD APP SDK Runtime (Version: 2.4.595.9)
AMD Catalyst Install Manager (Version: 8.0.911.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Fuel (Version: 2013.0328.2218.38225)
AMD Media Foundation Decoders (Version: 1.0.80328.2203)
AMD Steady Video Plug-In  (Version: 2.04.0000)
AMD VISION Engine Control Center (Version: 2013.0328.2218.38225)
Anno 1404 (Version: 1.00.0000)
ANNO 1404 (Version: 1.03.0000)
Anno 1701 - Der Fluch des Drachen (Version: 2.03)
Anno 1701 (Version: 1.02)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ASRock App Charger v1.0.4
ASRock IES v2.0.84
ATI AVIVO Codecs (Version: 11.6.0.10308)
Avira Free Antivirus (Version: 14.0.0.383)
AVS Audio Converter version 6.1
AVS Audio Editor version 5.2
AVS Audio Recorder version 3.9
AVS Cover Editor 1.3.1.96 (AVS4YOU)
AVS Disc Creator version 3.5
AVS DVD Authoring
AVS DVD Copy version 4.1.2
AVS Media Player 3.1
AVS Registry Cleaner version 1.1
AVS Ringtone Maker version 1.6
AVS Screen Capture version 1.1.2
AVS System Info
AVS TV Recorder 2.1.2
AVS Update Manager 1.0 (Update Version)
AVS Video Converter 6
AVS Video Editor 6 (Version: 6.3.2.234)
AVS Video Recorder 2.5 (Version: 2.5.3.83)
AVS YouTube Uploader version 2.1
AVS4YOU Software Navigator 1.4
Azteca (VOLLVERSION)
Beetle Ju 2 (VOLLVERSION)
BOcncV2 (Version: 1.0.0)
CameraHelperMsi (Version: 13.51.815.0)
Canon IJ Network Tool
Canon Inkjet Printer Driver Add-On Module
Canon PIXMA iP4000R
Canon Utilities Easy-PhotoPrint EX
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version: 2013.0328.2218.38225)
Catalyst Control Center InstallProxy (Version: 2013.0328.2218.38225)
Catalyst Control Center Localization All (Version: 2013.0328.2218.38225)
CCC Help Chinese Standard (Version: 2013.0328.2217.38225)
CCC Help Chinese Traditional (Version: 2013.0328.2217.38225)
CCC Help Czech (Version: 2013.0328.2217.38225)
CCC Help Danish (Version: 2013.0328.2217.38225)
CCC Help Dutch (Version: 2013.0328.2217.38225)
CCC Help English (Version: 2013.0328.2217.38225)
CCC Help Finnish (Version: 2013.0328.2217.38225)
CCC Help French (Version: 2013.0328.2217.38225)
CCC Help German (Version: 2013.0328.2217.38225)
CCC Help Greek (Version: 2013.0328.2217.38225)
CCC Help Hungarian (Version: 2013.0328.2217.38225)
CCC Help Italian (Version: 2013.0328.2217.38225)
CCC Help Japanese (Version: 2013.0328.2217.38225)
CCC Help Korean (Version: 2013.0328.2217.38225)
CCC Help Norwegian (Version: 2013.0328.2217.38225)
CCC Help Polish (Version: 2013.0328.2217.38225)
CCC Help Portuguese (Version: 2013.0328.2217.38225)
CCC Help Russian (Version: 2013.0328.2217.38225)
CCC Help Spanish (Version: 2013.0328.2217.38225)
CCC Help Swedish (Version: 2013.0328.2217.38225)
CCC Help Thai (Version: 2013.0328.2217.38225)
CCC Help Turkish (Version: 2013.0328.2217.38225)
ccc-utility (Version: 2013.0328.2218.38225)
Cradle of Egypt
Cradle of Rome 2
D3DX10 (Version: 15.4.2368.0902)
DEUTSCHLAND SPIELT GAME CENTER
DIE SIEDLER - Aufstieg eines Königreichs (Version: 1.00.0000)
DIE SIEDLER - Das Erbe der Könige - Gold Edition (Version: 1.00.0000)
Die Siedler II - Die nächste Generation
DiRT 2
EditPlus 3
Entity Framework Designer für Visual Studio 2012 - DEU (Version: 11.1.20702.00)
Erforderliche Komponenten für SSDT  (Version: 11.0.2100.60)
erLT (Version: 1.20.138.34)
Ext2Fsd 0.51 (Version: 0.51)
freundin - Inca Pearls
FRITZ!Box-Fernzugang einrichten (Version: 1.0.3)
Galaxy Rebellion
getPlus(R) Download Manager for Corel (Version: 1.5.0.56)
Google Earth (Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4601.54)
Hardcopy (C:\Program Files\Hardcopy) (Version: 17.0.19)
Hotfix für Microsoft Visual Basic 2010 Express - DEU (KB2635973) (Version: 1)
HydraVision (Version: 4.2.188.0)
IIS 8.0 Express (Version: 8.0.1557)
IIS Express Application Compatibility Database for x86
iTunes (Version: 11.0.4.4)
Japanese Fonts Support For Adobe Reader X (Version: 10.0.0)
Java 7 Update 40 (Version: 7.0.400)
Java Auto Updater (Version: 2.1.9.8)
Junk Mail filter update (Version: 15.4.3502.0922)
Karthago
Land der Pharaonen
Licensing Service Install (Version: 2.0.1.181)
LinuxLive USB Creator (Version: 2.8)
Logitech Webcam-Software (Version: 2.51)
Luxor 5th Passage (Version: 1.1.0.0)
Luxor Amun Rising with Luxor (Version: )
LWS Facebook (Version: 13.50.854.0)
LWS Gallery (Version: 13.51.827.0)
LWS Help_main (Version: 13.51.828.0)
LWS Launcher (Version: 13.51.828.0)
LWS Motion Detection (Version: 13.51.815.0)
LWS Pictures And Video (Version: 13.51.815.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Webcam Software (Version: 13.51.815.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
Lyrics-Monkey
Mahjongg
Mahjongg - Ancient Mayas
MegaNC 3D 2012 
Microsoft .NET Framework 4 Multi-Targeting Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 3 - DEU (Version: 3.0.20105.0)
Microsoft ASP.NET MVC 3 (Version: 3.0.20105.0)
Microsoft ASP.NET Web Pages - DEU (Version: 1.0.20105.0)
Microsoft ASP.NET Web Pages (Version: 1.0.20105.0)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.88.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft Help Viewer 1.1 (Version: 1.1.40219)
Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219)
Microsoft Help Viewer 2.0 (Version: 2.0.50727)
Microsoft Help Viewer 2.0 Language Pack - DEU (Version: 2.0.50727)
Microsoft Lync 2010 Attendee (Version: 4.0.7577.4109)
Microsoft Office Access database engine 2007 (German) (Version: 12.0.6425.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Silverlight 4 SDK - Deutsch (Version: 4.0.60310.0)
Microsoft Silverlight 5 SDK - DEU (Version: 5.0.61118.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Common Files (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Services (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Native Client (Version: 10.3.5500.0)
Microsoft SQL Server 2008 R2 Management Objects (Version: 10.50.1750.9)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.3.5500.0)
Microsoft SQL Server 2012 Command Line Utilities  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Data-Tier App Framework  (Version: 11.0.2316.0)
Microsoft SQL Server 2012 Express LocalDB  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Native Client  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 T-SQL Language Service  (Version: 11.0.2100.60)
Microsoft SQL Server Compact 3.5 SP2 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Compact 4.0 SP1 DEU (Version: 4.0.8876.1)
Microsoft SQL Server Data Tools - DEU (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server System CLR Types (Version: 10.50.1750.9)
Microsoft SQL Server VSS Writer (Version: 10.3.5500.0)
Microsoft Visual Basic 2010 Express - DEU (Version: 10.0.40219)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (Version: 10.0.40219)
Microsoft Visual Studio 2010 Service Pack 1 (Version: 10.0.40219)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40303)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (Version: 10.0.40303)
Microsoft Web Deploy 3.0 (Version: 3.1236.1631)
Microsoft Web Deploy dbSqlPackage Provider - DEU (Version: 10.3.20225.0)
Microsoft-System-CLR-Typen für SQL Server 2012 (Version: 11.0.2100.60)
mirkes.de Tiny Hexer (Version: 1.8)
Moorhuhn X - XXL (Version: 1.01.0000)
MotoHelper MergeModules (Version: 1.2.0)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyFreeCodec
NAVIGON Fresh 3.4.1 (Version: 3.4.1)
Notepad++ (Version: 5.9.8)
OpenOffice.org 3.4.1 (Version: 3.41.9593)
Pacboy (Version: 1.00.0000)
PCMark Vantage (Version: 1.0.2.1)
PDFCreator (Version: 1.3.2)
PhoenixRC (Version: 3.00.18)
Plus-HD-3.2 (Version: 1.27.153.8)
Protect Disc License Helper 1.0.118 (Version: 1.0.118)
ProtectDisc Driver, Version 11 (Version: 11.0.0.12)
QuickTime (Version: 7.74.80.86)
RAIDXpert (Version: 3.3.1540.19)
RealDownloader (Version: 1.3.0)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0)
RealPlayer (Version: 16.0.0)
Realtek Ethernet Controller  Driver (Version: 1.00.0008)
Realtek High Definition Audio Driver (Version: 6.0.1.6953)
RealUpgrade 1.1 (Version: 1.1.0)
Romance of Rome
Samsung CLX-3170 Series
Samsung Kies (Version: 2.5.3.13052_10)
SAMSUNG Mobile Composite Device Software
Samsung Mobile phone USB driver Drive Software
Samsung PC Studio 3 (Version: 3.0.0.80601)
Samsung PC Studio 3 (Version: 3.2.2.80601)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.24.0)
Schatzinsel
Service Pack 3 für SQL Server 2008 (KB2546951) (Version: 10.3.5500.0)
Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (Version: 6.5.3)
Skype™ 6.6 (Version: 6.6.106)
SmarThru 4
SmarThru PC Fax
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0)
Steam (Version: 1.0.0.0)
swMSM (Version: 12.0.0.1)
SYBEX Spieltrieb TetriX 1  (Version: 1)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 2.00.0001)
TIPCI (Version: 2.00.0001)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (Version: 10.3.5500.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (Version: 1)
Video Downloader version 2.0 (Version: 2.0)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (Version: 4.0.8080.0)
VLC media player 2.1.0 (Version: 2.1.0)
WEB.DE MailCheck für Internet Explorer (Version: 2.3.0.1)
WEB.DE Softwareaktualisierung (Version: 3.0.0.54)
Win7codecs (Version: 2.3.3)
Windows 7 Upgrade Advisor (Version: 2.0.5000.0)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live OneCare safety scanner
Windows Live OneCare safety scanner (Version: 1.0.0.0)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WinISO (Version: 6.3.0.4969)
WinPC-NC Economy Demo (Version: 2.00)
WinRAR 4.11 (32-bit) (Version: 4.11.0)
XFastUSB (Version: 3.02.28)
XMedia Recode 3.0.8.5 (Version: 3.0.8.5)

==================== Restore Points  =========================

24-08-2013 20:02:51 Geplanter Prüfpunkt
26-08-2013 09:30:45 Wiederherstellungsvorgang
27-08-2013 07:53:32 Removed Bonjour
29-08-2013 09:36:34 Removed Microsoft Web Platform Installer 4.0
29-08-2013 11:26:30 Removed Update Manager for SweetPacks 1.1
18-09-2013 17:45:37 Windows Update
01-10-2013 14:42:18 Geplanter Prüfpunkt
01-10-2013 16:23:14 Installed Java 7 Update 40
02-10-2013 09:30:46 Removed WCF RIA Services V1.0 SP2
09-10-2013 09:37:57 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0BAF4384-F8E7-4BC8-AD4F-BC6E36EA3F61} - System32\Tasks\motorola software update => C:\Program Files\Motorola\Software Update\mumservice.exe
Task: {11FBE3C4-ACDF-4382-A8AB-67A234605D7D} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {130A8C2C-5D37-44C1-B5D2-3CCFCF2B6101} - System32\Tasks\Plus-HD-3.2-chromeinstaller => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-chromeinstaller.exe [2013-08-30] (Plus HD)
Task: {27C1933D-8049-4724-9FCB-C0A8E0730283} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {2B7FD384-D9C7-4B2D-9287-6076528A788E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {2C0303A6-57C5-4305-859D-9FD9E51E3E68} - System32\Tasks\Plus-HD-3.2-firefoxinstaller => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-firefoxinstaller.exe [2013-08-30] (Plus HD)
Task: {340ED7E6-1B25-4260-AD3A-ACB2DC310042} - System32\Tasks\Plus-HD-3.2-updater => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-updater.exe [2013-08-30] (Plus HD)
Task: {4F2E86C2-92DC-4434-A618-36B8CB482E51} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => c:\program files\real\realplayer\Update\realsched.exe [2013-02-28] (RealNetworks, Inc.)
Task: {54BFB583-7A86-4212-A63B-5C7BD56EE632} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {5A40A046-1405-4014-8A3C-B16D725AE17C} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {6D609A4F-E36E-4F8B-BDFC-28D3E721BEFE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-14] (Google Inc.)
Task: {7362A7E4-3723-4447-B7F3-C4D97B61B5E3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {75B603B6-DE5C-48D7-924D-E7BC7BFADDE1} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {8412AE68-7CF5-430C-B2D7-0FC6FE72B439} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-31] (Adobe Systems Incorporated)
Task: {98DD5A9E-75DB-4FBA-98DA-81528C90AD1C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-14] (Google Inc.)
Task: {C1C8674A-170F-4329-9BA1-E8A1A136794E} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {D4AD869A-14BA-4743-A301-02546CE04C76} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {ED903302-966A-4CC6-9433-8997D9E889B6} - System32\Tasks\Plus-HD-3.2-enabler => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-enabler.exe [2013-08-30] (Plus HD)
Task: {F33D6FBF-A863-4842-9236-11D32445F661} - System32\Tasks\Plus-HD-3.2-codedownloader => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-codedownloader.exe [2013-08-30] (Plus HD)
Task: {F50EBB68-F9CF-4226-8A4B-D9510FAF100F} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {FAEF476B-FDFC-4FD1-8234-777694CDB2C4} - System32\Tasks\Registration 1und1 Task => C:\Program Files\1und1Softwareaktualisierung\cdsupdclient.exe [2013-05-28] (1&1 Mail & Media GmbH)
Task: {FF4B012D-3307-48E9-B0AC-78A09B2391EB} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Plus-HD-3.2-chromeinstaller.job => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-chromeinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-3.2-codedownloader.job => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-codedownloader.exe
Task: C:\Windows\Tasks\Plus-HD-3.2-enabler.job => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-enabler.exe
Task: C:\Windows\Tasks\Plus-HD-3.2-firefoxinstaller.job => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-firefoxinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-3.2-updater.job => C:\Program Files\Plus-HD-3.2\Plus-HD-3.2-updater.exe

==================== Loaded Modules (whitelisted) =============

2010-02-22 20:48 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files\Hardcopy\HcDLL2_29_Win32.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 02145304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 07956504 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00342552 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00029208 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00128536 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2010-02-22 20:48 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files\Hardcopy\hardcopy_02.dll
2010-02-22 20:48 - 2009-12-10 08:50 - 00445952 _____ () C:\Program Files\Hardcopy\HcDllS.dll
2013-03-28 22:29 - 2013-03-28 22:29 - 00095232 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-09-01 01:03 - 2013-10-01 14:50 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-10-08 23:03 - 2013-10-08 23:03 - 16233864 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:99B2514F

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (10/09/2013 09:45:23 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002

Error: (10/09/2013 09:45:23 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002

Error: (10/09/2013 06:49:58 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (10/09/2013 06:49:58 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/09/2013 06:49:58 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/09/2013 11:43:54 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "ASP.NET" (ASP.NET). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (10/09/2013 11:43:54 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/09/2013 11:43:54 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (10/09/2013 11:43:53 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "aspnet_state" (ASP.NET-Zustandsdienst). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (10/09/2013 11:43:53 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (10/11/2013 02:09:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/11/2013 02:09:37 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht.

Error: (10/11/2013 02:07:58 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (10/11/2013 09:49:18 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (10/10/2013 05:08:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (10/10/2013 03:48:28 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004005

Error: (10/10/2013 03:48:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/10/2013 03:48:21 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht.

Error: (10/10/2013 03:46:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (10/10/2013 10:22:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (10/09/2013 09:45:23 PM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002 
Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91

Error: (10/09/2013 09:45:23 PM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 . Error code = 0x80070002 
Microsoft.SqlServer.Management.SmoMetadataProvider, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91

Error: (10/09/2013 06:49:58 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (10/09/2013 06:49:58 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/09/2013 06:49:58 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/09/2013 11:43:54 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: ASP.NETASP.NET8F20300004D070000

Error: (10/09/2013 11:43:54 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/09/2013 11:43:54 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (10/09/2013 11:43:53 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: aspnet_stateASP.NET-Zustandsdienst8F20300004D070000

Error: (10/09/2013 11:43:53 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


==================== Memory info =========================== 

Percentage of memory in use: 68%
Total physical RAM: 4095.24 MB
Available physical RAM: 1308.66 MB
Total Pagefile: 8188.77 MB
Available Pagefile: 4865.45 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.2 MB

==================== Drives ================================

Drive c: (WIndows 7 HDD) (Fixed) (Total:465.71 GB) (Free:156.79 GB) NTFS
Drive d: (Videoplatte) (Fixed) (Total:1863.01 GB) (Free:1862.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: AF890102)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 32F7D651)
Partition 1: (Active) - (Size=48 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

--- --- ---

M-K-D-B · 12.10.2013, 10:02

Servus,

ja, alles korrekt.

Schritt 1
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Schritt 2
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von ComboFix,
die Logdatei von AdwCleaner,
die Logdatei von JRT.

Garfield- · 12.10.2013, 12:28

Combofix Logfile:

Code:

ATTFilter

ComboFix 13-10-12.01 - Papa 12.10.2013  11:35:02.1.3 - x86
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4095.2666 [GMT 2:00]
ausgeführt von:: c:\users\Papa\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}




unkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows 7 Home Premium x86
Ran by Papa on 12.10.2013 at 12:51:43,75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1632185309-2399383750-939381153-1000\Software\SweetIM



~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-chromeinstaller
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-codedownloader
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-enabler
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-firefoxinstaller
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-updater
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-chromeinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-codedownloader.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-enabler.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-firefoxinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-updater.job
Successfully deleted: [File] "C:\Users\Papa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\startmenu\startfenster.lnk"
Successfully deleted: [File] "C:\Users\Papa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\taskbar\startfenster.lnk"



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{090C31DD-7A46-43D4-8303-44C7584778AE}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{3148BF99-10F7-4312-99E9-40C0DD19F1C1}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{3C93F562-7B75-44C2-987C-3ACBFF84AAE0}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{64071A7D-9E7B-446E-8C5A-FE8F8A2387C9}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{68F4FD99-221F-423C-BBE7-AA43A76A00A1}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{A2C7196A-EF31-4071-B381-B236ACABF9D0}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{B1038E93-D185-45EE-BD84-496ACB25A8AE}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{D88DED79-EC31-40C2-AD79-6DE008A6DD9E}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{E9605856-4499-45C9-809E-167A090F3029}



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [Folder] C:\Users\Papa\AppData\Roaming\mozilla\firefox\profiles\dfus4sez.default\extensions\49ef6b77-d546-42d3-a3a1-82912137df82@350ffb92-f05e-4412-b199-7a670953a747.com
Successfully deleted the following from C:\Users\Papa\AppData\Roaming\mozilla\firefox\profiles\dfus4sez.default\prefs.js

user_pref("extensions.a49ef6b77d54642d3a3a182912137df82350ffb92f05e4412b1997a670953a747com34330.34330.internaldb.cache/530e52021dc20843b1aa62957edeb9f8.value", "%22var%20adsDe
user_pref("extensions.a49ef6b77d54642d3a3a182912137df82350ffb92f05e4412b1997a670953a747com34330.34330.internaldb.cache/833447eaff04548ccb80787286a7cad9_DE.value", "%22var%20ca
Emptied folder: C:\Users\Papa\AppData\Roaming\mozilla\firefox\profiles\dfus4sez.default\minidumps [24 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.10.2013 at 12:54:43,86
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Papa\4.0
c:\windows\PFRO.log
c:\windows\system32\cnm243B.tmp
c:\windows\system32\cnm4A05.tmp
c:\windows\system32\cnm98C4.tmp
c:\windows\system32\cnmD312.tmp
c:\windows\system32\ntkrlICE.exe
c:\windows\system32\winio32.sys
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-09-12 bis 2013-10-12  ))))))))))))))))))))))))))))))
.
.
2013-10-12 09:44 . 2013-10-12 09:44	--------	d-----w-	c:\users\Papa\AppData\Local\temp
2013-10-12 09:44 . 2013-10-12 09:44	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-10-12 09:44 . 2013-10-12 09:44	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2013-10-11 20:35 . 2013-10-11 20:35	--------	d-----w-	C:\FRST
2013-10-09 08:55 . 2013-07-04 11:50	530432	----a-w-	c:\windows\system32\comctl32.dll
2013-10-09 08:54 . 2013-08-29 01:51	3914176	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-10-02 09:38 . 2013-10-02 09:38	--------	d-----w-	c:\users\Papa\AppData\Roaming\vlc
2013-10-01 16:24 . 2013-10-01 16:24	--------	d-----w-	c:\programdata\Oracle
2013-10-01 16:24 . 2013-10-01 16:24	--------	d-----w-	c:\program files\Common Files\Java
2013-10-01 16:24 . 2013-10-01 16:24	94632	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2013-09-26 18:00 . 2013-09-26 18:00	208760	----a-w-	c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-08 21:03 . 2012-04-01 16:18	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-10-08 21:03 . 2011-05-14 08:08	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-01 16:24 . 2012-06-23 19:50	868264	----a-w-	c:\windows\system32\npdeployJava1.dll
2013-10-01 16:24 . 2010-06-13 11:39	790440	----a-w-	c:\windows\system32\deployJava1.dll
2013-10-01 12:41 . 2013-08-02 16:02	29760	----a-w-	c:\windows\system32\drivers\FNETTBOH_305.SYS
2013-10-01 10:18 . 2013-08-07 09:13	67680	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-10-01 10:18 . 2013-08-07 09:09	89376	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-10-01 10:18 . 2013-08-07 09:09	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-10-01 10:18 . 2013-08-07 09:09	137208	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-09-01 08:59 . 2013-09-01 08:59	167344	----a-w-	c:\windows\system32\mfevtps.exe.5e5d.deleteme
2013-08-30 17:46 . 2013-08-30 17:49	1169609	----a-w-	c:\windows\unins000.exe
2013-08-09 11:00 . 2013-08-16 14:29	121600	----a-w-	c:\windows\system32\drivers\WinisoCDBus.sys
2013-08-01 01:08 . 2013-08-03 20:54	32328	----a-w-	c:\windows\Launcher.exe
2013-07-25 08:57 . 2013-08-14 09:54	1620992	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-23 14:13 . 2013-07-23 14:13	14656	----a-w-	c:\windows\system32\drivers\FNETURPX.SYS
2013-07-21 17:02 . 2013-07-21 17:02	53248	----a-r-	c:\users\Papa\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2013-07-19 01:41 . 2013-08-14 09:54	2048	----a-w-	c:\windows\system32\tzres.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"HydraVisionDesktopManager"="c:\program files\ATI Technologies\HydraVision\HydraDM.exe" [2011-03-08 393216]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-21 19875432]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-06-12 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 648072]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2009-10-13 606208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2012-09-12 204136]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"MailCheck IE Broker"="c:\program files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe" [2013-06-27 1519680]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-05-23 311152]
"XFastUSB"="c:\program files\XFastUSB\XFastUsb.exe" [2013-07-23 5019360]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2013-06-24 11992792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-28 642656]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-10-01 681032]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hardcopy.LNK - c:\program files\Hardcopy\hardcopy.exe [2010-2-22 1315840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^Papa^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Canon IJ Status Monitor Canon Inkjet PIXMA iP4000R.lnk]
path=c:\users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Canon IJ Status Monitor Canon Inkjet PIXMA iP4000R.lnk
backup=c:\windows\pss\Canon IJ Status Monitor Canon Inkjet PIXMA iP4000R.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-05-31 09:56	152392	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
2013-05-23 13:16	1561968	----a-w-	c:\program files\Samsung\Kies\Kies.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsgCenterExe]
2013-02-27 23:53	82632	----a-w-	c:\program files\Real\RealPlayer\Update\realonemessagecenter.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2013-05-01 01:59	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2013-02-27 23:53	295072	----a-w-	c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"mumservice"=c:\program files\Motorola\Software Update\mumservice.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" -osboot
.
R2 Megatech-Software-Protection;Megatech-Software-Protection;c:\megatech\MProtect\MPSERV.EXE [2007-12-12 36864]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-06-21 162408]
R3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
R3 AODDriver4.0;AODDriver4.0;c:\program files\ATI\ATI.ACE\Fuel\i386\AODDriver2.sys [x]
R3 cpuz130;cpuz130;c:\users\Papa\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2013-06-04 84248]
R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2013-10-01 29760]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2011-08-08 47176]
R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2012-06-04 61696]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2013-06-04 181912]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 usbrndis6;USB-RNDIS6-Adapter;c:\windows\system32\DRIVERS\usb80236.sys [2013-02-12 15872]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2013-10-01 1164360]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-21 47128]
R4 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 20992]
R4 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [2012-11-29 38608]
R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [2011-09-22 238696]
R4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-09-22 370024]
S0 AsrRamDisk;AsrRamDisk;c:\windows\system32\DRIVERS\AsrRamDisk.sys [2012-08-09 33104]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 13832]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-01 37352]
S1 Ext2Fsd;Linux ext2 file system driver; [x]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2013-07-23 14656]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2009-01-19 277544]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-03-29 219136]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-03-28 291840]
S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\bin\RAIDXpertService.exe [2011-12-14 131320]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-10-01 440392]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2012-04-09 48256]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2007-08-13 5120]
S2 WinisoCDBus;WinISO Virtual CD Drive;c:\windows\system32\drivers\WinisoCDBus.sys [2013-08-09 121600]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2013-02-14 79872]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [2011-03-07 101248]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2013-04-10 651848]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2012-08-28 45736]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
getPlusHelper	REG_MULTI_SZ   	getPlusHelper
nosGetPlusHelper	REG_MULTI_SZ   	nosGetPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 21:46]
.
2013-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-14 17:26]
.
2013-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-14 17:26]
.
2013-10-12 c:\windows\Tasks\Plus-HD-3.2-chromeinstaller.job
- c:\program files\Plus-HD-3.2\Plus-HD-3.2-chromeinstaller.exe [2013-08-30 17:47]
.
2013-10-12 c:\windows\Tasks\Plus-HD-3.2-codedownloader.job
- c:\program files\Plus-HD-3.2\Plus-HD-3.2-codedownloader.exe [2013-08-30 17:47]
.
2013-10-12 c:\windows\Tasks\Plus-HD-3.2-enabler.job
- c:\program files\Plus-HD-3.2\Plus-HD-3.2-enabler.exe [2013-08-30 17:47]
.
2013-10-12 c:\windows\Tasks\Plus-HD-3.2-firefoxinstaller.job
- c:\program files\Plus-HD-3.2\Plus-HD-3.2-firefoxinstaller.exe [2013-08-30 17:47]
.
2013-10-12 c:\windows\Tasks\Plus-HD-3.2-updater.job
- c:\program files\Plus-HD-3.2\Plus-HD-3.2-updater.exe [2013-08-30 17:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
IE: SmarThru4 Als HTML speichern - c:\program files\SmarThru 4\WebCapture.dll1.htm
IE: SmarThru4 Auswahl erfassen - c:\program files\SmarThru 4\WebCapture.dll2.htm
IE: SmarThru4 Capture Selection - c:\program files\SmarThru 4\WebCapture.dll2.htm
IE: SmarThru4 Markierten Text speichern - c:\program files\SmarThru 4\WebCapture.dll.htm
IE: SmarThru4 Save as HTML - c:\program files\SmarThru 4\WebCapture.dll1.htm
IE: SmarThru4 Save Selected Text - c:\program files\SmarThru 4\WebCapture.dll.htm
IE: SmarThru4 Web Capture - c:\program files\SmarThru 4\WebCapture.dll
IE: {{92808042-fb78-4fa0-bb4f-c9a95e0e9c10} - {ba696155-d96e-4281-b467-0367a0456474} -
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - c:\program files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll
DPF: {631396C3-108B-46FE-9888-680694D242C6} - hxxp://login.vivicom.de/Files/client/SHWebManager.cab
FF - ProfilePath - c:\users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\
FF - prefs.js: browser.search.selectedEngine - SuchMaschine
FF - prefs.js: keyword.URL - hxxp://www.sm.de/?q=
FF - ExtSQL: 2013-09-01 16:46; toolbar@web.de; c:\users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\extensions\toolbar@web.de.xpi
FF - ExtSQL: 2013-10-02 11:08; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{78e516ef-11de-47a1-8364-a99b917ec5ee} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{78E516EF-11DE-47A1-8364-A99B917EC5EE} - (no file)
HKCU-Run-ASRockIES - (no file)
MSConfigStartUp-Akamai NetSession Interface - c:\users\Papa\AppData\Local\Akamai\netsession_win.exe
MSConfigStartUp-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
AddRemove-lrcsmonkey@lrcsmonkey.net - c:\program files\Lyrics_Monkey\uninstall.exe
AddRemove-SAMSUNG Mobile Composite Device - c:\windows\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\program files\Silabs\MCU\DriverUninstall\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1632185309-2399383750-939381153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1632185309-2399383750-939381153-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-1632185309-2399383750-939381153-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:67,4b,51,f2,18,29,d7,8b,7b,f1,ee,39,fa,ac,a3,d5,1c,74,00,99,db,91,f5,
   02,b4,62,31,ef,ab,76,01,75,59,f2,86,82,d0,4e,ec,b7,20,23,a1,e4,cc,e7,eb,6f,\
"??"=hex:dc,7b,a3,4f,54,d8,7d,2e,ae,25,c8,f8,90,ff,fd,51
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-10-12  11:46:23
ComboFix-quarantined-files.txt  2013-10-12 09:46
.
Vor Suchlauf: 29 Verzeichnis(se), 169.492.725.760 Bytes frei
Nach Suchlauf: 36 Verzeichnis(se), 169.746.030.592 Bytes frei
.
- - End Of File - - 5D4B1027493635C5DD92EF2D88885E5C

--- --- ---
3E3318301A6E144EC408FD8DB50F51D4

Was bitte sind CODE-Tags?

Richtige Datei? ComboFix ist aber ohne die beschriebene (Fehler)Meldung nach dem Neustart durchgelaufen.
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.007 - Bericht erstellt am 12/10/2013 um 12:24:21
# Updated 09/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Papa - TOWER-PAPA
# Gestartet von : C:\Users\Papa\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\myfree codec
Ordner Gelöscht : C:\Program Files\myfree codec
Ordner Gelöscht : C:\Users\Papa\AppData\Roaming\pccustubinstaller
Ordner Gelöscht : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\128

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Mozilla Firefox v24.0 (de)

[ Datei : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.a49ef6b77d54642d3a3a182912137df82350ffb92f05e4412b1997a670953a747com34330.34330.internaldb.cache/5cdf8a7ef2ec84abac286c67587b78d9.value", "%22function%20tcmMarkWindow%28a%29%7Bva[...]

*************************

AdwCleaner[R0].txt - [22628 octets] - [01/09/2013 14:53:53]
AdwCleaner[R1].txt - [8338 octets] - [02/10/2013 01:55:08]
AdwCleaner[R2].txt - [1402 octets] - [02/10/2013 11:41:08]
AdwCleaner[R3].txt - [1376 octets] - [02/10/2013 23:59:04]
AdwCleaner[R4].txt - [3745 octets] - [12/10/2013 12:23:35]
AdwCleaner[S0].txt - [17021 octets] - [01/09/2013 15:33:18]
AdwCleaner[S1].txt - [8403 octets] - [02/10/2013 01:55:48]
AdwCleaner[S2].txt - [1443 octets] - [02/10/2013 11:41:55]
AdwCleaner[S3].txt - [3589 octets] - [12/10/2013 12:24:21]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [3649 octets] ##########

--- --- ---

unkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows 7 Home Premium x86
Ran by Papa on 12.10.2013 at 12:51:43,75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1632185309-2399383750-939381153-1000\Software\SweetIM

~~~ Files

Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-chromeinstaller
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-codedownloader
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-enabler
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-firefoxinstaller
Successfully deleted: [File] C:\Windows\System32\Tasks\Plus-HD-3.2-updater
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-chromeinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-codedownloader.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-enabler.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-firefoxinstaller.job
Successfully deleted: [File] C:\Windows\Tasks\Plus-HD-3.2-updater.job
Successfully deleted: [File] "C:\Users\Papa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\startmenu\startfenster.lnk"
Successfully deleted: [File] "C:\Users\Papa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user pinned\taskbar\startfenster.lnk"

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{090C31DD-7A46-43D4-8303-44C7584778AE}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{3148BF99-10F7-4312-99E9-40C0DD19F1C1}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{3C93F562-7B75-44C2-987C-3ACBFF84AAE0}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{64071A7D-9E7B-446E-8C5A-FE8F8A2387C9}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{68F4FD99-221F-423C-BBE7-AA43A76A00A1}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{A2C7196A-EF31-4071-B381-B236ACABF9D0}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{B1038E93-D185-45EE-BD84-496ACB25A8AE}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{D88DED79-EC31-40C2-AD79-6DE008A6DD9E}
Successfully deleted: [Empty Folder] C:\Users\Papa\appdata\local\{E9605856-4499-45C9-809E-167A090F3029}

~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [Folder] C:\Users\Papa\AppData\Roaming\mozilla\firefox\profiles\dfus4sez.default\extensions\49ef6b77-d546-42d3-a3a1-82912137df82@350ffb92-f05e-4412-b199-7a670953a747.com
Successfully deleted the following from C:\Users\Papa\AppData\Roaming\mozilla\firefox\profiles\dfus4sez.default\prefs.js

user_pref("extensions.a49ef6b77d54642d3a3a182912137df82350ffb92f05e4412b1997a670953a747com34330.34330.internaldb.cache/530e52021dc20843b1aa62957edeb9f8.value", "%22var%20adsDe
user_pref("extensions.a49ef6b77d54642d3a3a182912137df82350ffb92f05e4412b1997a670953a747com34330.34330.internaldb.cache/833447eaff04548ccb80787286a7cad9_DE.value", "%22var%20ca
Emptied folder: C:\Users\Papa\AppData\Roaming\mozilla\firefox\profiles\dfus4sez.default\minidumps [24 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12.10.2013 at 12:54:43,86
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Alles richtig?

Hallo,

habe wie gewünscht die drei Log-Files gepostet. Schaut im Moment sehr gut aus. Zumindest hier im Trojaner-Board und im Warbirdforum wo ich bisher war sind die Werbelinks weg.

Habt Ihr Ratschläge für mich wieich das in Zukunft verhindern kann respektive die Wahrscheinlichkeit herabsetzen kann?

Uwe

M-K-D-B · 13.10.2013, 11:49

Servus Uwe,

Zitat:

Zitat von Garfield-

Alles richtig?

Ja, du hast alles richtig gemacht.

Zitat:

Zitat von Garfield-

Habt Ihr Ratschläge für mich wieich das in Zukunft verhindern kann respektive die Wahrscheinlichkeit herabsetzen kann?

Klar, hab ich Tipps.

Die bekommst du am Ende der Bereinigung.

Bitte erst mal folgendes durchführen:

Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus.
Setze dazu eine Haken bei Addition.txt rechts unten und klicke auf Scan.
Es werden wieder zwei Logdateien erzeugt. Poste mir diese.

Garfield- · 13.10.2013, 16:20

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Papa (administrator) on TOWER-PAPA on 13-10-2013 17:14:07
Running from C:\Users\Papa\Downloads
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
(AMD) C:\Program Files\AMD\RAIDXpert\bin\RAIDXpert.exe
() C:\Megatech\MProtect\MPSERV.EXE
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(1und1 Mail und Media GmbH) C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(FNet Co., Ltd.) C:\Program Files\XFastUSB\XFastUsb.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(sw4you, Siegfried Weckmann) C:\Program Files\Hardcopy\hardcopy.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(AMD) C:\Windows\system32\WinMsgBalloonServer.exe
(AMD) C:\Windows\system32\WinMsgBalloonClient.exe
(RealNetworks, Inc.) C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Farbar) C:\Users\Papa\Downloads\FRST(1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [606208 2009-10-13] ()
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [LWS] - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [MailCheck IE Broker] - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-06-27] (1und1 Mail und Media GmbH)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [XFastUSB] - C:\Program Files\XFastUSB\XFastUsb.exe [5019360 2013-07-23] (FNet Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11992792 2013-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-03-09] (AMD)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-06-12] (Google Inc.)
HKU\Administrator\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-06-12] (Google Inc.)
HKU\Administrator\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2011-03-09] (AMD)
HKU\Administrator\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)
HKU\Administrator\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-05-23] (Samsung)
HKU\Administrator\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Administrator\...\Run: [] - C:\Windows\system32\External\FirmwareUpdate\KiesPDLR.exe
HKU\Administrator\...\Run: [ASRockIES] - [x]
HKU\Gast\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-06-12] (Google Inc.)
HKU\Gast\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2011-03-09] (AMD)
HKU\Gast\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)
HKU\Gast\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-05-23] (Samsung)
HKU\Gast\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Gast\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-05-23] (Samsung)
HKU\Gast\...\Run: [ASRockIES] - [x]
HKU\Gast\...\RunOnce: [spchecker] - "C:\Program Files\AVG\AVG10\Notification\SPCheckerTE.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2E4238DD797BCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: DealPly Shopping - {ae48ed75-5a56-4c5f-bbce-6f1ac3875f66} - C:\Program Files\DealPly\DealPlyIE.dll (DealPly)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU -WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: {631396C3-108B-46FE-9888-680694D242C6} hxxp://login.vivicom.de/Files/client/SHWebManager.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553530000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 32 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default
FF user.js: detected! => C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\user.js
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: SuchMaschine
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: SuchMaschine
FF Keyword.URL: hxxp://www.sm.de/?q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @protectdisc.com/NPPDLicenseHelper - C:\Program Files\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=3 - C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=9 - C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\ominent.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DealPly  Shopping - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f}
FF Extension: toolbar - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\toolbar@web.de.xpi
FF Extension: No Name - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files\Lyrics_Monkey\128.xpi

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-03-28] (Advanced Micro Devices, Inc.)
R2 AMD_RAIDXpert; C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe [131320 2011-12-14] (AMD)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
S4 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
S2 dealplylive; C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [148000 2013-10-13] (DealPly Technologies Ltd)
S3 dealplylivem; C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [148000 2013-10-13] (DealPly Technologies Ltd)
S4 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [44576 2010-02-03] (NOS Microsystems Ltd.)
R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()
S4 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277544 2009-01-19] (Protect Software GmbH)
R0 ahcix86s; C:\Windows\System32\DRIVERS\ahcix86s.sys [184120 2009-12-12] (Advanced Micro Devices, Inc)
R0 aic78xx; C:\Windows\System32\DRIVERS\aic78xx.sys [64000 2006-07-06] (Windows (R) Codename Longhorn DDK provider)
R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [33104 2012-08-09] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-12-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [101248 2011-03-07] (AVM Berlin)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-03-25] (Samsung Electronics Co., Ltd.)
S3 ENTECH; C:\Windows\system32\DRIVERS\ENTECH.sys [27672 2007-08-20] (EnTech Taiwan)
R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [686872 2011-07-09] (www.ext2fsd.com)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [29760 2013-10-01] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [14656 2013-07-23] (FNet Co., Ltd.)
S3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2008-01-19] (Microsoft Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-12-13] ()
S4 RsFx0105; C:\Windows\System32\DRIVERS\RsFx0105.sys [238696 2011-09-22] (Microsoft Corporation)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2011-08-08] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61696 2012-06-04] (Silicon Laboratories)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-07] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-08-13] (Samsung Electronics)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [121600 2013-08-09] (WinISO.com)
S3 amdiox86; system32\DRIVERS\amdiox86.sys [x]
S3 AODDriver4.0; \??\C:\Program Files\ATI\ATI.ACE\Fuel\i386\AODDriver2.sys [x]
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Papa\AppData\Local\Temp\catchme.sys [x]
S3 cpuz130; \??\C:\Users\Papa\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
S3 motccgp; system32\DRIVERS\motccgp.sys [x]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [x]
S3 MotDev; system32\DRIVERS\motodrv.sys [x]
S3 motmodem; system32\DRIVERS\motmodem.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-13 17:12 - 2013-10-13 17:12 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST(1).exe
2013-10-13 16:33 - 2013-10-13 15:30 - 03963352 _____ (Microsoft Corporation) C:\Windows\system32\ntkrlICE.exe
2013-10-13 15:06 - 2013-10-13 14:53 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlICE.exe
2013-10-13 15:06 - 2010-05-13 22:26 - 00237392 _____ (Microsoft Corporation) C:\Windows\system32\signtool.exe
2013-10-13 15:06 - 2010-05-13 22:26 - 00055632 _____ (Microsoft Corporation) C:\Windows\system32\makecert.exe
2013-10-13 14:28 - 2013-10-13 14:28 - 00000000 ____D C:\Program Files\Hex-Editor MX
2013-10-13 14:25 - 2013-10-13 14:25 - 00000042 _____ C:\user.js
2013-10-13 14:25 - 2013-10-13 14:25 - 00000000 ____D C:\Program Files\weDownload Ltd
2013-10-13 14:20 - 2013-10-13 14:20 - 00002319 _____ C:\Users\Public\Desktop\WinZip.lnk
2013-10-13 14:19 - 2013-10-13 14:27 - 00000000 ____D C:\ProgramData\WinZip
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Users\Papa\AppData\Local\WinZip
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Program Files\WinZip
2013-10-13 14:15 - 2013-10-13 17:01 - 00000886 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-10-13 14:15 - 2013-10-13 16:30 - 00000890 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-10-13 14:15 - 2013-10-13 16:25 - 00000286 _____ C:\Windows\Tasks\Dealply.job
2013-10-13 14:15 - 2013-10-13 14:26 - 00000000 ____D C:\Program Files\HHD Software
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Dealply
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Users\Papa\AppData\Local\DealPlyLive
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Program Files\DealPlyLive
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Program Files\DealPly
2013-10-13 14:13 - 2013-10-13 14:13 - 01116952 _____ C:\Users\Papa\Downloads\free hex editor setup.exe
2013-10-13 13:38 - 2013-10-13 13:38 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Avira
2013-10-13 13:36 - 2013-10-13 13:36 - 00000000 ____D C:\Users\Administrator\AppData\Local\Macromedia
2013-10-13 13:34 - 2013-10-13 13:35 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Mozilla
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\mirkes.de
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Local\Mozilla
2013-10-13 13:33 - 2013-10-13 13:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-10-13 12:24 - 2013-10-13 15:32 - 00000000 ___RD C:\4G patch
2013-10-13 12:24 - 2013-10-13 12:24 - 00000000 ____D C:\Neuer Ordner
2013-10-12 20:24 - 2013-10-12 20:24 - 00069632 ___SH C:\Users\Papa\Downloads\Thumbs.db
2013-10-12 19:55 - 2013-10-12 19:57 - 00000000 ____D C:\Program Files\GUMC37.tmp
2013-10-12 12:54 - 2013-10-12 12:54 - 00003798 _____ C:\Users\Papa\Desktop\JRT.txt
2013-10-12 12:44 - 2013-10-12 12:44 - 00000000 ____D C:\Windows\ERUNT
2013-10-12 12:43 - 2013-10-12 12:43 - 01032220 _____ (Thisisu) C:\Users\Papa\Desktop\JRT.exe
2013-10-12 12:37 - 2013-10-12 12:37 - 00003729 _____ C:\Users\Papa\Desktop\AdwCleaner[S3].txt
2013-10-12 12:05 - 2013-10-12 12:05 - 01048960 _____ C:\Users\Papa\Desktop\adwcleaner.exe
2013-10-12 11:57 - 2013-10-12 11:57 - 00000558 _____ C:\Windows\PFRO.log
2013-10-12 11:46 - 2013-10-12 11:46 - 00018616 _____ C:\ComboFix.txt
2013-10-12 11:32 - 2013-10-12 11:49 - 00000000 ____D C:\ComboFix
2013-10-12 11:32 - 2013-10-12 11:46 - 00000000 ____D C:\Qoobox
2013-10-12 11:32 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-12 11:32 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-12 11:32 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-12 11:31 - 2013-10-12 11:45 - 00000000 ____D C:\Windows\erdnt
2013-10-12 11:22 - 2013-10-12 11:22 - 05131958 ____R (Swearware) C:\Users\Papa\Desktop\ComboFix.exe
2013-10-12 09:38 - 2013-10-12 09:38 - 00001217 _____ C:\Users\Papa\Desktop\AVS Video Editor.lnk
2013-10-11 22:36 - 2013-10-11 22:37 - 00032289 _____ C:\Users\Papa\Downloads\Addition.txt
2013-10-11 22:35 - 2013-10-11 22:35 - 00000000 ____D C:\FRST
2013-10-11 22:34 - 2013-10-11 22:34 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00753504 _____ C:\Users\Papa\Downloads\ZipExtractorSetup.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00001146 _____ C:\Users\Papa\Desktop\Continue Zip Extractor Installation.lnk
2013-10-11 18:50 - 2013-10-11 18:50 - 00001121 _____ C:\Users\Papa\Desktop\Die Installation von Adblock Plus für Firefox fortsetzen.lnk
2013-10-09 11:39 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-09 11:39 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-09 11:39 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-09 11:39 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-09 11:39 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-09 11:39 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-09 10:55 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 10:55 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 10:55 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 10:55 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-09 10:55 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 10:55 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 10:55 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 10:55 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 10:55 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 10:54 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 10:54 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 10:54 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 10:54 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 10:54 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 10:54 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 10:54 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 10:54 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 10:54 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 10:54 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 10:54 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 10:54 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 10:54 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 10:54 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 10:54 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 10:54 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 10:54 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 10:54 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-02 11:40 - 2013-10-02 11:40 - 01045226 _____ C:\Users\Papa\Downloads\adwcleaner_3.0.0.6.exe
2013-10-02 11:38 - 2013-10-02 11:38 - 00000000 ____D C:\Users\Papa\AppData\Roaming\vlc
2013-10-02 11:35 - 2013-10-02 11:36 - 25132744 _____ C:\Users\Papa\Downloads\vlc-2.1.0-win32.exe
2013-10-01 18:33 - 2013-10-01 18:33 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Papa\Downloads\Shockwave_Installer_Slim.exe
2013-10-01 18:29 - 2013-10-02 11:37 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-01 18:26 - 2013-10-01 18:27 - 22240760 _____ (Mozilla) C:\Users\Papa\Downloads\Firefox_23.0.1_german.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\ProgramData\Oracle
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-01 18:20 - 2013-10-01 18:19 - 00913832 _____ (Oracle Corporation) C:\Users\Papa\Downloads\jre-7u40-windows-i586-iftw.exe
2013-09-18 19:30 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-18 19:30 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-18 19:30 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-18 19:30 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-18 19:30 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-18 19:30 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-18 19:30 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

==================== One Month Modified Files and Folders =======

2013-10-13 17:15 - 2012-12-20 12:46 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Skype
2013-10-13 17:12 - 2013-10-13 17:12 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST(1).exe
2013-10-13 17:08 - 2009-07-14 06:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-13 17:08 - 2009-07-14 06:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-13 17:04 - 2009-12-13 05:30 - 01916504 _____ C:\Windows\WindowsUpdate.log
2013-10-13 17:03 - 2013-03-14 10:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-13 17:01 - 2013-10-13 14:15 - 00000886 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2013-10-13 17:01 - 2009-12-14 19:26 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-13 17:01 - 2009-12-14 19:26 - 00001090 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-13 17:00 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-13 17:00 - 2009-07-14 06:39 - 00582631 _____ C:\Windows\setupact.log
2013-10-13 16:30 - 2013-10-13 14:15 - 00000890 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-10-13 16:25 - 2013-10-13 14:15 - 00000286 _____ C:\Windows\Tasks\Dealply.job
2013-10-13 15:39 - 2013-07-13 21:19 - 00000000 _____ C:\ProgramData\LauncherAccess.dt
2013-10-13 15:32 - 2013-10-13 12:24 - 00000000 ___RD C:\4G patch
2013-10-13 15:30 - 2013-10-13 16:33 - 03963352 _____ (Microsoft Corporation) C:\Windows\system32\ntkrlICE.exe
2013-10-13 15:13 - 2009-12-12 22:31 - 00000000 ___RD C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-10-13 14:53 - 2013-10-13 15:06 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlICE.exe
2013-10-13 14:28 - 2013-10-13 14:28 - 00000000 ____D C:\Program Files\Hex-Editor MX
2013-10-13 14:27 - 2013-10-13 14:19 - 00000000 ____D C:\ProgramData\WinZip
2013-10-13 14:26 - 2013-10-13 14:15 - 00000000 ____D C:\Program Files\HHD Software
2013-10-13 14:25 - 2013-10-13 14:25 - 00000042 _____ C:\user.js
2013-10-13 14:25 - 2013-10-13 14:25 - 00000000 ____D C:\Program Files\weDownload Ltd
2013-10-13 14:20 - 2013-10-13 14:20 - 00002319 _____ C:\Users\Public\Desktop\WinZip.lnk
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Users\Papa\AppData\Local\WinZip
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Program Files\WinZip
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Dealply
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Users\Papa\AppData\Local\DealPlyLive
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Program Files\DealPlyLive
2013-10-13 14:15 - 2013-10-13 14:15 - 00000000 ____D C:\Program Files\DealPly
2013-10-13 14:15 - 2012-10-11 10:03 - 00000000 ____D C:\Users\Papa\AppData\Local\Google
2013-10-13 14:13 - 2013-10-13 14:13 - 01116952 _____ C:\Users\Papa\Downloads\free hex editor setup.exe
2013-10-13 13:38 - 2013-10-13 13:38 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Avira
2013-10-13 13:36 - 2013-10-13 13:36 - 00000000 ____D C:\Users\Administrator\AppData\Local\Macromedia
2013-10-13 13:35 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Mozilla
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\mirkes.de
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Local\Mozilla
2013-10-13 13:33 - 2013-10-13 13:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-10-13 13:33 - 2013-01-11 02:34 - 00084640 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-13 13:24 - 2013-01-07 00:27 - 00000000 ____D C:\Users\Papa\AppData\Roaming\EditPlus 3
2013-10-13 13:23 - 2009-12-12 23:34 - 00000000 ____D C:\a
2013-10-13 12:24 - 2013-10-13 12:24 - 00000000 ____D C:\Neuer Ordner
2013-10-12 21:22 - 2009-12-12 23:34 - 00000000 ____D C:\c
2013-10-12 20:24 - 2013-10-12 20:24 - 00069632 ___SH C:\Users\Papa\Downloads\Thumbs.db
2013-10-12 19:57 - 2013-10-12 19:55 - 00000000 ____D C:\Program Files\GUMC37.tmp
2013-10-12 13:04 - 2013-09-01 14:53 - 00000000 ____D C:\AdwCleaner
2013-10-12 12:54 - 2013-10-12 12:54 - 00003798 _____ C:\Users\Papa\Desktop\JRT.txt
2013-10-12 12:44 - 2013-10-12 12:44 - 00000000 ____D C:\Windows\ERUNT
2013-10-12 12:43 - 2013-10-12 12:43 - 01032220 _____ (Thisisu) C:\Users\Papa\Desktop\JRT.exe
2013-10-12 12:37 - 2013-10-12 12:37 - 00003729 _____ C:\Users\Papa\Desktop\AdwCleaner[S3].txt
2013-10-12 12:05 - 2013-10-12 12:05 - 01048960 _____ C:\Users\Papa\Desktop\adwcleaner.exe
2013-10-12 11:57 - 2013-10-12 11:57 - 00000558 _____ C:\Windows\PFRO.log
2013-10-12 11:49 - 2013-10-12 11:32 - 00000000 ____D C:\ComboFix
2013-10-12 11:46 - 2013-10-12 11:46 - 00018616 _____ C:\ComboFix.txt
2013-10-12 11:46 - 2013-10-12 11:32 - 00000000 ____D C:\Qoobox
2013-10-12 11:46 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-10-12 11:45 - 2013-10-12 11:31 - 00000000 ____D C:\Windows\erdnt
2013-10-12 11:44 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-12 11:43 - 2009-12-12 22:31 - 00000000 ____D C:\Users\Papa
2013-10-12 11:22 - 2013-10-12 11:22 - 05131958 ____R (Swearware) C:\Users\Papa\Desktop\ComboFix.exe
2013-10-12 09:39 - 2010-02-13 02:14 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
2013-10-12 09:39 - 2009-12-13 21:17 - 00000000 ____D C:\Program Files\AVS4YOU
2013-10-12 09:38 - 2013-10-12 09:38 - 00001217 _____ C:\Users\Papa\Desktop\AVS Video Editor.lnk
2013-10-11 22:37 - 2013-10-11 22:36 - 00032289 _____ C:\Users\Papa\Downloads\Addition.txt
2013-10-11 22:35 - 2013-10-11 22:35 - 00000000 ____D C:\FRST
2013-10-11 22:34 - 2013-10-11 22:34 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00753504 _____ C:\Users\Papa\Downloads\ZipExtractorSetup.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00001146 _____ C:\Users\Papa\Desktop\Continue Zip Extractor Installation.lnk
2013-10-11 18:50 - 2013-10-11 18:50 - 00001121 _____ C:\Users\Papa\Desktop\Die Installation von Adblock Plus für Firefox fortsetzen.lnk
2013-10-09 23:42 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-09 21:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-09 18:50 - 2009-12-12 22:31 - 00006682 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-09 18:43 - 2009-07-14 06:33 - 00357520 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 18:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-09 11:42 - 2013-07-13 20:36 - 00000000 ____D C:\Windows\system32\MRT
2013-10-09 11:40 - 2009-12-13 04:07 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 11:39 - 2010-09-12 17:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-08 23:03 - 2012-04-01 18:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-08 23:03 - 2011-05-14 10:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-02 11:40 - 2013-10-02 11:40 - 01045226 _____ C:\Users\Papa\Downloads\adwcleaner_3.0.0.6.exe
2013-10-02 11:38 - 2013-10-02 11:38 - 00000000 ____D C:\Users\Papa\AppData\Roaming\vlc
2013-10-02 11:37 - 2013-10-01 18:29 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-02 11:36 - 2013-10-02 11:35 - 25132744 _____ C:\Users\Papa\Downloads\vlc-2.1.0-win32.exe
2013-10-02 11:32 - 2012-06-19 20:06 - 00000000 ____D C:\Program Files\Microsoft SDKs
2013-10-02 11:02 - 2013-08-16 11:35 - 00000000 ____D C:\Users\Papa\AppData\Local\Akamai
2013-10-02 01:58 - 2013-08-12 19:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-01 18:33 - 2013-10-01 18:33 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Papa\Downloads\Shockwave_Installer_Slim.exe
2013-10-01 18:27 - 2013-10-01 18:26 - 22240760 _____ (Mozilla) C:\Users\Papa\Downloads\Firefox_23.0.1_german.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\ProgramData\Oracle
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-01 18:24 - 2012-06-23 21:50 - 00868264 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2013-10-01 18:24 - 2010-06-13 13:39 - 00790440 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-10-01 18:19 - 2013-10-01 18:20 - 00913832 _____ (Oracle Corporation) C:\Users\Papa\Downloads\jre-7u40-windows-i586-iftw.exe
2013-10-01 14:51 - 2013-08-12 19:06 - 00000000 ____D C:\Users\Papa\AppData\Local\Mozilla
2013-10-01 14:50 - 2013-09-01 01:03 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-01 14:41 - 2013-08-02 18:02 - 00029760 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2013-10-01 12:34 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-01 12:18 - 2013-08-07 11:13 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-23 01:28 - 2013-10-09 11:39 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:28 - 2013-10-09 11:39 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-09 11:39 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:27 - 2013-10-09 11:39 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-21 05:30 - 2013-10-09 11:39 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-09 11:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-14 02:48 - 2013-10-09 10:55 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

Files to move or delete:
====================
C:\Users\Papa\cnmss Canon Inkjet PIXMA iP4000R (Local).dll


Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\temp\avgnt.exe
C:\Users\Papa\AppData\Local\temp\avgnt.exe
C:\Users\Papa\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-10-11 14:59

==================== End Of Log ============================

--- --- ---

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Papa at 2013-10-13 17:15:13
Running from C:\Users\Papa\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7 Wonders of the Ancient World (Version: )
7-Zip 9.20
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.4.144)
AeroFly 5 (HKCU Version: 5.00.01.12)
AeroFly Professional Deluxe (HKCU Version: 1.11.0701)
aha² 1.00
Amazon MP3-Downloader 1.0.9
Amazonia
AMD Accelerated Video Transcoding (Version: 12.10.100.30328)
AMD APP SDK Runtime (Version: 2.4.595.9)
AMD Catalyst Install Manager (Version: 8.0.911.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Fuel (Version: 2013.0328.2218.38225)
AMD Media Foundation Decoders (Version: 1.0.80328.2203)
AMD Steady Video Plug-In (Version: 2.04.0000)
AMD VISION Engine Control Center (Version: 2013.0328.2218.38225)
Anno 1404 (Version: 1.00.0000)
ANNO 1404 (Version: 1.03.0000)
Anno 1701 - Der Fluch des Drachen (Version: 2.03)
Anno 1701 (Version: 1.02)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ASRock App Charger v1.0.4
ASRock IES v2.0.84
ATI AVIVO Codecs (Version: 11.6.0.10308)
Avira Free Antivirus (Version: 14.0.0.383)
AVS Audio Converter version 6.1
AVS Audio Editor version 5.2
AVS Audio Recorder version 3.9
AVS Cover Editor 1.3.1.96 (AVS4YOU)
AVS Disc Creator version 3.5
AVS DVD Authoring
AVS DVD Copy version 4.1.2
AVS Media Player 3.1
AVS Registry Cleaner version 1.1
AVS Ringtone Maker version 1.6
AVS Screen Capture version 1.1.2
AVS System Info
AVS TV Recorder 2.1.2
AVS Update Manager 1.0 (Update Version)
AVS Video Converter 6
AVS Video Editor 6 (Version: 6.4.2.241)
AVS Video Recorder 2.5 (Version: 2.5.6.87)
AVS YouTube Uploader version 2.1
AVS4YOU Software Navigator 1.4
Azteca (VOLLVERSION)
Beetle Ju 2 (VOLLVERSION)
BOcncV2 (Version: 1.0.0)
CameraHelperMsi (Version: 13.51.815.0)
Canon IJ Network Tool
Canon Inkjet Printer Driver Add-On Module
Canon PIXMA iP4000R
Canon Utilities Easy-PhotoPrint EX
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version: 2013.0328.2218.38225)
Catalyst Control Center InstallProxy (Version: 2013.0328.2218.38225)
Catalyst Control Center Localization All (Version: 2013.0328.2218.38225)
CCC Help Chinese Standard (Version: 2013.0328.2217.38225)
CCC Help Chinese Traditional (Version: 2013.0328.2217.38225)
CCC Help Czech (Version: 2013.0328.2217.38225)
CCC Help Danish (Version: 2013.0328.2217.38225)
CCC Help Dutch (Version: 2013.0328.2217.38225)
CCC Help English (Version: 2013.0328.2217.38225)
CCC Help Finnish (Version: 2013.0328.2217.38225)
CCC Help French (Version: 2013.0328.2217.38225)
CCC Help German (Version: 2013.0328.2217.38225)
CCC Help Greek (Version: 2013.0328.2217.38225)
CCC Help Hungarian (Version: 2013.0328.2217.38225)
CCC Help Italian (Version: 2013.0328.2217.38225)
CCC Help Japanese (Version: 2013.0328.2217.38225)
CCC Help Korean (Version: 2013.0328.2217.38225)
CCC Help Norwegian (Version: 2013.0328.2217.38225)
CCC Help Polish (Version: 2013.0328.2217.38225)
CCC Help Portuguese (Version: 2013.0328.2217.38225)
CCC Help Russian (Version: 2013.0328.2217.38225)
CCC Help Spanish (Version: 2013.0328.2217.38225)
CCC Help Swedish (Version: 2013.0328.2217.38225)
CCC Help Thai (Version: 2013.0328.2217.38225)
CCC Help Turkish (Version: 2013.0328.2217.38225)
ccc-utility (Version: 2013.0328.2218.38225)
Cradle of Egypt
Cradle of Rome 2
D3DX10 (Version: 15.4.2368.0902)
DealPly (remove only) (Version: 4.8.7.2)
DEUTSCHLAND SPIELT GAME CENTER
DIE SIEDLER - Aufstieg eines Königreichs (Version: 1.00.0000)
DIE SIEDLER - Das Erbe der Könige - Gold Edition (Version: 1.00.0000)
Die Siedler II - Die nächste Generation
DiRT 2
EditPlus 3
Entity Framework Designer für Visual Studio 2012 - DEU (Version: 11.1.20702.00)
Erforderliche Komponenten für SSDT (Version: 11.0.2100.60)
erLT (Version: 1.20.138.34)
Ext2Fsd 0.51 (Version: 0.51)
freundin - Inca Pearls
FRITZ!Box-Fernzugang einrichten (Version: 1.0.3)
Galaxy Rebellion
getPlus(R) Download Manager for Corel (Version: 1.5.0.56)
Google Earth (Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4601.54)
Google Update Helper (Version: 1.3.21.165)
Hardcopy (C:\Program Files\Hardcopy) (Version: 17.0.19)
Hex-Editor MX (Version: 6.0)
Hotfix für Microsoft Visual Basic 2010 Express - DEU (KB2635973) (Version: 1)
HydraVision (Version: 4.2.188.0)
IIS 8.0 Express (Version: 8.0.1557)
IIS Express Application Compatibility Database for x86
iTunes (Version: 11.0.4.4)
Japanese Fonts Support For Adobe Reader X (Version: 10.0.0)
Java 7 Update 40 (Version: 7.0.400)
Java Auto Updater (Version: 2.1.9.8)
Junk Mail filter update (Version: 15.4.3502.0922)
Karthago
Land der Pharaonen
Licensing Service Install (Version: 2.0.1.181)
LinuxLive USB Creator (Version: 2.8)
Logitech Webcam-Software (Version: 2.51)
Luxor 5th Passage (Version: 1.1.0.0)
Luxor Amun Rising with Luxor (Version: )
LWS Facebook (Version: 13.50.854.0)
LWS Gallery (Version: 13.51.827.0)
LWS Help_main (Version: 13.51.828.0)
LWS Launcher (Version: 13.51.828.0)
LWS Motion Detection (Version: 13.51.815.0)
LWS Pictures And Video (Version: 13.51.815.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Webcam Software (Version: 13.51.815.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
Mahjongg
Mahjongg - Ancient Mayas
MegaNC 3D 2012
Microsoft .NET Framework 4 Multi-Targeting Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 3 - DEU (Version: 3.0.20105.0)
Microsoft ASP.NET MVC 3 (Version: 3.0.20105.0)
Microsoft ASP.NET Web Pages - DEU (Version: 1.0.20105.0)
Microsoft ASP.NET Web Pages (Version: 1.0.20105.0)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.88.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft Help Viewer 1.1 (Version: 1.1.40219)
Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219)
Microsoft Help Viewer 2.0 (Version: 2.0.50727)
Microsoft Help Viewer 2.0 Language Pack - DEU (Version: 2.0.50727)
Microsoft Lync 2010 Attendee (Version: 4.0.7577.4109)
Microsoft Office Access database engine 2007 (German) (Version: 12.0.6425.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Silverlight 4 SDK - Deutsch (Version: 4.0.60310.0)
Microsoft Silverlight 5 SDK - DEU (Version: 5.0.61118.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Common Files (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Services (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Native Client (Version: 10.3.5500.0)
Microsoft SQL Server 2008 R2 Management Objects (Version: 10.50.1750.9)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.3.5500.0)
Microsoft SQL Server 2012 Command Line Utilities (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Data-Tier App Framework (Version: 11.0.2316.0)
Microsoft SQL Server 2012 Express LocalDB (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Native Client (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL Compiler Service (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL ScriptDom (Version: 11.0.2100.60)
Microsoft SQL Server 2012 T-SQL Language Service (Version: 11.0.2100.60)
Microsoft SQL Server Compact 3.5 SP2 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Compact 4.0 SP1 DEU (Version: 4.0.8876.1)
Microsoft SQL Server Data Tools - DEU (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server System CLR Types (Version: 10.50.1750.9)
Microsoft SQL Server VSS Writer (Version: 10.3.5500.0)
Microsoft Visual Basic 2010 Express - DEU (Version: 10.0.40219)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (Version: 10.0.40219)
Microsoft Visual Studio 2010 Service Pack 1 (Version: 10.0.40219)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40303)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (Version: 10.0.40303)
Microsoft Web Deploy 3.0 (Version: 3.1236.1631)
Microsoft Web Deploy dbSqlPackage Provider - DEU (Version: 10.3.20225.0)
Microsoft-System-CLR-Typen für SQL Server 2012 (Version: 11.0.2100.60)
mirkes.de Tiny Hexer (Version: 1.8)
Moorhuhn X - XXL (Version: 1.01.0000)
MotoHelper MergeModules (Version: 1.2.0)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyFreeCodec
NAVIGON Fresh 3.4.1 (Version: 3.4.1)
Notepad++ (Version: 5.9.8)
Ominent toolbar (Version: 1.8.25.6)
OpenOffice.org 3.4.1 (Version: 3.41.9593)
Pacboy (Version: 1.00.0000)
PCMark Vantage (Version: 1.0.2.1)
PDFCreator (Version: 1.3.2)
PhoenixRC (Version: 3.00.18)
Plus-HD-3.2 (Version: 1.27.153.8)
Protect Disc License Helper 1.0.118 (Version: 1.0.118)
ProtectDisc Driver, Version 11 (Version: 11.0.0.12)
QuickTime (Version: 7.74.80.86)
RAIDXpert (Version: 3.3.1540.19)
RealDownloader (Version: 1.3.0)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0)
RealPlayer (Version: 16.0.0)
Realtek Ethernet Controller Driver (Version: 1.00.0008)
Realtek High Definition Audio Driver (Version: 6.0.1.6953)
RealUpgrade 1.1 (Version: 1.1.0)
Romance of Rome
Samsung CLX-3170 Series
Samsung Kies (Version: 2.5.3.13052_10)
Samsung Mobile phone USB driver Drive Software
Samsung PC Studio 3 (Version: 3.0.0.80601)
Samsung PC Studio 3 (Version: 3.2.2.80601)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.24.0)
Schatzinsel
Service Pack 3 für SQL Server 2008 (KB2546951) (Version: 10.3.5500.0)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (Version: 6.5.3)
Skype™ 6.6 (Version: 6.6.106)
SmarThru 4
SmarThru PC Fax
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0)
Steam (Version: 1.0.0.0)
swMSM (Version: 12.0.0.1)
SYBEX Spieltrieb TetriX 1 (Version: 1)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 2.00.0001)
TIPCI (Version: 2.00.0001)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup (Version: 10.3.5500.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (Version: 1)
Video Downloader version 2.0 (Version: 2.0)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (Version: 4.0.8080.0)
VLC media player 2.1.0 (Version: 2.1.0)
WEB.DE MailCheck für Internet Explorer (Version: 2.3.0.1)
WEB.DE Softwareaktualisierung (Version: 3.0.0.54)
Win7codecs (Version: 2.3.3)
Windows 7 Upgrade Advisor (Version: 2.0.5000.0)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live OneCare safety scanner
Windows Live OneCare safety scanner (Version: 1.0.0.0)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WinISO (Version: 6.3.0.4969)
WinPC-NC Economy Demo (Version: 2.00)
WinRAR 4.11 (32-bit) (Version: 4.11.0)
WinZip 17.5 (Version: 17.5.10480)
XFastUSB (Version: 3.02.28)
XMedia Recode 3.0.8.5 (Version: 3.0.8.5)

==================== Restore Points =========================

26-08-2013 09:30:45 Wiederherstellungsvorgang
27-08-2013 07:53:32 Removed Bonjour
29-08-2013 09:36:34 Removed Microsoft Web Platform Installer 4.0
29-08-2013 11:26:30 Removed Update Manager for SweetPacks 1.1
18-09-2013 17:45:37 Windows Update
01-10-2013 14:42:18 Geplanter Prüfpunkt
01-10-2013 16:23:14 Installed Java 7 Update 40
02-10-2013 09:30:46 Removed WCF RIA Services V1.0 SP2
09-10-2013 09:37:57 Windows Update
12-10-2013 09:32:26 ComboFix created restore point
12-10-2013 11:21:55 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2013-10-12 11:44 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0A97BFED-B81E-4E9D-B92F-DC46225295C0} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {0BAF4384-F8E7-4BC8-AD4F-BC6E36EA3F61} - System32\Tasks\motorola software update => C:\Program Files\Motorola\Software Update\mumservice.exe
Task: {11FBE3C4-ACDF-4382-A8AB-67A234605D7D} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2B7FD384-D9C7-4B2D-9287-6076528A788E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {2C04A722-B4A7-4D1C-897D-BDA582D80DAE} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {4F2E86C2-92DC-4434-A618-36B8CB482E51} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => c:\program files\real\realplayer\Update\realsched.exe [2013-02-28] (RealNetworks, Inc.)
Task: {4F9FFEF3-BD02-4A1B-A0C1-B814218F421A} - System32\Tasks\DealPlyLiveUpdateTaskMachineCore => C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [2013-10-13] (DealPly Technologies Ltd)
Task: {5A40A046-1405-4014-8A3C-B16D725AE17C} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {613692F6-4970-4C0E-864D-BBBC7DBF8BC2} - System32\Tasks\DealPlyLiveUpdateTaskMachineUA => C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [2013-10-13] (DealPly Technologies Ltd)
Task: {6D609A4F-E36E-4F8B-BDFC-28D3E721BEFE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-14] (Google Inc.)
Task: {7362A7E4-3723-4447-B7F3-C4D97B61B5E3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {75B603B6-DE5C-48D7-924D-E7BC7BFADDE1} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {8412AE68-7CF5-430C-B2D7-0FC6FE72B439} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-31] (Adobe Systems Incorporated)
Task: {98DD5A9E-75DB-4FBA-98DA-81528C90AD1C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-14] (Google Inc.)
Task: {A7738A5F-3DEC-47D9-96D6-E7C0001B3AF4} - System32\Tasks\Dealply => C:\Users\Papa\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE [2013-10-13] ()
Task: {C1C8674A-170F-4329-9BA1-E8A1A136794E} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {D4AD869A-14BA-4743-A301-02546CE04C76} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {F50EBB68-F9CF-4226-8A4B-D9510FAF100F} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {FAEF476B-FDFC-4FD1-8234-777694CDB2C4} - System32\Tasks\Registration 1und1 Task => C:\Program Files\1und1Softwareaktualisierung\cdsupdclient.exe [2013-05-28] (1&1 Mail & Media GmbH)
Task: {FF4B012D-3307-48E9-B0AC-78A09B2391EB} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Dealply.job => C:\Users\Papa\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job => C:\Program Files\DealPlyLive\Update\DealPlyLive.exe
Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job => C:\Program Files\DealPlyLive\Update\DealPlyLive.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-02-22 20:48 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files\Hardcopy\HcDLL2_29_Win32.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 02145304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 07956504 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00342552 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00029208 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00128536 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2010-02-22 20:48 - 2009-12-10 08:50 - 00445952 _____ () C:\Program Files\Hardcopy\HcDllS.dll
2010-02-22 20:48 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files\Hardcopy\hardcopy_02.dll
2013-03-28 22:29 - 2013-03-28 22:29 - 00095232 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-09-01 01:03 - 2013-10-01 14:50 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-10-08 23:03 - 2013-10-08 23:03 - 16233864 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:99B2514F

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service:
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.

==================== Event log errors: =========================

Application errors:
==================
Error: (10/13/2013 03:37:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/13/2013 02:25:17 PM) (Source: MsiInstaller) (User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi

Error: (10/13/2013 02:15:40 PM) (Source: MsiInstaller) (User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi

System errors:
=============
Error: (10/13/2013 05:01:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20

Error: (10/13/2013 04:58:03 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (10/13/2013 04:49:19 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20

Error: (10/13/2013 04:04:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20

Error: (10/13/2013 03:24:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20

Error: (10/13/2013 01:13:51 PM) (Source: DCOM) (User: )
Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (10/13/2013 01:13:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (10/13/2013 01:13:51 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (10/13/2013 01:12:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20

Error: (10/13/2013 11:12:34 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20

Microsoft Office Sessions:
=========================
Error: (10/13/2013 03:37:45 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (10/13/2013 02:25:17 PM) (Source: MsiInstaller)(User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/13/2013 02:15:40 PM) (Source: MsiInstaller)(User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi(NULL)(NULL)(NULL)(NULL)(NULL)

==================== Memory info ===========================

Percentage of memory in use: 40%
Total physical RAM: 4095.24 MB
Available physical RAM: 2430.73 MB
Total Pagefile: 8188.77 MB
Available Pagefile: 6091.57 MB
Total Virtual: 2047.88 MB
Available Virtual: 1914.54 MB

==================== Drives ================================

Drive c: (WIndows 7 HDD) (Fixed) (Total:465.71 GB) (Free:157.25 GB) NTFS
Drive d: (Videoplatte) (Fixed) (Total:1863.01 GB) (Free:1862.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: AF890102)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 32F7D651)
Partition 1: (Active) - (Size=48 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Richtig so?

M-K-D-B · 13.10.2013, 19:46

Servus,

du hast dir seit meiner letzten Antwort wieder lästige Software (Adware) auf den Rechner geholt. So werden wir nie fertig.

Bitte installiere nichts mehr auf deinem Rechner, bis wir hier fertig sind.

Schritt 1
AdwCleaner bitte erneut ausführen, auf "Suchen" klicken. Nach Ablauf des Suchlaufs auf "Löschen" klicken. Nach dem Neustart die Logdatei wieder posten.

Schritt 2
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
SearchScopes: HKLM - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: DealPly Shopping - {ae48ed75-5a56-4c5f-bbce-6f1ac3875f66} - C:\Program Files\DealPly\DealPlyIE.dll (DealPly)
C:\Program Files\DealPly
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: SuchMaschine
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: SuchMaschine
FF Keyword.URL: hxxp://www.sm.de/?q=
FF Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=3 - C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=9 - C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Extension: DealPly  Shopping - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f}
FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files\Lyrics_Monkey\128.xpi
C:\Program Files\Lyrics_Monkey
S2 dealplylive; C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [148000 2013-10-13] (DealPly Technologies Ltd)
S3 dealplylivem; C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [148000 2013-10-13] (DealPly Technologies Ltd)
C:\Program Files\DealPlyLive
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 3
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/

Bitte deaktiviere während des Scans alle Virenscanner, da sie das Ergebnis beeinflussen
Starte Zoek.exe mit einem Doppelklick.
Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und könnte andere Computer beschädigen.
Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
Code:
ATTFilter
```
FFdefaults;
CHRdefaults;
iedefaults;
emptyclsid;
autoclean;
         
```
Nun klicke auf "Run script" und sei geduldig bis das Skript durchläuft.
Wenn das Tool fertig ist wird sich Notepad mit dem Logfile öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:
Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken)

Schritt 4
Kontrollscan mit FRST
Führe wie zuvor beschrieben einen Scan mit FRST aus.
Setze dazu eine Haken bei Addition.txt rechts unten und klicke auf Scan.
Es werden wieder zwei Logdateien erzeugt. Poste mir diese.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei des FRST-Fix,
die Logdatei von Zoek,
die beiden neuen Logdateien von FRST.

Garfield- · 13.10.2013, 22:01

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.007 - Bericht erstellt am 13/10/2013 um 22:05:48
# Updated 09/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Papa - TOWER-PAPA
# Gestartet von : C:\Users\Papa\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : dealplylive
[#] Dienst Gelöscht : dealplylivem

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\DealPlyLive
Ordner Gelöscht : C:\Program Files\DealPly
Ordner Gelöscht : C:\Program Files\DealPlyLive
Ordner Gelöscht : C:\Users\Papa\AppData\Local\DealPlyLive
Ordner Gelöscht : C:\Users\Papa\AppData\Roaming\DealPly
Ordner Gelöscht : C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
Ordner Gelöscht : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{906000A4-88D9-4D52-B209-7A772970D91F}
Ordner Gelöscht : C:\Users\Papa\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf
Datei Gelöscht : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\user.js
Datei Gelöscht : C:\Windows\Tasks\Dealply.job
Datei Gelöscht : C:\Windows\System32\Tasks\Dealply
Datei Gelöscht : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
Datei Gelöscht : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dealply
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A7738A5F-3DEC-47D9-96D6-E7C0001B3AF4}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A7738A5F-3DEC-47D9-96D6-E7C0001B3AF4}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineCore
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4F9FFEF3-BD02-4A1B-A0C1-B814218F421A}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4F9FFEF3-BD02-4A1B-A0C1-B814218F421A}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{613692F6-4970-4C0E-864D-BBBC7DBF8BC2}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{613692F6-4970-4C0E-864D-BBBC7DBF8BC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\dealplylive.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.coreclass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclasssvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dealplylive.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKCU\Software\DealPly
Schlüssel Gelöscht : HKCU\Software\DealPlyLive
Schlüssel Gelöscht : HKLM\Software\DealPly
Schlüssel Gelöscht : HKLM\Software\DealPlyLive
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DealPly

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Mozilla Firefox v24.0 (de)

[ Datei : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\prefs.js ]


[ Datei : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\5slj8m3q.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [22628 octets] - [01/09/2013 14:53:53]
AdwCleaner[R1].txt - [8338 octets] - [02/10/2013 01:55:08]
AdwCleaner[R2].txt - [1402 octets] - [02/10/2013 11:41:08]
AdwCleaner[R3].txt - [1376 octets] - [02/10/2013 23:59:04]
AdwCleaner[R4].txt - [3745 octets] - [12/10/2013 12:23:35]
AdwCleaner[R5].txt - [9864 octets] - [13/10/2013 22:04:42]
AdwCleaner[S0].txt - [17021 octets] - [01/09/2013 15:33:18]
AdwCleaner[S1].txt - [8403 octets] - [02/10/2013 01:55:48]
AdwCleaner[S2].txt - [1443 octets] - [02/10/2013 11:41:55]
AdwCleaner[S3].txt - [3729 octets] - [12/10/2013 12:24:21]
AdwCleaner[S4].txt - [9931 octets] - [13/10/2013 22:05:48]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [9991 octets] ##########

--- --- ---

Garfield- · 13.10.2013, 23:02

...

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by Papa at 2013-10-13 23:27:23 Run:2
Running from C:\Users\Papa\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
SearchScopes: HKLM - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {EC365207-A8E0-4256-8058-AF6F5AA3ABC6} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: DealPly Shopping - {ae48ed75-5a56-4c5f-bbce-6f1ac3875f66} - C:\Program Files\DealPly\DealPlyIE.dll (DealPly)
C:\Program Files\DealPly
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: SuchMaschine
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: SuchMaschine
FF Keyword.URL: hxxp://www.sm.de/?q=
FF Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=3 - C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=9 - C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Extension: DealPly  Shopping - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f}
FF HKCU\...\Firefox\Extensions: [lrcsmonkey@lrcsmonkey.net] - C:\Program Files\Lyrics_Monkey\128.xpi
C:\Program Files\Lyrics_Monkey
S2 dealplylive; C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [148000 2013-10-13] (DealPly Technologies Ltd)
S3 dealplylivem; C:\Program Files\DealPlyLive\Update\DealPlyLive.exe [148000 2013-10-13] (DealPly Technologies Ltd)
C:\Program Files\DealPlyLive
end
*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EC365207-A8E0-4256-8058-AF6F5AA3ABC6} => Key not found.
HKCR\Wow6432Node\CLSID\{EC365207-A8E0-4256-8058-AF6F5AA3ABC6} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EC365207-A8E0-4256-8058-AF6F5AA3ABC6} => Key not found.
HKCR\Wow6432Node\CLSID\{EC365207-A8E0-4256-8058-AF6F5AA3ABC6} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae48ed75-5a56-4c5f-bbce-6f1ac3875f66} => Key not found.
HKCR\CLSID\{ae48ed75-5a56-4c5f-bbce-6f1ac3875f66} => Key not found.
"C:\Program Files\DealPly" => File/Directory not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value not found.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.
Firefox newtab deleted successfully.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox Keyword.URL deleted successfully.
HKLM\Software\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3 => Key not found.
C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll not found.
HKLM\Software\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9 => Key not found.
C:\Program Files\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll not found.
C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f} => not found.
HKCU\Software\Mozilla\Firefox\Extensions\\lrcsmonkey@lrcsmonkey.net => Value not found.
"C:\Program Files\Lyrics_Monkey" => File/Directory not found.
dealplylive => Service not found.
dealplylivem => Service not found.
"C:\Program Files\DealPlyLive" => File/Directory not found.

==== End of Fixlog ====

Code:

ATTFilter

Zoek.exe Version 4.0.0.5 Updated 13-October-2013
Tool run by Papa on 13.10.2013 at 23:30:50,86.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Papa\Desktop\zoek.exe [Script inserted] 

==== Older Logs ======================

C:\zoek-results2013-10-13-204808.log	20602 bytes

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\5slj8m3q.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\5slj8m3q.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\prefs.js:
user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{34712C68-7391-4c47-94F3-8F88D49AD632}"="C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext" [20.12.2012 11:57]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default
- RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
- WEB.DE MailCheck - %ProfilePath%\extensions\toolbar@web.de.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default
CFAF7B67C78D09D79688AEDCA3D090E2	- C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll -	Google Update
4BF70B35B943BD73BD6E13EB7C1BA4B3	- C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll -	Shockwave Flash
CA0E1DFBE480CF0BE13A0883BEB378B6	- C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll -	Java(TM) Platform SE 7 U40
AF661355EBAB898EB92D5454AEF93CE0	- C:\Windows\system32\npdeployJava1.dll -	Java Deployment Toolkit 7.0.400.43
69AA47F09AA281C7D3C7716CA7E283B4	- C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll -	Adobe Acrobat
380F9A643A149B9030142E7171EFA91B	- C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll -	Adobe Acrobat
D1DC265C3FF7F92B4A75A55B3749D48C	- C:\Program Files\VideoLAN\VLC\npvlc.dll -	VLC Web Plugin
BE501CBC29B2025A263D80D399F1797A	- C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll -	Silverlight Plug-In
0C0C5C207121C7A78414A8250E8E099A	- C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll -	Shockwave for Director / Shockwave for Director
7550FC1ADE982582D5920BEA6430E3D4	- C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll -	Google Earth Plugin
871C7A4B3466ED1B1D1D7588D14EC816	- C:\Program Files\QuickTime\Plugins\npqtplugin5.dll -	QuickTime Plug-in 7.7.4
53B55AB0CF4872F9C420D78D92C1033B	- C:\Program Files\QuickTime\Plugins\npqtplugin4.dll -	QuickTime Plug-in 7.7.4
3A6EBB668DB997B1874981F153403B46	- C:\Program Files\QuickTime\Plugins\npqtplugin3.dll -	QuickTime Plug-in 7.7.4
0805C33F24F45B11EE2CFCCD8F9C6693	- C:\Program Files\QuickTime\Plugins\npqtplugin2.dll -	QuickTime Plug-in 7.7.4
5F63DC3C36366FF4A90AEAA334509BE8	- C:\Program Files\QuickTime\Plugins\npqtplugin.dll -	QuickTime Plug-in 7.7.4
270EE43CC00609B9937AAF94E1E970D4	- C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll -	iTunes Application Detector
E18B5B26F41D8C37CCAA7256F29F6A15	- c:\program files\real\realplayer\Netscape6\nppl3260.dll -	RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)
EBEEC9B1FB8BC809C719713A36640966	- c:\program files\real\realplayer\Netscape6\nprpplugin.dll -	RealPlayer Download Plugin
FEF9ECECFA177AEC0F7564A08394D2C8	- C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll -	RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit)
0ABF093757E9C827E30EC652868E5FAC	- C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll -	RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit)
06E140A567B8DC7900173197FD059EE5	- C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll -	RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit)
558270B968CB82196CB8D045D13B0FF6	- C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll -	RealDownloader Plugin
A5D84FBDC77D55AB78566CB6BA51733C	- C:\Users\Papa\AppData\Roaming\Mozilla\plugins\npMeetingJoinPluginAOCUser.dll -	Microsoft Lync 2010 Attendee Meeting Join Plug-in
C517E5EA7CEE783F3681F62D2A362E5B	- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll -	Windows Live? Photo Gallery
CE252B04FB9F4F773A7DB5338BFEEA5B	- C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL -	CANON iMAGE GATEWAY Album Plugin Utility
9282A8281CBBF8750E399E25613B2E1C	- C:\Program Files\ProtectDisc\License Helper\NPPDLicenseHelper.dll -	Protect Disc License Acquisition Plugin
15E298B5EC5B89C5994A59863969D9FF	- C:\Windows\system32\npmproxy.dll -	Microsoft® Windows® Operating System
B27CCB1168B1960AEC6E9D3E0E0F0D2A	- C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrlui.dll -	Microsoft® Silverlight


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[29.11.2012 21:35]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

Nothing found to reset

==== Empty IE Cache ======================

C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OF66KDFX will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\Administrator\AppData\Local\Mozilla\Firefox\Profiles\5slj8m3q.default\Cache emptied successfully
C:\Users\Papa\AppData\Local\Mozilla\Firefox\Profiles\dfus4sez.default\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome Cache found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Papa\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OF66KDFX" not found

==== EOF on 13.10.2013 at 23:41:41,35 ======================

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Papa (administrator) on TOWER-PAPA on 13-10-2013 23:55:28
Running from C:\Users\Papa\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
(AMD) C:\Program Files\AMD\RAIDXpert\bin\RAIDXpert.exe
() C:\Megatech\MProtect\MPSERV.EXE
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(1und1 Mail und Media GmbH) C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(FNet Co., Ltd.) C:\Program Files\XFastUSB\XFastUsb.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(sw4you, Siegfried Weckmann) C:\Program Files\Hardcopy\hardcopy.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(AMD) C:\Windows\system32\WinMsgBalloonServer.exe
(AMD) C:\Windows\system32\WinMsgBalloonClient.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(RealNetworks, Inc.) C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [606208 2009-10-13] ()
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [LWS] - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [MailCheck IE Broker] - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-06-27] (1und1 Mail und Media GmbH)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [XFastUSB] - C:\Program Files\XFastUSB\XFastUsb.exe [5019360 2013-07-23] (FNet Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11992792 2013-06-24] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-03-09] (AMD)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-06-12] (Google Inc.)
HKU\Administrator\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-06-12] (Google Inc.)
HKU\Administrator\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2011-03-09] (AMD)
HKU\Administrator\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)
HKU\Administrator\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-05-23] (Samsung)
HKU\Administrator\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Administrator\...\Run: [] - C:\Windows\system32\External\FirmwareUpdate\KiesPDLR.exe
HKU\Administrator\...\Run: [ASRockIES] - [x]
HKU\Gast\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-06-12] (Google Inc.)
HKU\Gast\...\Run: [HydraVisionDesktopManager] - C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [ 2011-03-09] (AMD)
HKU\Gast\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-06-21] (Skype Technologies S.A.)
HKU\Gast\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-05-23] (Samsung)
HKU\Gast\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Gast\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-05-23] (Samsung)
HKU\Gast\...\Run: [ASRockIES] - [x]
HKU\Gast\...\RunOnce: [spchecker] - "C:\Program Files\AVG\AVG10\Notification\SPCheckerTE.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2E4238DD797BCA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: {631396C3-108B-46FE-9888-680694D242C6} hxxp://login.vivicom.de/Files/client/SHWebManager.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553530000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 32 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @protectdisc.com/NPPDLicenseHelper - C:\Program Files\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin: @real.com/nppl3260;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: toolbar - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\toolbar@web.de.xpi
FF Extension: No Name - C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\dfus4sez.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

========================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-03-28] (Advanced Micro Devices, Inc.)
R2 AMD_RAIDXpert; C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe [131320 2011-12-14] (AMD)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
S4 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
S4 getPlusHelper; C:\Program Files\NOS\bin\getPlus_Helper.dll [44576 2010-02-03] (NOS Microsystems Ltd.)
R2 Megatech-Software-Protection; C:\Megatech\MProtect\MPSERV.EXE [36864 2007-12-12] ()
S4 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277544 2009-01-19] (Protect Software GmbH)
R0 ahcix86s; C:\Windows\System32\DRIVERS\ahcix86s.sys [184120 2009-12-12] (Advanced Micro Devices, Inc)
R0 aic78xx; C:\Windows\System32\DRIVERS\aic78xx.sys [64000 2006-07-06] (Windows (R) Codename Longhorn DDK provider)
R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [33104 2012-08-09] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-12-13] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [101248 2011-03-07] (AVM Berlin)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-03-25] (Samsung Electronics Co., Ltd.)
S3 ENTECH; C:\Windows\system32\DRIVERS\ENTECH.sys [27672 2007-08-20] (EnTech Taiwan)
R1 Ext2Fsd; C:\Windows\System32\Drivers\Ext2Fsd.sys [686872 2011-07-09] (www.ext2fsd.com)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [29760 2013-10-01] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [14656 2013-07-23] (FNet Co., Ltd.)
S3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2008-01-19] (Microsoft Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-12-13] ()
S4 RsFx0105; C:\Windows\System32\DRIVERS\RsFx0105.sys [238696 2011-09-22] (Microsoft Corporation)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2011-08-08] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61696 2012-06-04] (Silicon Laboratories)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-07] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2007-08-13] (Samsung Electronics)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [121600 2013-08-09] (WinISO.com)
S3 amdiox86; system32\DRIVERS\amdiox86.sys [x]
S3 AODDriver4.0; \??\C:\Program Files\ATI\ATI.ACE\Fuel\i386\AODDriver2.sys [x]
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Papa\AppData\Local\Temp\catchme.sys [x]
S3 cpuz130; \??\C:\Users\Papa\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
S3 motccgp; system32\DRIVERS\motccgp.sys [x]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [x]
S3 MotDev; system32\DRIVERS\motodrv.sys [x]
S3 motmodem; system32\DRIVERS\motmodem.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-13 23:38 - 2013-10-13 23:30 - 00024064 _____ C:\Windows\zoek-delete.exe
2013-10-13 23:32 - 2013-10-13 22:48 - 00020602 _____ C:\zoek-results2013-10-13-204808.log
2013-10-13 23:17 - 2013-10-13 23:17 - 00000633 _____ C:\Users\Papa\Desktop\Text M-K-B-D.txt
2013-10-13 23:00 - 2013-10-13 23:00 - 00028651 _____ C:\Users\Papa\Desktop\Addition.txt
2013-10-13 22:36 - 2013-10-13 23:41 - 00010578 _____ C:\zoek-results.log
2013-10-13 22:04 - 2013-10-11 22:34 - 01087213 _____ (Farbar) C:\Users\Papa\Desktop\FRST.exe
2013-10-13 17:15 - 2013-10-13 17:15 - 00052040 _____ C:\Users\Papa\Downloads\FRST.txt
2013-10-13 17:12 - 2013-10-13 17:12 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST(1).exe
2013-10-13 16:33 - 2013-10-13 15:30 - 03963352 _____ (Microsoft Corporation) C:\Windows\system32\ntkrlICE.exe
2013-10-13 15:06 - 2013-10-13 14:53 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlICE.exe
2013-10-13 15:06 - 2010-05-13 22:26 - 00237392 _____ (Microsoft Corporation) C:\Windows\system32\signtool.exe
2013-10-13 15:06 - 2010-05-13 22:26 - 00055632 _____ (Microsoft Corporation) C:\Windows\system32\makecert.exe
2013-10-13 14:28 - 2013-10-13 14:28 - 00000000 ____D C:\Program Files\Hex-Editor MX
2013-10-13 14:25 - 2013-10-13 14:25 - 00000000 ____D C:\Program Files\weDownload Ltd
2013-10-13 14:20 - 2013-10-13 14:20 - 00002319 _____ C:\Users\Public\Desktop\WinZip.lnk
2013-10-13 14:19 - 2013-10-13 14:27 - 00000000 ____D C:\ProgramData\WinZip
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Users\Papa\AppData\Local\WinZip
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Program Files\WinZip
2013-10-13 14:15 - 2013-10-13 14:26 - 00000000 ____D C:\Program Files\HHD Software
2013-10-13 14:13 - 2013-10-13 14:13 - 01116952 _____ C:\Users\Papa\Downloads\free hex editor setup.exe
2013-10-13 13:38 - 2013-10-13 13:38 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Avira
2013-10-13 13:36 - 2013-10-13 13:36 - 00000000 ____D C:\Users\Administrator\AppData\Local\Macromedia
2013-10-13 13:34 - 2013-10-13 13:35 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Mozilla
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\mirkes.de
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Local\Mozilla
2013-10-13 13:33 - 2013-10-13 13:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-10-13 12:24 - 2013-10-13 15:32 - 00000000 ___RD C:\4G patch
2013-10-13 12:24 - 2013-10-13 12:24 - 00000000 ____D C:\Neuer Ordner
2013-10-13 01:42 - 2013-10-13 01:42 - 01265664 _____ C:\Users\Papa\Desktop\zoek.exe
2013-10-13 01:14 - 2013-10-13 01:14 - 01388542 _____ C:\Users\Papa\Desktop\zoek.scr
2013-10-13 01:14 - 2013-10-13 01:14 - 01388542 _____ C:\Users\Papa\Desktop\zoek.com
2013-10-12 20:24 - 2013-10-12 20:24 - 00069632 ___SH C:\Users\Papa\Downloads\Thumbs.db
2013-10-12 12:54 - 2013-10-12 12:54 - 00003798 _____ C:\Users\Papa\Desktop\JRT.txt
2013-10-12 12:44 - 2013-10-12 12:44 - 00000000 ____D C:\Windows\ERUNT
2013-10-12 12:43 - 2013-10-12 12:43 - 01032220 _____ (Thisisu) C:\Users\Papa\Desktop\JRT.exe
2013-10-12 12:37 - 2013-10-12 12:37 - 00003729 _____ C:\Users\Papa\Desktop\AdwCleaner[S3].txt
2013-10-12 12:05 - 2013-10-12 12:05 - 01048960 _____ C:\Users\Papa\Desktop\adwcleaner.exe
2013-10-12 11:57 - 2013-10-13 23:40 - 00001222 _____ C:\Windows\PFRO.log
2013-10-12 11:46 - 2013-10-12 11:46 - 00018616 _____ C:\ComboFix.txt
2013-10-12 11:32 - 2013-10-12 11:49 - 00000000 ____D C:\ComboFix
2013-10-12 11:32 - 2013-10-12 11:46 - 00000000 ____D C:\Qoobox
2013-10-12 11:32 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-12 11:32 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-12 11:32 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-12 11:32 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-12 11:31 - 2013-10-12 11:45 - 00000000 ____D C:\Windows\erdnt
2013-10-12 11:22 - 2013-10-12 11:22 - 05131958 ____R (Swearware) C:\Users\Papa\Desktop\ComboFix.exe
2013-10-12 09:38 - 2013-10-12 09:38 - 00001217 _____ C:\Users\Papa\Desktop\AVS Video Editor.lnk
2013-10-11 22:36 - 2013-10-13 17:15 - 00028508 _____ C:\Users\Papa\Downloads\Addition.txt
2013-10-11 22:35 - 2013-10-11 22:35 - 00000000 ____D C:\FRST
2013-10-11 22:34 - 2013-10-11 22:34 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00753504 _____ C:\Users\Papa\Downloads\ZipExtractorSetup.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00001146 _____ C:\Users\Papa\Desktop\Continue Zip Extractor Installation.lnk
2013-10-11 18:50 - 2013-10-11 18:50 - 00001121 _____ C:\Users\Papa\Desktop\Die Installation von Adblock Plus für Firefox fortsetzen.lnk
2013-10-09 11:39 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-09 11:39 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-09 11:39 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-09 11:39 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-09 11:39 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-09 11:39 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-09 11:39 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-09 10:55 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 10:55 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 10:55 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 10:55 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-09 10:55 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-09 10:55 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 10:55 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 10:55 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 10:55 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 10:55 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 10:54 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 10:54 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 10:54 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 10:54 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 10:54 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 10:54 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 10:54 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 10:54 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 10:54 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 10:54 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 10:54 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 10:54 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 10:54 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 10:54 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 10:54 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 10:54 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 10:54 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 10:54 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-02 11:40 - 2013-10-02 11:40 - 01045226 _____ C:\Users\Papa\Downloads\adwcleaner_3.0.0.6.exe
2013-10-02 11:38 - 2013-10-02 11:38 - 00000000 ____D C:\Users\Papa\AppData\Roaming\vlc
2013-10-02 11:35 - 2013-10-02 11:36 - 25132744 _____ C:\Users\Papa\Downloads\vlc-2.1.0-win32.exe
2013-10-01 18:33 - 2013-10-01 18:33 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Papa\Downloads\Shockwave_Installer_Slim.exe
2013-10-01 18:29 - 2013-10-02 11:37 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-01 18:26 - 2013-10-01 18:27 - 22240760 _____ (Mozilla) C:\Users\Papa\Downloads\Firefox_23.0.1_german.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\ProgramData\Oracle
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-01 18:20 - 2013-10-01 18:19 - 00913832 _____ (Oracle Corporation) C:\Users\Papa\Downloads\jre-7u40-windows-i586-iftw.exe
2013-09-18 19:30 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-18 19:30 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-18 19:30 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-18 19:30 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-18 19:30 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-18 19:30 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-18 19:30 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-18 19:30 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

==================== One Month Modified Files and Folders =======

2013-10-13 23:48 - 2009-07-14 06:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-13 23:48 - 2009-07-14 06:34 - 00015120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-13 23:44 - 2009-12-13 05:30 - 01934341 _____ C:\Windows\WindowsUpdate.log
2013-10-13 23:42 - 2012-12-20 12:46 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Skype
2013-10-13 23:41 - 2013-10-13 22:36 - 00010578 _____ C:\zoek-results.log
2013-10-13 23:41 - 2009-12-14 19:26 - 00001090 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-13 23:41 - 2009-07-14 06:39 - 00582967 _____ C:\Windows\setupact.log
2013-10-13 23:40 - 2013-10-12 11:57 - 00001222 _____ C:\Windows\PFRO.log
2013-10-13 23:40 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-13 23:30 - 2013-10-13 23:38 - 00024064 _____ C:\Windows\zoek-delete.exe
2013-10-13 23:17 - 2013-10-13 23:17 - 00000633 _____ C:\Users\Papa\Desktop\Text M-K-B-D.txt
2013-10-13 23:03 - 2013-03-14 10:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-13 23:01 - 2009-12-14 19:26 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-13 23:00 - 2013-10-13 23:00 - 00028651 _____ C:\Users\Papa\Desktop\Addition.txt
2013-10-13 22:48 - 2013-10-13 23:32 - 00020602 _____ C:\zoek-results2013-10-13-204808.log
2013-10-13 22:43 - 2009-12-12 22:31 - 00000000 ____D C:\Users\Papa
2013-10-13 22:27 - 2013-09-01 14:53 - 00000000 ____D C:\AdwCleaner
2013-10-13 17:15 - 2013-10-13 17:15 - 00052040 _____ C:\Users\Papa\Downloads\FRST.txt
2013-10-13 17:15 - 2013-10-11 22:36 - 00028508 _____ C:\Users\Papa\Downloads\Addition.txt
2013-10-13 17:12 - 2013-10-13 17:12 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST(1).exe
2013-10-13 15:39 - 2013-07-13 21:19 - 00000000 _____ C:\ProgramData\LauncherAccess.dt
2013-10-13 15:32 - 2013-10-13 12:24 - 00000000 ___RD C:\4G patch
2013-10-13 15:30 - 2013-10-13 16:33 - 03963352 _____ (Microsoft Corporation) C:\Windows\system32\ntkrlICE.exe
2013-10-13 15:13 - 2009-12-12 22:31 - 00000000 ___RD C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-10-13 14:53 - 2013-10-13 15:06 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlICE.exe
2013-10-13 14:28 - 2013-10-13 14:28 - 00000000 ____D C:\Program Files\Hex-Editor MX
2013-10-13 14:27 - 2013-10-13 14:19 - 00000000 ____D C:\ProgramData\WinZip
2013-10-13 14:26 - 2013-10-13 14:15 - 00000000 ____D C:\Program Files\HHD Software
2013-10-13 14:25 - 2013-10-13 14:25 - 00000000 ____D C:\Program Files\weDownload Ltd
2013-10-13 14:20 - 2013-10-13 14:20 - 00002319 _____ C:\Users\Public\Desktop\WinZip.lnk
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Users\Papa\AppData\Local\WinZip
2013-10-13 14:19 - 2013-10-13 14:19 - 00000000 ____D C:\Program Files\WinZip
2013-10-13 14:15 - 2012-10-11 10:03 - 00000000 ____D C:\Users\Papa\AppData\Local\Google
2013-10-13 14:13 - 2013-10-13 14:13 - 01116952 _____ C:\Users\Papa\Downloads\free hex editor setup.exe
2013-10-13 13:38 - 2013-10-13 13:38 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Avira
2013-10-13 13:36 - 2013-10-13 13:36 - 00000000 ____D C:\Users\Administrator\AppData\Local\Macromedia
2013-10-13 13:35 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Mozilla
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\mirkes.de
2013-10-13 13:34 - 2013-10-13 13:34 - 00000000 ____D C:\Users\Administrator\AppData\Local\Mozilla
2013-10-13 13:33 - 2013-10-13 13:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-10-13 13:33 - 2013-01-11 02:34 - 00084640 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-13 13:24 - 2013-01-07 00:27 - 00000000 ____D C:\Users\Papa\AppData\Roaming\EditPlus 3
2013-10-13 13:23 - 2009-12-12 23:34 - 00000000 ____D C:\a
2013-10-13 12:24 - 2013-10-13 12:24 - 00000000 ____D C:\Neuer Ordner
2013-10-13 01:42 - 2013-10-13 01:42 - 01265664 _____ C:\Users\Papa\Desktop\zoek.exe
2013-10-13 01:14 - 2013-10-13 01:14 - 01388542 _____ C:\Users\Papa\Desktop\zoek.scr
2013-10-13 01:14 - 2013-10-13 01:14 - 01388542 _____ C:\Users\Papa\Desktop\zoek.com
2013-10-12 21:22 - 2009-12-12 23:34 - 00000000 ____D C:\c
2013-10-12 20:24 - 2013-10-12 20:24 - 00069632 ___SH C:\Users\Papa\Downloads\Thumbs.db
2013-10-12 12:54 - 2013-10-12 12:54 - 00003798 _____ C:\Users\Papa\Desktop\JRT.txt
2013-10-12 12:44 - 2013-10-12 12:44 - 00000000 ____D C:\Windows\ERUNT
2013-10-12 12:43 - 2013-10-12 12:43 - 01032220 _____ (Thisisu) C:\Users\Papa\Desktop\JRT.exe
2013-10-12 12:37 - 2013-10-12 12:37 - 00003729 _____ C:\Users\Papa\Desktop\AdwCleaner[S3].txt
2013-10-12 12:05 - 2013-10-12 12:05 - 01048960 _____ C:\Users\Papa\Desktop\adwcleaner.exe
2013-10-12 11:49 - 2013-10-12 11:32 - 00000000 ____D C:\ComboFix
2013-10-12 11:46 - 2013-10-12 11:46 - 00018616 _____ C:\ComboFix.txt
2013-10-12 11:46 - 2013-10-12 11:32 - 00000000 ____D C:\Qoobox
2013-10-12 11:46 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-10-12 11:45 - 2013-10-12 11:31 - 00000000 ____D C:\Windows\erdnt
2013-10-12 11:44 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-12 11:22 - 2013-10-12 11:22 - 05131958 ____R (Swearware) C:\Users\Papa\Desktop\ComboFix.exe
2013-10-12 09:39 - 2010-02-13 02:14 - 00000000 ____D C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
2013-10-12 09:39 - 2009-12-13 21:17 - 00000000 ____D C:\Program Files\AVS4YOU
2013-10-12 09:38 - 2013-10-12 09:38 - 00001217 _____ C:\Users\Papa\Desktop\AVS Video Editor.lnk
2013-10-11 22:35 - 2013-10-11 22:35 - 00000000 ____D C:\FRST
2013-10-11 22:34 - 2013-10-13 22:04 - 01087213 _____ (Farbar) C:\Users\Papa\Desktop\FRST.exe
2013-10-11 22:34 - 2013-10-11 22:34 - 01087213 _____ (Farbar) C:\Users\Papa\Downloads\FRST.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00753504 _____ C:\Users\Papa\Downloads\ZipExtractorSetup.exe
2013-10-11 22:33 - 2013-10-11 22:33 - 00001146 _____ C:\Users\Papa\Desktop\Continue Zip Extractor Installation.lnk
2013-10-11 18:50 - 2013-10-11 18:50 - 00001121 _____ C:\Users\Papa\Desktop\Die Installation von Adblock Plus für Firefox fortsetzen.lnk
2013-10-09 23:42 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-09 21:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-09 18:50 - 2009-12-12 22:31 - 00006682 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-09 18:43 - 2009-07-14 06:33 - 00357520 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 18:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-09 11:42 - 2013-07-13 20:36 - 00000000 ____D C:\Windows\system32\MRT
2013-10-09 11:40 - 2009-12-13 04:07 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 11:39 - 2010-09-12 17:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-08 23:03 - 2012-04-01 18:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-08 23:03 - 2011-05-14 10:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-02 11:40 - 2013-10-02 11:40 - 01045226 _____ C:\Users\Papa\Downloads\adwcleaner_3.0.0.6.exe
2013-10-02 11:38 - 2013-10-02 11:38 - 00000000 ____D C:\Users\Papa\AppData\Roaming\vlc
2013-10-02 11:37 - 2013-10-01 18:29 - 00001082 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-10-02 11:36 - 2013-10-02 11:35 - 25132744 _____ C:\Users\Papa\Downloads\vlc-2.1.0-win32.exe
2013-10-02 11:32 - 2012-06-19 20:06 - 00000000 ____D C:\Program Files\Microsoft SDKs
2013-10-02 11:02 - 2013-08-16 11:35 - 00000000 ____D C:\Users\Papa\AppData\Local\Akamai
2013-10-02 01:58 - 2013-08-12 19:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-01 18:33 - 2013-10-01 18:33 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Papa\Downloads\Shockwave_Installer_Slim.exe
2013-10-01 18:27 - 2013-10-01 18:26 - 22240760 _____ (Mozilla) C:\Users\Papa\Downloads\Firefox_23.0.1_german.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-01 18:24 - 2013-10-01 18:24 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\ProgramData\Oracle
2013-10-01 18:24 - 2013-10-01 18:24 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-01 18:24 - 2012-06-23 21:50 - 00868264 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2013-10-01 18:24 - 2010-06-13 13:39 - 00790440 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-10-01 18:19 - 2013-10-01 18:20 - 00913832 _____ (Oracle Corporation) C:\Users\Papa\Downloads\jre-7u40-windows-i586-iftw.exe
2013-10-01 14:51 - 2013-08-12 19:06 - 00000000 ____D C:\Users\Papa\AppData\Local\Mozilla
2013-10-01 14:50 - 2013-09-01 01:03 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-01 14:41 - 2013-08-02 18:02 - 00029760 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS
2013-10-01 12:34 - 2009-07-14 06:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-01 12:18 - 2013-08-07 11:13 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 12:18 - 2013-08-07 11:09 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-09-23 01:28 - 2013-10-09 11:39 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:28 - 2013-10-09 11:39 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-09 11:39 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:27 - 2013-10-09 11:39 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-09 11:39 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-21 05:30 - 2013-10-09 11:39 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-09 11:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-14 02:48 - 2013-10-09 10:55 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Papa\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-10-11 14:59

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Papa at 2013-10-13 23:56:21
Running from C:\Users\Papa\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7 Wonders of the Ancient World (Version: )
7-Zip 9.20
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.4.144)
AeroFly 5 (HKCU Version: 5.00.01.12)
AeroFly Professional Deluxe (HKCU Version: 1.11.0701)
aha² 1.00
Amazon MP3-Downloader 1.0.9
Amazonia
AMD Accelerated Video Transcoding (Version: 12.10.100.30328)
AMD APP SDK Runtime (Version: 2.4.595.9)
AMD Catalyst Install Manager (Version: 8.0.911.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Fuel (Version: 2013.0328.2218.38225)
AMD Media Foundation Decoders (Version: 1.0.80328.2203)
AMD Steady Video Plug-In  (Version: 2.04.0000)
AMD VISION Engine Control Center (Version: 2013.0328.2218.38225)
Anno 1404 (Version: 1.00.0000)
ANNO 1404 (Version: 1.03.0000)
Anno 1701 - Der Fluch des Drachen (Version: 2.03)
Anno 1701 (Version: 1.02)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ASRock App Charger v1.0.4
ASRock IES v2.0.84
ATI AVIVO Codecs (Version: 11.6.0.10308)
Avira Free Antivirus (Version: 14.0.0.383)
AVS Audio Converter version 6.1
AVS Audio Editor version 5.2
AVS Audio Recorder version 3.9
AVS Cover Editor 1.3.1.96 (AVS4YOU)
AVS Disc Creator version 3.5
AVS DVD Authoring
AVS DVD Copy version 4.1.2
AVS Media Player 3.1
AVS Registry Cleaner version 1.1
AVS Ringtone Maker version 1.6
AVS Screen Capture version 1.1.2
AVS System Info
AVS TV Recorder 2.1.2
AVS Update Manager 1.0 (Update Version)
AVS Video Converter 6
AVS Video Editor 6 (Version: 6.4.2.241)
AVS Video Recorder 2.5 (Version: 2.5.6.87)
AVS YouTube Uploader version 2.1
AVS4YOU Software Navigator 1.4
Azteca (VOLLVERSION)
Beetle Ju 2 (VOLLVERSION)
BOcncV2 (Version: 1.0.0)
CameraHelperMsi (Version: 13.51.815.0)
Canon IJ Network Tool
Canon Inkjet Printer Driver Add-On Module
Canon PIXMA iP4000R
Canon Utilities Easy-PhotoPrint EX
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version: 2013.0328.2218.38225)
Catalyst Control Center InstallProxy (Version: 2013.0328.2218.38225)
Catalyst Control Center Localization All (Version: 2013.0328.2218.38225)
CCC Help Chinese Standard (Version: 2013.0328.2217.38225)
CCC Help Chinese Traditional (Version: 2013.0328.2217.38225)
CCC Help Czech (Version: 2013.0328.2217.38225)
CCC Help Danish (Version: 2013.0328.2217.38225)
CCC Help Dutch (Version: 2013.0328.2217.38225)
CCC Help English (Version: 2013.0328.2217.38225)
CCC Help Finnish (Version: 2013.0328.2217.38225)
CCC Help French (Version: 2013.0328.2217.38225)
CCC Help German (Version: 2013.0328.2217.38225)
CCC Help Greek (Version: 2013.0328.2217.38225)
CCC Help Hungarian (Version: 2013.0328.2217.38225)
CCC Help Italian (Version: 2013.0328.2217.38225)
CCC Help Japanese (Version: 2013.0328.2217.38225)
CCC Help Korean (Version: 2013.0328.2217.38225)
CCC Help Norwegian (Version: 2013.0328.2217.38225)
CCC Help Polish (Version: 2013.0328.2217.38225)
CCC Help Portuguese (Version: 2013.0328.2217.38225)
CCC Help Russian (Version: 2013.0328.2217.38225)
CCC Help Spanish (Version: 2013.0328.2217.38225)
CCC Help Swedish (Version: 2013.0328.2217.38225)
CCC Help Thai (Version: 2013.0328.2217.38225)
CCC Help Turkish (Version: 2013.0328.2217.38225)
ccc-utility (Version: 2013.0328.2218.38225)
Cradle of Egypt
Cradle of Rome 2
D3DX10 (Version: 15.4.2368.0902)
DEUTSCHLAND SPIELT GAME CENTER
DIE SIEDLER - Aufstieg eines Königreichs (Version: 1.00.0000)
DIE SIEDLER - Das Erbe der Könige - Gold Edition (Version: 1.00.0000)
Die Siedler II - Die nächste Generation
DiRT 2
EditPlus 3
Entity Framework Designer für Visual Studio 2012 - DEU (Version: 11.1.20702.00)
Erforderliche Komponenten für SSDT  (Version: 11.0.2100.60)
erLT (Version: 1.20.138.34)
Ext2Fsd 0.51 (Version: 0.51)
freundin - Inca Pearls
FRITZ!Box-Fernzugang einrichten (Version: 1.0.3)
Galaxy Rebellion
getPlus(R) Download Manager for Corel (Version: 1.5.0.56)
Google Earth (Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4601.54)
Hardcopy (C:\Program Files\Hardcopy) (Version: 17.0.19)
Hex-Editor MX (Version: 6.0)
Hotfix für Microsoft Visual Basic 2010 Express - DEU (KB2635973) (Version: 1)
HydraVision (Version: 4.2.188.0)
IIS 8.0 Express (Version: 8.0.1557)
IIS Express Application Compatibility Database for x86
iTunes (Version: 11.0.4.4)
Japanese Fonts Support For Adobe Reader X (Version: 10.0.0)
Java 7 Update 40 (Version: 7.0.400)
Java Auto Updater (Version: 2.1.9.8)
Junk Mail filter update (Version: 15.4.3502.0922)
Karthago
Land der Pharaonen
Licensing Service Install (Version: 2.0.1.181)
LinuxLive USB Creator (Version: 2.8)
Logitech Webcam-Software (Version: 2.51)
Luxor 5th Passage (Version: 1.1.0.0)
Luxor Amun Rising with Luxor (Version: )
LWS Facebook (Version: 13.50.854.0)
LWS Gallery (Version: 13.51.827.0)
LWS Help_main (Version: 13.51.828.0)
LWS Launcher (Version: 13.51.828.0)
LWS Motion Detection (Version: 13.51.815.0)
LWS Pictures And Video (Version: 13.51.815.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Webcam Software (Version: 13.51.815.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
Mahjongg
Mahjongg - Ancient Mayas
MegaNC 3D 2012 
Microsoft .NET Framework 4 Multi-Targeting Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 3 - DEU (Version: 3.0.20105.0)
Microsoft ASP.NET MVC 3 (Version: 3.0.20105.0)
Microsoft ASP.NET Web Pages - DEU (Version: 1.0.20105.0)
Microsoft ASP.NET Web Pages (Version: 1.0.20105.0)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.88.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft Help Viewer 1.1 (Version: 1.1.40219)
Microsoft Help Viewer 1.1 Language Pack - DEU (Version: 1.1.40219)
Microsoft Help Viewer 2.0 (Version: 2.0.50727)
Microsoft Help Viewer 2.0 Language Pack - DEU (Version: 2.0.50727)
Microsoft Lync 2010 Attendee (Version: 4.0.7577.4109)
Microsoft Office Access database engine 2007 (German) (Version: 12.0.6425.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Silverlight 4 SDK - Deutsch (Version: 4.0.60310.0)
Microsoft Silverlight 5 SDK - DEU (Version: 5.0.61118.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Common Files (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Services (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.3.5500.0)
Microsoft SQL Server 2008 Native Client (Version: 10.3.5500.0)
Microsoft SQL Server 2008 R2 Management Objects (Version: 10.50.1750.9)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.3.5500.0)
Microsoft SQL Server 2012 Command Line Utilities  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Data-Tier App Framework  (Version: 11.0.2316.0)
Microsoft SQL Server 2012 Express LocalDB  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Native Client  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 T-SQL Language Service  (Version: 11.0.2100.60)
Microsoft SQL Server Compact 3.5 SP2 DEU (Version: 3.5.8080.0)
Microsoft SQL Server Compact 4.0 SP1 DEU (Version: 4.0.8876.1)
Microsoft SQL Server Data Tools - DEU (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server System CLR Types (Version: 10.50.1750.9)
Microsoft SQL Server VSS Writer (Version: 10.3.5500.0)
Microsoft Visual Basic 2010 Express - DEU (Version: 10.0.40219)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (Version: 10.0.40219)
Microsoft Visual Studio 2010 Service Pack 1 (Version: 10.0.40219)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40303)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40308)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.40303)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (Version: 10.0.40303)
Microsoft Web Deploy 3.0 (Version: 3.1236.1631)
Microsoft Web Deploy dbSqlPackage Provider - DEU (Version: 10.3.20225.0)
Microsoft-System-CLR-Typen für SQL Server 2012 (Version: 11.0.2100.60)
mirkes.de Tiny Hexer (Version: 1.8)
Moorhuhn X - XXL (Version: 1.01.0000)
MotoHelper MergeModules (Version: 1.2.0)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MyFreeCodec
NAVIGON Fresh 3.4.1 (Version: 3.4.1)
Notepad++ (Version: 5.9.8)
Ominent toolbar   (Version: 1.8.25.6)
OpenOffice.org 3.4.1 (Version: 3.41.9593)
Pacboy (Version: 1.00.0000)
PCMark Vantage (Version: 1.0.2.1)
PDFCreator (Version: 1.3.2)
PhoenixRC (Version: 3.00.18)
Plus-HD-3.2 (Version: 1.27.153.8)
Protect Disc License Helper 1.0.118 (Version: 1.0.118)
ProtectDisc Driver, Version 11 (Version: 11.0.0.12)
QuickTime (Version: 7.74.80.86)
RAIDXpert (Version: 3.3.1540.19)
RealDownloader (Version: 1.3.0)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0)
RealPlayer (Version: 16.0.0)
Realtek Ethernet Controller  Driver (Version: 1.00.0008)
Realtek High Definition Audio Driver (Version: 6.0.1.6953)
RealUpgrade 1.1 (Version: 1.1.0)
Romance of Rome
Samsung CLX-3170 Series
Samsung Kies (Version: 2.5.3.13052_10)
Samsung Mobile phone USB driver Drive Software
Samsung PC Studio 3 (Version: 3.0.0.80601)
Samsung PC Studio 3 (Version: 3.2.2.80601)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.24.0)
Schatzinsel
Service Pack 3 für SQL Server 2008 (KB2546951) (Version: 10.3.5500.0)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (Version: 6.5.3)
Skype™ 6.6 (Version: 6.6.106)
SmarThru 4
SmarThru PC Fax
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0)
Steam (Version: 1.0.0.0)
swMSM (Version: 12.0.0.1)
SYBEX Spieltrieb TetriX 1  (Version: 1)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 2.00.0001)
TIPCI (Version: 2.00.0001)
Unterstützungsdateien für Microsoft SQL Server 2008-Setup  (Version: 10.3.5500.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (Version: 1)
Video Downloader version 2.0 (Version: 2.0)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU (Version: 4.0.8080.0)
VLC media player 2.1.0 (Version: 2.1.0)
WEB.DE MailCheck für Internet Explorer (Version: 2.3.0.1)
WEB.DE Softwareaktualisierung (Version: 3.0.0.54)
Win7codecs (Version: 2.3.3)
Windows 7 Upgrade Advisor (Version: 2.0.5000.0)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live OneCare safety scanner
Windows Live OneCare safety scanner (Version: 1.0.0.0)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WinISO (Version: 6.3.0.4969)
WinPC-NC Economy Demo (Version: 2.00)
WinRAR 4.11 (32-bit) (Version: 4.11.0)
WinZip 17.5 (Version: 17.5.10480)
XFastUSB (Version: 3.02.28)
XMedia Recode 3.0.8.5 (Version: 3.0.8.5)

==================== Restore Points  =========================

26-08-2013 09:30:45 Wiederherstellungsvorgang
27-08-2013 07:53:32 Removed Bonjour
29-08-2013 09:36:34 Removed Microsoft Web Platform Installer 4.0
29-08-2013 11:26:30 Removed Update Manager for SweetPacks 1.1
18-09-2013 17:45:37 Windows Update
01-10-2013 14:42:18 Geplanter Prüfpunkt
01-10-2013 16:23:14 Installed Java 7 Update 40
02-10-2013 09:30:46 Removed WCF RIA Services V1.0 SP2
09-10-2013 09:37:57 Windows Update
12-10-2013 09:32:26 ComboFix created restore point
12-10-2013 11:21:55 Windows Update
13-10-2013 20:37:00 zoek.exe restore point

==================== Hosts content: ==========================

2009-07-14 04:04 - 2013-10-12 11:44 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0BAF4384-F8E7-4BC8-AD4F-BC6E36EA3F61} - System32\Tasks\motorola software update => C:\Program Files\Motorola\Software Update\mumservice.exe
Task: {11FBE3C4-ACDF-4382-A8AB-67A234605D7D} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {217C9D47-2217-43D7-97F5-9C4A3FC5F30E} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {2B7FD384-D9C7-4B2D-9287-6076528A788E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {4F2E86C2-92DC-4434-A618-36B8CB482E51} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => c:\program files\real\realplayer\Update\realsched.exe [2013-02-28] (RealNetworks, Inc.)
Task: {5A40A046-1405-4014-8A3C-B16D725AE17C} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {6D609A4F-E36E-4F8B-BDFC-28D3E721BEFE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-14] (Google Inc.)
Task: {7362A7E4-3723-4447-B7F3-C4D97B61B5E3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {75B603B6-DE5C-48D7-924D-E7BC7BFADDE1} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {8412AE68-7CF5-430C-B2D7-0FC6FE72B439} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-31] (Adobe Systems Incorporated)
Task: {98DD5A9E-75DB-4FBA-98DA-81528C90AD1C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-14] (Google Inc.)
Task: {C1C8674A-170F-4329-9BA1-E8A1A136794E} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {D4AD869A-14BA-4743-A301-02546CE04C76} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {E8F396F9-F26F-4904-ABE9-652172D2A05B} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {F50EBB68-F9CF-4226-8A4B-D9510FAF100F} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {FAEF476B-FDFC-4FD1-8234-777694CDB2C4} - System32\Tasks\Registration 1und1 Task => C:\Program Files\1und1Softwareaktualisierung\cdsupdclient.exe [2013-05-28] (1&1 Mail & Media GmbH)
Task: {FF4B012D-3307-48E9-B0AC-78A09B2391EB} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1632185309-2399383750-939381153-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-02-22 20:48 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files\Hardcopy\HcDLL2_29_Win32.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 02145304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 07956504 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00342552 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00029208 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2011-11-11 15:08 - 2011-11-11 15:08 - 00128536 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2010-02-22 20:48 - 2009-12-10 08:50 - 00445952 _____ () C:\Program Files\Hardcopy\HcDllS.dll
2010-02-22 20:48 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files\Hardcopy\hardcopy_02.dll
2013-03-28 22:29 - 2013-03-28 22:29 - 00095232 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-09-01 01:03 - 2013-10-01 14:50 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:99B2514F

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Unknown Device
Description: Unknown Device
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Standard-USB-Hostcontroller)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (10/13/2013 03:37:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (10/13/2013 02:25:17 PM) (Source: MsiInstaller) (User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi

Error: (10/13/2013 02:15:40 PM) (Source: MsiInstaller) (User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi


System errors:
=============
Error: (10/13/2013 11:40:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (10/13/2013 11:37:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/13/2013 11:37:19 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/13/2013 11:37:19 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/13/2013 11:37:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/13/2013 11:37:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/13/2013 10:49:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/13/2013 10:49:16 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht.

Error: (10/13/2013 10:47:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (10/13/2013 10:43:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================
Error: (10/13/2013 03:37:45 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (10/13/2013 03:37:45 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe

Error: (10/13/2013 02:25:17 PM) (Source: MsiInstaller)(User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (10/13/2013 02:15:40 PM) (Source: MsiInstaller)(User: Tower-Papa)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files\DealPlyLive\Update\1.3.23.0\GoogleUpdateHelper.msi(NULL)(NULL)(NULL)(NULL)(NULL)


==================== Memory info =========================== 

Percentage of memory in use: 37%
Total physical RAM: 4095.24 MB
Available physical RAM: 2556.35 MB
Total Pagefile: 8188.77 MB
Available Pagefile: 6251.56 MB
Total Virtual: 2047.88 MB
Available Virtual: 1918.54 MB

==================== Drives ================================

Drive c: (WIndows 7 HDD) (Fixed) (Total:465.71 GB) (Free:157.75 GB) NTFS
Drive d: (Videoplatte) (Fixed) (Total:1863.01 GB) (Free:1862.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: AF890102)
Partition 1: (Not Active) - (Size=-198626508800) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 32F7D651)
Partition 1: (Active) - (Size=48 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Hallo M-K-B-D,

Ich hoffe ich habe jetzt alles richtig gemacht.

Das ich mir schon wieder was eingefangen hatte kann eigentlich nur daran liegen, dass ich einen Hex-Editor gebraucht habe, da mein Bootmenü nach den Scans nicht mer funktioniert hat und ich die manuelle Einrichtung des 2. Menüpunktes "Windows 7 ohne RAM Sperre" wiederholen musste.

Da habe ich verschiedene HEX-Editoren runtergeladen. Gearbeitet habe ich letztendlich mit Hes-Editor MX.

Außerdem Spiele ich Anno-Online.

Bei einer dieser Aktionen muss die neue Verseuchung dabei gewesen sein.

Tut mir leid.

Ich hoffe jetzt ist alles ok.

Uwe

M-K-D-B · 14.10.2013, 13:05

Servus,

ja, sieht besser aus.

Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
AlternateDataStreams: C:\ProgramData\TEMP:99B2514F
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Schritt 5
Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Bitte poste mit deiner nächsten Antwort

die Logdatei von FRST,
die Logdatei von MBAM,
die Logdatei von ESET,
die Logdatei von TDSS-Killer,
die Logdatei von SecurityCheck.

Garfield- · 14.10.2013, 15:25

Schritt 1

Code:

ATTFilter


	Code: 

 ATTFilter

  
	Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by Papa at 2013-10-14 16:23:17 Run:3

Running from C:\Users\Papa\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
AlternateDataStreams: C:\ProgramData\TEMP:99B2514F
end
*****************

C:\ProgramData\TEMP => ":99B2514F" ADS removed successfully.

==== End of Fixlog ====

M-K-D-B · 14.10.2013, 15:48

Servus,

fehlen noch die andren Schritte.

Garfield- · 14.10.2013, 15:59

Schritt 2

Code:

ATTFilter


	Code: 

 ATTFilter

  
	Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.14.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16721
Papa :: TOWER-PAPA [Administrator]

14.10.2013 16:44:59
mbam-log-2013-10-14 (16-44-59).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 265888
Laufzeit: 9 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SOFTWARE\Plus-HD-3.2 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Papa\Downloads\free hex editor setup.exe (PUP.Soft32Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Papa\Downloads\freeisocreatewizardsetup.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Papa\Downloads\ZipExtractorSetup.exe (PUP.Optional.Installcore) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Ja, klar, mache eines nach dem anderen und poste das Ergebnis immer gleich, damit ich nichts falsch mache oder vergesse.

Uwe

M-K-D-B · 14.10.2013, 18:29

Servus Uwe,

ok, alles klar.

Fehlen nur noch 2 Schritte.

14.10.2013, 15:48	#13
M-K-D-B /// TB-Ausbilder	Lästige Werbepopups wenn man mit der Maus über farbig unterstrichene Wörter fährt Servus, fehlen noch die andren Schritte.

14.10.2013, 18:29	#15
M-K-D-B /// TB-Ausbilder	Lästige Werbepopups wenn man mit der Maus über farbig unterstrichene Wörter fährt Servus Uwe, ok, alles klar. Fehlen nur noch 2 Schritte.

Lästige Werbepopups wenn man mit der Maus über farbig unterstrichene Wörter fährt

Plagegeister aller Art und deren Bekämpfung: Lästige Werbepopups wenn man mit der Maus über farbig unterstrichene Wörter fährt