statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus?

SoloAlex · 29.01.2014, 23:29

Hallo liebe Leute,
ich brauche wirklich dringend hilfe sonst weiß ich auch nicht, seit 3 Stunden suche ich schon nach einer Lösung.
Ich wollte heute einen Film runterladen, und habe mir dabei wahrscheinlich ein Virus/Malware auf meinen Computer (Windows 7, benutze Firefox) geholt - denn, nachdem ich ein neues Tab öfffnen wollte, war da anstatt der Google-Seite diese komische Seite hier : hxxp://www.awesomehp.com/?type=sc&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC

Es ist da auch ein "uninstall" Feld angegeben, wo dann steht :
Firefox
1 – Open Firefox explore
2 – Via “Firefox->Options” open “Options” panel
3 - Click “General” tab
4 - Delete awesomehp homepage link and set a new homepage link
5 - Choose “Manage Search Engines” in the search list
6 – Remove awesomehp,then click “OK”
7 – Restart Firefox explore

Ich kam hier aber gar nicht weiter.

Ich dachte, dass man sie wie üblich sehr einfach wegbekommen kann, und zwar nur simple Google als Homepage einzustellen, aber nichts hat gewirkt. Dazu, immer wenn ich ein neues Tab dazu öffnen will, werde ich auf noch eine andere Seite umgeleitet : chrome://lightning/content/newtab.html. Ich habe keine Ahnung was dass sein soll, und bin schon total verzweifelt nachdem ich es mit Malwarebytes versucht habe, sowohl mit adwcleaner, obwohl ich mich da ehrlich gesagt nicht so gut mit den Programmen auskenne, und kann sein dass ich da aus versehen nicht alles richtig gemacht habe. Ich habe zu dem Problem auch so wenig Infos im Internet gefunden, es scheint nicht so verbreitet zu sein:

Ich bedanke mich ganz herzlich für eure Hilfe im Voraus!

Alexandra

cosinus · 29.01.2014, 23:36

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

SoloAlex · 30.01.2014, 15:08

Merci für Deine schnelle Antwort, cosinus!

Hier der Scan von Malwarebytes, dass ich erst gestern Abend noch installiert habe :

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.29.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
AlexSal :: ALEXSAL-PC [Administrator]

Schutz: Aktiviert

29.01.2014 20:13:46
mbam-log-2014-01-29 (20-13-46).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 344794
Laufzeit: 54 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DefaultScope (PUP.Optional.Qone8) -> Bösartig: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}) Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 15
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\Install (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\en_us (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\es_es (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\pt_br (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\tr_tr (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\layout (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\layout\default (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\style (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\337\libcef (PUP.Optional.337Technologies.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123 (PUP.Optional.337Technologies.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales (PUP.Optional.337Technologies.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 51
C:\Program Files\Vuze\.install4j\user\mism.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\eInstall.exe (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\fullpackage_temp1391012418\package1.zip (PUP.Optional.NationZoom.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\fullpackage_temp1391012418\tmp\desk365.exe (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\Downloads\ccleaner.exe (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\Downloads\SoftonicDownloader_for_vlc-media-player.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\main (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\msvcp100.dll (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\msvcr100.dll (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\segoeui.ttf (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\segoeuib.ttf (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\app_icon.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\change_skin.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\combo_skin.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\edit_skin.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\install_back.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\install_button_skin.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_checked.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_intermediate.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\install_check_uncheck.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\install_logo.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\install_resource.xml (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\patch_file_icon.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\pic-error.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\pic-info.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\pic-question.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\pic-warning.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\popup_dialog_bk.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_bk.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\progressbar_image.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\radio_normal.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\radio_selected.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\image\default\sys_close.png (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\Install\4zip.inst (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\Install\AirZip.inst (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\Install\edesk.inst (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\Install\gamelogin.inst (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\protocol.txt (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\en_us\install_lang.ini (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\es_es\install_lang.ini (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\pt_br\install_lang.ini (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\language\tr_tr\install_lang.ini (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\layout\default\eDeskInstall.xml (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\layout\default\gamelogin.xml (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\layout\default\install_msgbox.xml (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\layout\default\languageSelect.xml (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\layout\default\uninstgl.xml (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\AlexSal\AppData\Local\Temp\Desk365\eInstall\style\install_style.xml (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\icudt.dll (PUP.Optional.337Technologies.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\libcef.dll (PUP.Optional.337Technologies.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Common Files\337\libcef\1.1364.1123\locales\en-US.pak (PUP.Optional.337Technologies.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Und hier der von FRST :

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014 01
Ran by AlexSal at 2014-01-30 14:47:14
Running from C:\Users\AlexSal\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 clear.fi SDK - MVP 2 (x32 Version: 2.0.1505 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.0.1502 - CyberLink Corp.) Hidden
Acer Backup Manager (x32 Version: 3.0.0.100 - NTI Corporation)
Acer Crystal Eye Webcam (x32 Version: 1.5.3501.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.5.3501.00 - CyberLink Corp.) Hidden
Acer ePower Management (x32 Version: 6.00.3010 - Acer Incorporated)
Acer eRecovery Management (x32 Version: 5.00.3508 - Acer Incorporated)
Acer Games (x32 Version: 1.0.2.5 - WildTangent)
Acer Instant Update Service (Version: 1.00.3004 - Acer Incorporated)
Acer Registration (x32 Version: 1.04.3506 - Acer Incorporated)
Acer Theft Shield (Version: 1.00.3005 - Acer Incorporated)
Acer Updater (x32 Version: 1.02.3501 - Acer Incorporated)
Acer USB Charge Manager (x32 Version: 1.00.3002 - Acer Incorporated)
Acer VCM (x32 Version: 4.05.3501 - Acer Incorporated)
Adobe AIR (x32 Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.6.0.19120 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Atheros Bluetooth Suite (64) (Version: 7.4.0.125 - Atheros)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Broadcom NetLink Controller (Version: 15.0.6.1 - Broadcom Corporation)
CCleaner (Version: 4.10 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco AnyConnect Secure Mobility Client  (x32 Version: 3.1.05152 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05152 - Cisco Systems, Inc.) Hidden
clear.fi Media (x32 Version: 2.00.3004 - Acer Incorporated)
clear.fi Photo (x32 Version: 2.00.3004 - Acer Incorporated)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Home Theater v4 (x32 Version: 7.2.7000.7 - Dolby Laboratories Inc)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
eBay Worldwide (x32 Version: 2.2.0409 - OEM)
ETDWare PS/2-X64 10.6.10.8_WHQL (Version: 10.6.10.8 - ELAN Microelectronic Corp.)
ExpressCache (Version: 1.0.82 - Diskeeper Corporation)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fooz Kids (x32 Version: 3.1.2 - FUHU, Inc.)
Fooz Kids (x32 Version: 3.1.2 - FUHU, Inc.) Hidden
Fooz Kids Platform (x32 Version: 2.1 - FUHU, Inc.)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GeoGebra 4.2 (x32 Version: 4.2.60.0 - International GeoGebra Institute)
Identity Card (x32 Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 8.0.4.1441 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (x32 Version:  - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2712 - Intel Corporation)
Intel(R) Rapid Start Technology (x32 Version: 1.0.0.1022 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.23.605.1 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kobo (x32 Version: 2.1.5 - Kobo Inc.)
Launch Manager (x32 Version: 5.1.15 - Acer Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Internet Security Suite (x32 Version: 11.0.678 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 365 Home Premium - de-de (Version: 15.0.4551.1512 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5139.5005 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20513.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
Norton Online Backup (x32 Version: 2.1.17869 - Symantec Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9006 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9006 - NTI Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
PDF24 Creator 6.0.1 (x32 Version:  - PDF24.org)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
PhotoScape (x32 Version:  - )
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6612 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (x32 Version: 6.1.7601.28104 - Realtek Semiconductor Corp.)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sleep Memory Optimizer (x32 Version: 1.00.3004 - Acer Incorporated)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Smart Timer (x32 Version: 1.00.3004 - Acer Incorporated)
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0 - Intel)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
VLC media player 2.1.0 (x32 Version: 2.1.0 - VideoLAN)
Vuze (Version: 5.0.0.0 - Azureus Software, Inc.)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (x32 Version: 1.02.3507 - Acer Incorporated)
WildTangent Games App (Acer Games) (x32 Version: 4.0.5.32 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinZip 17.5 (x32 Version: 17.5.10562 - WinZip Computing, S.L. )
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

26-01-2014 13:02:25 Removed Java 7 Update 45
29-01-2014 18:22:19 Removed Evernote v. 4.5.2
29-01-2014 20:47:51 Installed SpyHunter
29-01-2014 21:42:31 Removed SpyHunter

==================== Hosts content: ==========================

2009-07-14 03:34 - 2014-01-05 08:26 - 00000971 ____N C:\Windows\system32\Drivers\etc\hosts

141.39.208.68	vpn.leuphana.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.


==================== Scheduled Tasks (whitelisted) =============

Task: {05EF9B26-3D89-4F67-BD95-8890BA127539} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-10-31] (Microsoft Corporation)
Task: {440F77D3-C778-45B1-ABFD-BCBF95E8CC23} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-07] (Acer Incorporated)
Task: {4F26350B-95AA-40A1-A0C0-4CD6E0C93969} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-05-20] (CyberLink)
Task: {52682665-1850-453F-8E46-E57E82FCA22B} - System32\Tasks\{B8ABCC0A-4F8C-480D-8A54-9D96E283B5F5} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.5.0.158&amp;LastError=12002
Task: {54C10E2B-C64C-41E0-A3B7-925CCB9D96A6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {5C718A3B-0BC1-4AF8-B56D-22C7B9578EC5} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-15] (Microsoft Corporation)
Task: {67A0452F-8850-4B5D-B7A5-B7F9578A8DD1} - System32\Tasks\Smart Timer Task Scheduler => Smart_Timer.exe
Task: {A1D60D55-A6B8-401B-BC05-2938E02DF2F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {AB449415-8385-489C-AA5B-9433EC7F4B41} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {B92DEADC-87CA-4110-B7A8-46643774F883} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {F3E54CCE-7485-4386-BFFE-E99171C1C3F9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-12] (Adobe Systems Incorporated)
Task: {F74111C6-4594-40D4-A88C-18E67F5CAC2C} - \Desk 365 RunAsStdUser No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-06-07 13:38 - 2012-06-07 13:38 - 00213648 _____ () C:\Program Files\Acer\Acer Theft Shield\CommPtl.dll
2012-06-07 13:38 - 2012-06-07 13:38 - 00197776 _____ () C:\Program Files\Acer\Acer Theft Shield\LogMgr2.dll
2012-06-07 13:38 - 2012-06-07 13:38 - 00114320 _____ () C:\Program Files\Acer\Acer Theft Shield\SysCtrl.dll
2012-06-07 13:38 - 2012-06-07 13:38 - 00141456 _____ () C:\Program Files\Acer\Acer Theft Shield\WHNCtrl.dll
2012-04-26 06:43 - 2012-03-26 10:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-12-12 23:36 - 2013-12-12 23:36 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2013-09-07 08:10 - 2013-09-07 07:55 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-01-05 22:22 - 2012-01-05 22:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 22:22 - 2012-01-05 22:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 22:22 - 2012-01-05 22:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2013-12-30 22:17 - 2014-01-16 08:05 - 36967424 _____ () C:\Users\AlexSal\AppData\Roaming\Spotify\Data\libcef.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\AlexSal\AppData\Roaming\Dropbox\bin\libcef.dll
2013-12-12 15:49 - 2013-12-12 15:49 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
2013-12-30 22:17 - 2014-01-16 08:05 - 00887808 _____ () C:\Users\AlexSal\AppData\Roaming\Spotify\Data\libglesv2.dll
2013-12-30 22:17 - 2014-01-16 08:05 - 00109568 _____ () C:\Users\AlexSal\AppData\Roaming\Spotify\Data\libegl.dll
2014-01-26 11:46 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-01-13 17:42 - 2014-01-13 17:42 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\67f2d87ba056e1075fce76a8c50bb57e\IsdiInterop.ni.dll
2013-04-28 09:10 - 2012-02-01 15:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-04-28 09:07 - 2012-03-06 08:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/30/2014 02:37:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 11:02:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 10:44:39 PM) (Source: Microsoft-Windows-RestartManager) (User: AlexSal-PC)
Description: Die Anwendung oder der Dienst "SpyHunter 4 Service" konnte nicht neu gestartet werden.

Error: (01/29/2014 10:41:25 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 09:31:27 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 09:23:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 04:34:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 10:43:25 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 08:50:45 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/28/2014 09:53:47 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (01/30/2014 02:37:04 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom
mfewfpk

Error: (01/30/2014 02:36:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SpyHunter 4 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/29/2014 11:21:06 PM) (Source: BROWSER) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{5D24D5CE-8535-40E9-A486-642A2B5C69E0}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.

Error: (01/29/2014 11:02:52 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom
mfewfpk

Error: (01/29/2014 11:02:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SpyHunter 4 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/29/2014 10:44:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SpyHunter 4 Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (01/29/2014 10:42:05 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom
mfewfpk

Error: (01/29/2014 10:40:20 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎29.‎01.‎2014 um 22:39:04 unerwartet heruntergefahren.

Error: (01/29/2014 09:32:05 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom
mfewfpk

Error: (01/29/2014 09:22:49 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom
mfewfpk


Microsoft Office Sessions:
=========================
Error: (01/30/2014 02:37:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 11:02:39 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 10:44:39 PM) (Source: Microsoft-Windows-RestartManager)(User: AlexSal-PC)
Description: 0SH4SER~1.EXESpyHunter 4 Service0302621789480

Error: (01/29/2014 10:41:25 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 09:31:27 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 09:23:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 04:34:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 10:43:25 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/29/2014 08:50:45 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/28/2014 09:53:47 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 82%
Total physical RAM: 3933.36 MB
Available physical RAM: 671.06 MB
Total Pagefile: 7864.89 MB
Available Pagefile: 3963.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:450.16 GB) (Free:384.62 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 827584C3)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 19 GB) (Disk ID: 51EE9DC1)
Partition 1: (Not Active) - (Size=4 GB) - (Type=84)
Partition 2: (Not Active) - (Size=15 GB) - (Type=73)

==================== End Of Log ============================

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by AlexSal (administrator) on ALEXSAL-PC on 30-01-2014 14:46:43
Running from C:\Users\AlexSal\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Spotify Ltd) C:\Users\AlexSal\AppData\Roaming\Spotify\spotify.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(Dropbox, Inc.) C:\Users\AlexSal\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files\Sleep Memory Optimizer\FFSService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Farbar) C:\Users\AlexSal\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Secure Applicayion] - C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe [259728 2012-06-07] ()
HKLM\...\Run: [InstantUpdate] - C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-07] ()
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12476520 2012-04-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2816336 2012-03-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1020576 2012-02-28] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800416 2012-02-28] (Atheros Commnucations)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-26] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2013-12-12] (Cisco Systems, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify] - C:\Users\AlexSal\AppData\Roaming\Spotify\spotify.exe [6118400 2014-01-16] (Spotify Ltd)
Startup: C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\AlexSal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.awesomehp.com/?type=sc&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: No Name - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -  No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -  No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: No Name - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -  No File
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -  No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: 141.39.208.68	vpn.leuphana.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440
FF NewTab: chrome://lightning/content/newtab.html
FF DefaultSearchEngine: awesomehp
FF SelectedSearchEngine: awesomehp
FF Homepage: hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\awesomehp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Extension_Protected - C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\Extensions\jid0-O6MIff3eO5dIGf5Tcv8RsJDKxrs@jetpack.xpi [2014-01-29]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [lightningnewtab@gmail.com] - C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\extensions\lightningnewtab@gmail.com.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.awesomehp.com/?type=sc&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-02-17] (Diskeeper Corporation)
R2 FFSOpzSvc; C:\Program Files\Sleep Memory Optimizer\FFSService.exe [141192 2011-09-17] (Acer Incorporated)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-15] ()
S3 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [192856 2012-03-14] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-10-31] (Microsoft Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
R2 USecuAppSvc; C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe [235664 2012-06-07] ()
S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-02-17] (Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [92976 2012-02-17] (Diskeeper Corporation)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-14] (Intel Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S0 mfewfpk; system32\drivers\mfewfpk.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-30 14:46 - 2014-01-30 14:47 - 00021101 _____ C:\Users\AlexSal\Downloads\FRST.txt
2014-01-30 14:46 - 2014-01-30 14:46 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64(1).exe
2014-01-30 14:46 - 2014-01-30 14:46 - 00000000 ____D C:\FRST
2014-01-29 23:00 - 2014-01-29 23:00 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner(1).exe
2014-01-29 22:30 - 2014-01-29 22:30 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184(1).exe
2014-01-29 22:29 - 2014-01-29 22:29 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184.exe
2014-01-29 22:26 - 2014-01-29 22:26 - 01037068 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT.exe
2014-01-29 22:21 - 2014-01-29 22:21 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64.exe
2014-01-29 21:49 - 2014-01-29 21:49 - 00000000 _____ C:\autoexec.bat
2014-01-29 21:48 - 2014-01-29 21:48 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-29 21:47 - 2014-01-29 22:44 - 00000000 ____D C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-01-29 21:47 - 2014-01-29 21:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\AlexSal\Downloads\SpyHunter-Installer.exe
2014-01-29 21:39 - 2014-01-29 21:39 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner.exe
2014-01-29 21:27 - 2014-01-29 21:27 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner-3.018(1).exe
2014-01-29 21:19 - 2014-01-30 14:36 - 00000336 _____ C:\Windows\setupact.log
2014-01-29 21:19 - 2014-01-29 21:19 - 00020396 _____ C:\Windows\PFRO.log
2014-01-29 21:19 - 2014-01-29 21:19 - 00000000 _____ C:\Windows\setuperr.log
2014-01-29 20:12 - 2014-01-29 20:12 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D C:\Users\AlexSal\AppData\Roaming\Malwarebytes
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-29 20:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-29 19:56 - 2014-01-29 19:56 - 00002104 _____ C:\Users\AlexSal\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-01-29 19:53 - 2014-01-29 23:01 - 00000000 ____D C:\AdwCleaner
2014-01-29 19:52 - 2014-01-29 19:52 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner-3.018.exe
2014-01-29 17:29 - 2014-01-29 17:29 - 00444656 _____ C:\Users\AlexSal\Downloads\TheWolfofWallStreet.exe
2014-01-29 17:21 - 2014-01-29 19:24 - 00000000 ____D C:\Program Files (x86)\SupTab
2014-01-29 17:21 - 2014-01-29 19:23 - 00000000 ____D C:\ProgramData\WPM
2014-01-29 17:21 - 2014-01-29 19:23 - 00000000 ____D C:\ProgramData\IePluginService
2014-01-28 11:32 - 2014-01-28 11:32 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{DC93C29F-A760-4734-A73C-7216400142AB}
2014-01-26 14:08 - 2014-01-26 14:08 - 00000000 ____D C:\Users\AlexSal\Desktop\Alte Firefox-Daten
2014-01-26 13:13 - 2014-01-26 13:13 - 00002776 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-01-26 13:13 - 2014-01-26 13:13 - 00000826 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-01-26 13:13 - 2014-01-26 13:13 - 00000000 ____D C:\Program Files\CCleaner
2014-01-26 13:12 - 2014-01-26 13:12 - 04721920 _____ (Piriform Ltd) C:\Users\AlexSal\Downloads\ccsetup410.exe
2014-01-26 11:46 - 2014-01-29 17:20 - 00001353 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-26 11:46 - 2014-01-26 11:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-26 11:46 - 2014-01-26 11:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-26 10:44 - 2014-01-26 10:44 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{0977EF59-6751-458C-945A-6C64687DC755}
2014-01-24 23:49 - 2014-01-24 23:49 - 00128861 _____ C:\Users\AlexSal\Desktop\Čo ťa na literatúre nenaučili #4 - Jack Kerouac _ REFRESHER.sk.htm
2014-01-24 23:49 - 2014-01-24 23:49 - 00000000 ____D C:\Users\AlexSal\Desktop\Čo ťa na literatúre nenaučili #4 - Jack Kerouac _ REFRESHER.sk-Dateien
2014-01-24 23:47 - 2014-01-24 23:47 - 00066106 _____ C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht.htm
2014-01-24 23:47 - 2014-01-24 23:47 - 00000000 ____D C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht-Dateien
2014-01-23 12:06 - 2014-01-28 14:39 - 00000000 ____D C:\Users\AlexSal\Desktop\Klausurvorbereitung Uwi
2014-01-21 11:05 - 2014-01-21 15:46 - 00000000 ____D C:\Users\AlexSal\Desktop\Labor Boden 2
2014-01-18 17:27 - 2014-01-18 17:27 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{F69304CF-E1C4-4B94-844A-EEBB93BBFDA4}
2014-01-13 10:59 - 2014-01-13 11:00 - 33952200 _____ (                                                            ) C:\Users\AlexSal\Downloads\ACER.1.5.3501.22428_AVC121031-01(3).exe
2014-01-13 10:58 - 2013-08-10 06:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-01-13 10:58 - 2013-08-10 06:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-01-13 10:58 - 2013-08-10 06:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-01-13 10:58 - 2013-08-10 06:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-01-13 10:58 - 2013-08-10 06:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-01-13 10:58 - 2013-08-10 06:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-01-13 10:58 - 2013-08-10 06:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-01-13 10:58 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-01-13 10:58 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-01-13 10:58 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-01-13 10:58 - 2013-08-10 04:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-01-13 10:58 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-01-13 10:58 - 2013-08-10 03:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-01-13 10:58 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-01-13 10:53 - 2014-01-13 10:53 - 33952200 _____ (                                                            ) C:\Users\AlexSal\Downloads\ACER.1.5.3501.22428_AVC121031-01(2).exe
2014-01-09 22:21 - 2014-01-09 22:21 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{61F426A1-1F99-41C6-B9D8-9C181E2D2AE6}
2014-01-06 22:24 - 2014-01-06 22:24 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{9A582D96-5600-428D-BE99-7CDB8FDD2F0D}
2014-01-01 20:10 - 2014-01-23 11:02 - 00000000 ____D C:\Users\AlexSal\AppData\Local\Spotify

==================== One Month Modified Files and Folders =======

2014-01-30 14:47 - 2014-01-30 14:46 - 00021101 _____ C:\Users\AlexSal\Downloads\FRST.txt
2014-01-30 14:46 - 2014-01-30 14:46 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64(1).exe
2014-01-30 14:46 - 2014-01-30 14:46 - 00000000 ____D C:\FRST
2014-01-30 14:44 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-30 14:44 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-30 14:42 - 2013-12-30 22:15 - 00000000 ____D C:\Users\AlexSal\AppData\Roaming\Spotify
2014-01-30 14:39 - 2013-11-29 08:23 - 00000000 ___RD C:\Users\AlexSal\Dropbox
2014-01-30 14:39 - 2013-11-19 15:14 - 00000000 ____D C:\Users\AlexSal\AppData\Roaming\Dropbox
2014-01-30 14:38 - 2013-06-21 17:08 - 00000000 ____D C:\Users\AlexSal\AppData\Roaming\Skype
2014-01-30 14:36 - 2014-01-29 21:19 - 00000336 _____ C:\Windows\setupact.log
2014-01-30 14:36 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-29 23:01 - 2014-01-29 19:53 - 00000000 ____D C:\AdwCleaner
2014-01-29 23:00 - 2014-01-29 23:00 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner(1).exe
2014-01-29 22:49 - 2012-04-26 06:12 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-29 22:44 - 2014-01-29 21:47 - 00000000 ____D C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-01-29 22:30 - 2014-01-29 22:30 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184(1).exe
2014-01-29 22:29 - 2014-01-29 22:29 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184.exe
2014-01-29 22:26 - 2014-01-29 22:26 - 01037068 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT.exe
2014-01-29 22:21 - 2014-01-29 22:21 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64.exe
2014-01-29 21:49 - 2014-01-29 21:49 - 00000000 _____ C:\autoexec.bat
2014-01-29 21:48 - 2014-01-29 21:48 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-29 21:47 - 2014-01-29 21:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\AlexSal\Downloads\SpyHunter-Installer.exe
2014-01-29 21:39 - 2014-01-29 21:39 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner.exe
2014-01-29 21:27 - 2014-01-29 21:27 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner-3.018(1).exe
2014-01-29 21:19 - 2014-01-29 21:19 - 00020396 _____ C:\Windows\PFRO.log
2014-01-29 21:19 - 2014-01-29 21:19 - 00000000 _____ C:\Windows\setuperr.log
2014-01-29 20:12 - 2014-01-29 20:12 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D C:\Users\AlexSal\AppData\Roaming\Malwarebytes
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-29 19:56 - 2014-01-29 19:56 - 00002104 _____ C:\Users\AlexSal\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-01-29 19:52 - 2014-01-29 19:52 - 01166132 _____ C:\Users\AlexSal\Downloads\adwcleaner-3.018.exe
2014-01-29 19:24 - 2014-01-29 17:21 - 00000000 ____D C:\Program Files (x86)\SupTab
2014-01-29 19:23 - 2014-01-29 17:21 - 00000000 ____D C:\ProgramData\WPM
2014-01-29 19:23 - 2014-01-29 17:21 - 00000000 ____D C:\ProgramData\IePluginService
2014-01-29 17:29 - 2014-01-29 17:29 - 00444656 _____ C:\Users\AlexSal\Downloads\TheWolfofWallStreet.exe
2014-01-29 17:20 - 2014-01-26 11:46 - 00001353 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-29 17:20 - 2013-06-19 02:01 - 00001639 _____ C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-28 14:39 - 2014-01-23 12:06 - 00000000 ____D C:\Users\AlexSal\Desktop\Klausurvorbereitung Uwi
2014-01-28 11:32 - 2014-01-28 11:32 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{DC93C29F-A760-4734-A73C-7216400142AB}
2014-01-26 14:08 - 2014-01-26 14:08 - 00000000 ____D C:\Users\AlexSal\Desktop\Alte Firefox-Daten
2014-01-26 13:14 - 2013-07-04 08:09 - 00000000 ____D C:\Users\AlexSal\AppData\Roaming\Azureus
2014-01-26 13:14 - 2013-06-28 13:47 - 00000000 ____D C:\Windows\Minidump
2014-01-26 13:14 - 2013-06-21 19:46 - 00000000 ____D C:\Users\AlexSal\AppData\Local\CrashDumps
2014-01-26 13:14 - 2007-07-12 02:49 - 00000000 ____D C:\Windows\Panther
2014-01-26 13:13 - 2014-01-26 13:13 - 00002776 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-01-26 13:13 - 2014-01-26 13:13 - 00000826 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-01-26 13:13 - 2014-01-26 13:13 - 00000000 ____D C:\Program Files\CCleaner
2014-01-26 13:12 - 2014-01-26 13:12 - 04721920 _____ (Piriform Ltd) C:\Users\AlexSal\Downloads\ccsetup410.exe
2014-01-26 11:46 - 2014-01-26 11:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-26 11:46 - 2014-01-26 11:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-26 10:45 - 2013-12-09 16:41 - 00000000 ____D C:\Users\AlexSal\Desktop\Fahhradunfall
2014-01-26 10:44 - 2014-01-26 10:44 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{0977EF59-6751-458C-945A-6C64687DC755}
2014-01-24 23:49 - 2014-01-24 23:49 - 00128861 _____ C:\Users\AlexSal\Desktop\Čo ťa na literatúre nenaučili #4 - Jack Kerouac _ REFRESHER.sk.htm
2014-01-24 23:49 - 2014-01-24 23:49 - 00000000 ____D C:\Users\AlexSal\Desktop\Čo ťa na literatúre nenaučili #4 - Jack Kerouac _ REFRESHER.sk-Dateien
2014-01-24 23:47 - 2014-01-24 23:47 - 00066106 _____ C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht.htm
2014-01-24 23:47 - 2014-01-24 23:47 - 00000000 ____D C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht-Dateien
2014-01-24 15:40 - 2013-06-21 03:30 - 00000000 ____D C:\Users\AlexSal\Desktop\Alex
2014-01-23 23:34 - 2013-04-28 18:45 - 00644310 _____ C:\Windows\system32\perfh007.dat
2014-01-23 23:34 - 2013-04-28 18:45 - 00126580 _____ C:\Windows\system32\perfc007.dat
2014-01-23 23:34 - 2009-07-14 06:13 - 01473578 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-23 11:02 - 2014-01-01 20:10 - 00000000 ____D C:\Users\AlexSal\AppData\Local\Spotify
2014-01-23 11:01 - 2013-10-07 22:08 - 00000000 ____D C:\Users\AlexSal\Desktop\Z plochy
2014-01-21 15:46 - 2014-01-21 11:05 - 00000000 ____D C:\Users\AlexSal\Desktop\Labor Boden 2
2014-01-18 17:27 - 2014-01-18 17:27 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{F69304CF-E1C4-4B94-844A-EEBB93BBFDA4}
2014-01-16 21:24 - 2013-11-29 08:23 - 00000989 _____ C:\Users\AlexSal\Desktop\Dropbox.lnk
2014-01-16 21:24 - 2013-11-19 15:14 - 00000553 _____ C:\Windows\wininit.ini
2014-01-16 21:24 - 2013-11-19 15:14 - 00000000 ____D C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-16 21:24 - 2013-06-19 02:01 - 00000000 ___RD C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-16 21:17 - 2012-04-26 05:56 - 00000000 ____D C:\Program Files (x86)\Acer
2014-01-16 16:46 - 2013-11-22 10:38 - 00000000 ____D C:\ProgramData\Cisco
2014-01-16 16:46 - 2013-11-22 10:38 - 00000000 ____D C:\Program Files (x86)\Cisco
2014-01-15 19:20 - 2013-06-27 21:04 - 00000000 ____D C:\Program Files\Microsoft Office 15
2014-01-14 17:25 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2014-01-13 11:09 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-13 11:09 - 2009-07-14 05:45 - 00451520 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-13 11:08 - 2010-11-21 08:17 - 00000000 ____D C:\Program Files\Windows Journal
2014-01-13 11:08 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2014-01-13 11:08 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2014-01-13 11:00 - 2014-01-13 10:59 - 33952200 _____ (                                                            ) C:\Users\AlexSal\Downloads\ACER.1.5.3501.22428_AVC121031-01(3).exe
2014-01-13 10:58 - 2013-06-26 10:12 - 01500444 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-13 10:58 - 2013-06-26 10:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2014-01-13 10:54 - 2013-06-27 21:12 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2014-01-13 10:54 - 2013-06-27 21:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2014-01-13 10:53 - 2014-01-13 10:53 - 33952200 _____ (                                                            ) C:\Users\AlexSal\Downloads\ACER.1.5.3501.22428_AVC121031-01(2).exe
2014-01-09 22:21 - 2014-01-09 22:21 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{61F426A1-1F99-41C6-B9D8-9C181E2D2AE6}
2014-01-06 22:24 - 2014-01-06 22:24 - 00000000 ____D C:\Users\AlexSal\AppData\Local\{9A582D96-5600-428D-BE99-7CDB8FDD2F0D}
2014-01-04 11:15 - 2013-12-09 17:13 - 00000000 ____D C:\Users\AlexSal\Desktop\Fall Schlüsseldienst

Some content of TEMP:
====================
C:\Users\AlexSal\AppData\Local\Temp\avgnt.exe
C:\Users\AlexSal\AppData\Local\Temp\Quarantine.exe
C:\Users\AlexSal\AppData\Local\Temp\SHSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 13:57

==================== End Of Log ============================

--- --- ---

cosinus · 30.01.2014, 15:44

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

SoloAlex · 12.02.2014, 19:14

Hier der Bericht von AdwCleaner :

Code:

ATTFilter

# AdwCleaner v3.018 - Bericht erstellt am 12/02/2014 um 08:33:13
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : AlexSal - ALEXSAL-PC
# Gestartet von : C:\Users\AlexSal\Downloads\adwcleaner-3.018(2).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\prefs.js ]


*************************

AdwCleaner[R0].txt - [1978 octets] - [29/01/2014 19:53:17]
AdwCleaner[R1].txt - [1638 octets] - [29/01/2014 21:27:57]
AdwCleaner[R2].txt - [1002 octets] - [29/01/2014 21:40:28]
AdwCleaner[R3].txt - [1065 octets] - [29/01/2014 23:01:05]
AdwCleaner[R4].txt - [1192 octets] - [12/02/2014 08:32:33]
AdwCleaner[S0].txt - [1602 octets] - [29/01/2014 21:30:16]
AdwCleaner[S1].txt - [1127 octets] - [29/01/2014 23:01:42]
AdwCleaner[S2].txt - [1114 octets] - [12/02/2014 08:33:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1174 octets] ##########

Leider funktioniert der Download des Junkware Removal Tools bei mir nicht! Ich habe den JRT direkt in deiner letzten Nachricht angeklickt, Download wurde nicht ausgeführt, 2 Sekunden war ein schwarzes Kästchen zu sehen, und dann war es weg. Ich habe versucht auch von anderen Anbietern eine sicheren Download von JRT zu finden, konnte aber nichts finden oder es hat auch nicht funktioniert.

Übrigens habe ich bei meinem Antivirus-Programm Avira in der Qarantäne den Schaden entdeckt - ich habe mir den Virus TR/Agent.5252208 eingefangen

Wie soll ich denn jetzt weiter vorgehen, weiter versuchen eine passende Versuon JRT zu installieren? Gibt es da vielleicht Alternativen?
Ich bin echt schon ziemlich verloren

Vielen dank schon mal.
Mit freundlichen Grüßen

Alexandra

cosinus · 12.02.2014, 22:15

Alle Logs von Avira mit Funden posten ggf Screenshots erstellen und hier posten

SoloAlex · 13.02.2014, 08:10

statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus?-virus1.jpg

statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus?-virus2.jpg

statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus?-virus3.jpg

cosinus · 13.02.2014, 10:06

Was lädste denn da runter? Illegales Zeug, wolltest nen Film haben und hast nen Fake bekommen oder wie

SoloAlex · 13.02.2014, 11:49

Ja. Das erste mal seit ungefähr einem Jahr ist man so "illegal" und will sich mal einen Film runterladen, und dann passiert sowas.
Wird mir jetzt keine Hilfe mehr gewährleistet?

cosinus · 13.02.2014, 13:19

Nein, ich versteh nur nicht warum denn immer eine "oh wunder oh wunder" Reaktion kommt wenn man sich bewusst in den Underground begibt und wissen muss, dass man dort Müll zum Download bekommt

Bitte mal ein Log mit CF machen

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

SoloAlex · 19.02.2014, 17:40

Du gibst dich wahrscheinlich viel mit Computerlaien ab, die wahrscheinlich (so wie ich) erst später überhaupt realisieren, sich in der underground Szene zu bewegen und dann ihre Lektion bekommen

So, hier der Logfile (mein Avira hat trotzdem angezeigt etwas geblockt zu haben) :

Code:

ATTFilter

ComboFix 14-02-19.01 - AlexSal 19.02.2014  17:19:12.1.4 - x64
ausgeführt von:: c:\users\AlexSal\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\SearchProtect
c:\program files (x86)\SearchProtect\EULA.txt
c:\program files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
c:\program files (x86)\SearchProtect\Main\bin\SPTool.dll
c:\program files (x86)\SearchProtect\Main\bin\uninstall.exe
c:\program files (x86)\SearchProtect\Main\rep\SystemRepository.dat
c:\program files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
c:\program files (x86)\SearchProtect\UI\bin\cltmngui.exe
c:\program files (x86)\SearchProtect\UI\dialogs\bubble\bubble.css
c:\program files (x86)\SearchProtect\UI\dialogs\bubble\bubble.html
c:\program files (x86)\SearchProtect\UI\dialogs\bubble\bubble.js
c:\program files (x86)\SearchProtect\UI\dialogs\bubble\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bg.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\hez.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\text-field.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\v.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\x.png
c:\program files (x86)\SearchProtect\UI\dialogs\libs\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\main.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js
c:\program files (x86)\SearchProtect\UI\dialogs\protection\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\protection\protection.css
c:\program files (x86)\SearchProtect\UI\dialogs\protection\protection.html
c:\program files (x86)\SearchProtect\UI\dialogs\protection\protection.js
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js
c:\program files (x86)\SearchProtect\UI\dialogs\settings.html
c:\program files (x86)\SearchProtect\UI\dialogs\settings\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\settings\settings.css
c:\program files (x86)\SearchProtect\UI\dialogs\settings\settings.html
c:\program files (x86)\SearchProtect\UI\dialogs\settings\settings.js
c:\program files (x86)\SearchProtect\UI\dialogs\style.css
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_vpnagent
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-01-19 bis 2014-02-19  ))))))))))))))))))))))))))))))
.
.
2014-02-19 16:24 . 2014-02-19 16:24	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-02-13 12:39 . 2014-02-13 12:39	--------	d-----w-	c:\windows\SysWow64\SearchProtect
2014-02-12 10:12 . 2014-02-12 10:12	--------	d-----w-	c:\users\AlexSal\AppData\Local\SearchProtect
2014-02-10 17:39 . 2013-10-14 17:00	28368	----a-w-	c:\windows\system32\IEUDINIT.EXE
2014-02-02 17:13 . 2013-09-25 02:26	95680	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2014-02-02 17:08 . 2013-05-10 04:30	167424	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2014-02-02 17:08 . 2013-05-10 03:48	164864	----a-w-	c:\program files (x86)\Windows Media Player\wmplayer.exe
2014-02-02 17:08 . 2013-05-10 05:56	12625920	----a-w-	c:\windows\system32\wmploc.DLL
2014-02-02 17:08 . 2013-05-10 04:56	12625408	----a-w-	c:\windows\SysWow64\wmploc.DLL
2014-02-02 17:07 . 2013-05-10 05:56	14631424	----a-w-	c:\windows\system32\wmp.dll
2014-01-30 13:46 . 2014-01-30 13:47	--------	d-----w-	C:\FRST
2014-01-29 20:48 . 2014-01-29 20:48	--------	d-----w-	c:\program files\Enigma Software Group
2014-01-29 20:47 . 2014-01-29 21:44	--------	d-----w-	c:\windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-01-29 20:47 . 2014-01-29 20:47	--------	d-----w-	c:\program files (x86)\Common Files\Wise Installation Wizard
2014-01-29 19:12 . 2014-01-29 19:12	--------	d-----w-	c:\users\AlexSal\AppData\Roaming\Malwarebytes
2014-01-29 19:12 . 2014-01-29 19:12	--------	d-----w-	c:\programdata\Malwarebytes
2014-01-29 18:53 . 2014-02-12 07:33	--------	d-----w-	C:\AdwCleaner
2014-01-29 16:21 . 2014-01-29 18:23	--------	d-----w-	c:\programdata\IePluginService
2014-01-29 16:21 . 2014-01-29 18:24	--------	d-----w-	c:\program files (x86)\SupTab
2014-01-29 16:21 . 2014-01-29 18:23	--------	d-----w-	c:\programdata\WPM
2014-01-26 12:13 . 2014-01-26 12:13	--------	d-----w-	c:\program files\CCleaner
2014-01-26 10:46 . 2014-02-15 19:10	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-05 17:49 . 2012-04-26 05:12	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-05 17:49 . 2012-04-26 05:12	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-15 18:19 . 2013-06-27 20:21	566480	----a-w-	c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2014-01-06 19:23 . 2014-01-06 19:23	4558848	----a-w-	c:\windows\SysWow64\GPhotos.scr
2013-12-18 10:06 . 2013-09-07 14:51	84720	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-12-18 10:06 . 2013-09-07 07:10	131576	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-12-18 10:06 . 2013-09-07 07:10	108440	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-12-12 22:36 . 2013-12-12 22:36	11152	----a-w-	c:\windows\SysWow64\vpncategories.dll
2013-12-12 22:36 . 2013-12-12 22:36	34192	----a-w-	c:\windows\SysWow64\vpnevents.dll
2013-12-12 22:14 . 2013-10-10 21:29	112496	----a-r-	c:\windows\system32\drivers\acsock64.sys
2013-11-25 13:51 . 2013-09-07 07:10	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-07-03 12:09	222712	----a-w-	c:\users\AlexSal\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-07-03 12:09	222712	----a-w-	c:\users\AlexSal\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-07-03 12:09	222712	----a-w-	c:\users\AlexSal\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\AlexSal\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\AlexSal\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\AlexSal\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-14 20584608]
"Spotify"="c:\users\AlexSal\AppData\Roaming\Spotify\spotify.exe" [2014-01-16 6118400]
"Google+ Auto Backup"="c:\users\AlexSal\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe" [2014-01-06 3619096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-09-20 341360]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Dolby Home Theater v4"="c:\dolby pcee4\pcee4.exe" [2011-06-01 506712]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2012-03-23 1105488]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-26 291608]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-18 684600]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-10-28 185896]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2013-12-12 707472]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
R2 CltMngSvc;Search Protect by Conduit Service;c:\progra~2\SearchProtect\Main\bin\CltMngSvc.exe;c:\progra~2\SearchProtect\Main\bin\CltMngSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [x]
R2 Update lookinglink;Update lookinglink;c:\program files (x86)\lookinglink\updatelookinglink.exe;c:\program files (x86)\lookinglink\updatelookinglink.exe [x]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys;c:\windows\SYSNATIVE\DRIVERS\acsock64.sys [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 irstrtsv;Intel(R) Rapid Start Technology Service;c:\windows\SysWOW64\irstrtsv.exe;c:\windows\SysWOW64\irstrtsv.exe [x]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 excsd;ExpressCache Storage Filter Driver;c:\windows\system32\DRIVERS\excsd.sys;c:\windows\SYSNATIVE\DRIVERS\excsd.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 excfs;ExpressCache File System Filter Driver;c:\windows\system32\DRIVERS\excfs.sys;c:\windows\SYSNATIVE\DRIVERS\excfs.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 ExpressCache;ExpressCache;c:\program files\Diskeeper Corporation\ExpressCache\ExpressCache.exe;c:\program files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [x]
S2 FFSOpzSvc;Sleep memory optimizer;c:\program files\Sleep Memory Optimizer\FFSService.exe;c:\program files\Sleep Memory Optimizer\FFSService.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 OfficeSvc;Microsoft Office-Dienst;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [x]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 USecuAppSvc;Acer Theft Shield Service;c:\program files\Acer\Acer Theft Shield\USecuAppSvc.exe;c:\program files\Acer\Acer Theft Shield\USecuAppSvc.exe [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 irstrtdv;Intel(R) Rapid Start Technology Driver;c:\windows\system32\DRIVERS\irstrtdv.sys;c:\windows\SYSNATIVE\DRIVERS\irstrtdv.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 17:49]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-07-03 12:09	261624	----a-w-	c:\users\AlexSal\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-07-03 12:09	261624	----a-w-	c:\users\AlexSal\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-07-03 12:09	261624	----a-w-	c:\users\AlexSal\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112_1\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-01-15 18:20	2331336	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-01-15 18:20	2331336	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-01-15 18:20	2331336	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\AlexSal\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\AlexSal\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\AlexSal\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\AlexSal\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Secure Applicayion"="c:\program files\Acer\Acer Theft Shield\USecuAppClient.exe" [2012-06-07 259728]
"InstantUpdate"="c:\program files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe" [2012-04-07 124520]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-04-22 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-04-22 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-04-22 439064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-04-10 12476520]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-03-09 1158248]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2012-02-28 1020576]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2012-02-28 800416]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2012-02-07 1829768]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPD6BA226A-4230-445C-964C-15D95E91877B&SSPV=
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
mDefault_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
mDefault_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
mStart Page = hxxp://www.awesomehp.com/?type=hp&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1391012422&from=adks&uid=ST500LT012-9WS142_W0V8ZMWCXXXXW0V8ZMWC&q={searchTerms}
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\
FF - prefs.js: browser.search.selectedEngine - Conduit Search
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-MSC - c:\program files\McAfee\MSC\mcuihost.exe
AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Launch Manager\LMutilps32.exe
c:\program files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-02-19  17:30:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-02-19 16:30
.
Vor Suchlauf: 10 Verzeichnis(se), 403.482.726.400 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 408.841.166.848 Bytes frei
.
- - End Of File - - 6AF9B17D73BDBD8706F66F00BED4DFCC

cosinus · 19.02.2014, 22:09

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

SoloAlex · 20.02.2014, 08:55

Code:

ATTFilter

# AdwCleaner v3.019 - Bericht erstellt am 20/02/2014 um 07:54:10
# Aktualisiert 17/02/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : AlexSal - ALEXSAL-PC
# Gestartet von : C:\Users\AlexSal\Downloads\adwcleaner(3).exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : CltMngSvc

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\IePluginService
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Windows\SysWOW64\Searchprotect
Ordner Gelöscht : C:\Users\AlexSal\AppData\Local\Searchprotect
Datei Gelöscht : C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\searchplugins\conduit-search.xml
Datei Gelöscht : C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\user.js

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\AlexSal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\AlexSal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\AlexSal\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}
Schlüssel Gelöscht : HKLM\Software\caphyon
Schlüssel Gelöscht : HKLM\Software\hdcode
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\supTab
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\Wpm
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Speedchecker Limited

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16518

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "Conduit Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Conduit Search");

*************************

AdwCleaner[R0].txt - [1978 octets] - [29/01/2014 19:53:17]
AdwCleaner[R1].txt - [1638 octets] - [29/01/2014 21:27:57]
AdwCleaner[R2].txt - [1002 octets] - [29/01/2014 21:40:28]
AdwCleaner[R3].txt - [1065 octets] - [29/01/2014 23:01:05]
AdwCleaner[R4].txt - [1192 octets] - [12/02/2014 08:32:33]
AdwCleaner[R5].txt - [6436 octets] - [20/02/2014 07:53:38]
AdwCleaner[S0].txt - [1602 octets] - [29/01/2014 21:30:16]
AdwCleaner[S1].txt - [1127 octets] - [29/01/2014 23:01:42]
AdwCleaner[S2].txt - [1254 octets] - [12/02/2014 08:33:13]
AdwCleaner[S3].txt - [4770 octets] - [20/02/2014 07:54:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [4830 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by AlexSal on 20.02.2014 at  8:29:35,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{03305B17-DA29-4DA3-B9FC-21F7CC81133C}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{0977EF59-6751-458C-945A-6C64687DC755}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{0B5780B2-E69B-4E23-9D98-06DDC9DAA566}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{107AAE78-A0AB-4C7B-AD0C-AA17E2F8E021}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{24DCA97E-E163-405E-89DD-3C11BEEDC183}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{29DEB0D8-7102-4198-8BA9-86A3A9FB7B5B}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{3F1F3054-0631-4611-87D4-7C3B75B36C1A}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{427F31AF-6524-4D6E-B071-192B49CFA5A5}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{48C8CFA0-D0DA-4BE7-96FB-EA1192FDF6D0}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{530F5E74-D548-4E1E-BB09-7C8A7E6DDF30}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{5FB51C4F-D1B4-4F60-9AD3-1F903A9DB909}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{61F426A1-1F99-41C6-B9D8-9C181E2D2AE6}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{6A9006F8-A5DA-4B0B-853B-B0E2ECF91FA1}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{717EE46A-C08F-46BB-B709-6869ADDA9612}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{73C4F992-F3A3-4512-8C2A-1F94069010F9}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{7A63CAE2-9F5F-4C89-9740-3C04F0CDEC0B}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{8155365D-6C54-4E14-A693-F16B441329E0}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{9A582D96-5600-428D-BE99-7CDB8FDD2F0D}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{9CB91FED-6EC5-475A-9445-C7BD8947A601}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{A16E88F3-F42D-4F77-A474-3C1096E06CD3}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{A785E939-F623-4F0E-B95F-DEB0D6341A93}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{AD5888AE-ED5E-43AD-9890-998E585CBF1A}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{B17BBBAD-3F95-4297-82C7-70366A31A1E1}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{B1CBBF0D-DBD5-41A1-BF9F-DBD08A6C9DC3}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{BEEC5413-83BA-4504-8ADC-18BDDD7A20FF}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{C0424D95-CED1-4FFC-BE77-F98CCFA4D348}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{C652B871-DCAF-400B-A510-BCF5F9A64AD9}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{DC93C29F-A760-4734-A73C-7216400142AB}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{E50C3075-4B7C-4AA0-9965-D30FA8AE7103}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{EA004513-5174-4A96-8175-A3839D733FC2}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{ECB3D053-4E5B-4E1F-90EE-27846616B3B1}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{F69304CF-E1C4-4B94-844A-EEBB93BBFDA4}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{F6A5881D-1719-4259-8F67-C4F48A7F4EE5}
Successfully deleted: [Empty Folder] C:\Users\AlexSal\appdata\local\{F9D1758D-20BE-4DB8-8E38-0A1D0F75B4C6}



~~~ FireFox

Emptied folder: C:\Users\AlexSal\AppData\Roaming\mozilla\firefox\profiles\0yus8eob.default-1390741700440\minidumps [23 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.02.2014 at  8:35:05,95
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2014
Ran by AlexSal (administrator) on ALEXSAL-PC on 20-02-2014 08:36:53
Running from C:\Users\AlexSal\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
() C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Spotify Ltd) C:\Users\AlexSal\AppData\Roaming\Spotify\spotify.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(Dropbox, Inc.) C:\Users\AlexSal\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PMMUpdate.exe
() C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files\Sleep Memory Optimizer\FFSService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Farbar) C:\Users\AlexSal\Downloads\FRST64(2).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Secure Applicayion] - C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe [259728 2012-06-07] ()
HKLM\...\Run: [InstantUpdate] - C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-07] ()
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12476520 2012-04-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2816336 2012-03-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1020576 2012-02-28] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800416 2012-02-28] (Atheros Commnucations)
HKLM\...\Run: [IntelTBRunOnce] - wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-26] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2014-02-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2013-12-12] (Cisco Systems, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3221737769-90060885-3432294915-1000\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3221737769-90060885-3432294915-1000\...\Run: [Spotify] - C:\Users\AlexSal\AppData\Roaming\Spotify\spotify.exe [6118400 2014-01-16] (Spotify Ltd)
HKU\S-1-5-21-3221737769-90060885-3432294915-1000\...\Run: [Google+ Auto Backup] - C:\Users\AlexSal\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3619096 2014-01-06] (Google Inc.)
Startup: C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\AlexSal\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: No Name - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -  No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -  No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: No Name - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -  No File
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -  No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: 141.39.208.68	vpn.leuphana.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440
FF NewTab: chrome://lightning/content/newtab.html
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\awesomehp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ep - C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi [2014-02-20]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [lightningnewtab@gmail.com] - C:\Users\AlexSal\AppData\Roaming\Mozilla\Firefox\Profiles\0yus8eob.default-1390741700440\extensions\lightningnewtab@gmail.com.xpi

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2014-02-18] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-02-17] (Diskeeper Corporation)
R2 FFSOpzSvc; C:\Program Files\Sleep Memory Optimizer\FFSService.exe [141192 2011-09-17] (Acer Incorporated)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-15] ()
S3 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [192856 2012-03-14] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-10-31] (Microsoft Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
R2 USecuAppSvc; C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe [235664 2012-06-07] ()
S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [X]
S2 Update lookinglink; "C:\Program Files (x86)\lookinglink\updatelookinglink.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-02-17] (Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [92976 2012-02-17] (Diskeeper Corporation)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-14] (Intel Corporation)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S0 mfewfpk; system32\drivers\mfewfpk.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-20 08:36 - 2014-02-20 08:36 - 02153472 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64(2).exe
2014-02-20 08:35 - 2014-02-20 08:35 - 00004449 _____ () C:\Users\AlexSal\Desktop\JRT.txt
2014-02-20 08:29 - 2014-02-20 08:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-20 08:27 - 2014-02-20 08:27 - 01037734 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(4).exe
2014-02-20 07:55 - 2014-02-20 07:55 - 00004926 _____ () C:\Users\AlexSal\Desktop\AdwCleaner[S3].txt
2014-02-20 07:52 - 2014-02-20 07:52 - 01241834 _____ () C:\Users\AlexSal\Downloads\adwcleaner(3).exe
2014-02-19 18:43 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-19 18:43 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-19 18:42 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-19 18:42 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-19 18:42 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-19 18:42 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-19 18:42 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-19 18:42 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-19 18:42 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-19 18:42 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-19 18:42 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-19 18:42 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-19 18:42 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-19 18:42 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-19 18:42 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-19 18:42 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-19 18:42 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-19 18:42 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-19 18:42 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-19 18:42 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-19 18:42 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-19 18:42 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-19 18:42 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-19 18:42 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-19 18:42 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-19 18:42 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-19 18:42 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-19 18:42 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-19 18:42 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-19 18:42 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-19 18:42 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-19 18:42 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-19 18:42 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-19 18:42 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-19 18:42 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-19 18:42 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-19 18:42 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-19 18:42 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-19 18:42 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-19 18:42 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-19 18:42 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-19 17:34 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-19 17:34 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-19 17:34 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-19 17:34 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-19 17:34 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-19 17:34 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-19 17:34 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-19 17:34 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-19 17:34 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-19 17:34 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-19 17:34 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-19 17:34 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-19 17:34 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-19 17:34 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-19 17:34 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-19 17:34 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-19 17:34 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-19 17:34 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-19 17:34 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-19 17:34 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-19 17:34 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-19 17:34 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-19 17:34 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-19 17:34 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-19 17:34 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-19 17:34 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-19 17:34 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-19 17:34 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-19 17:30 - 2014-02-19 17:30 - 00035609 _____ () C:\ComboFix.txt
2014-02-19 17:18 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-19 17:18 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-19 17:18 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-19 17:18 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-19 17:18 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-19 17:18 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-19 17:18 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-19 17:18 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-19 17:17 - 2014-02-19 17:30 - 00000000 ____D () C:\Qoobox
2014-02-19 17:17 - 2014-02-19 17:28 - 00000000 ____D () C:\Windows\erdnt
2014-02-19 17:11 - 2014-02-19 17:11 - 00002094 _____ () C:\Users\AlexSal\Desktop\Avira Free Antivirus Profil Vollständige Systemprüfung.LNK
2014-02-19 17:09 - 2014-02-19 17:09 - 05183254 ____R (Swearware) C:\Users\AlexSal\Downloads\ComboFix.exe
2014-02-15 08:52 - 2014-02-15 08:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 18:17 - 2014-02-13 18:17 - 00077349 _____ () C:\Users\AlexSal\Desktop\Stickstoffkreislauf – Wikipedia.htm
2014-02-13 18:17 - 2014-02-13 18:17 - 00000000 ____D () C:\Users\AlexSal\Desktop\Stickstoffkreislauf – Wikipedia-Dateien
2014-02-13 16:45 - 2014-02-13 16:45 - 03221891 _____ () C:\Users\AlexSal\Desktop\Erstifahrt - Dropbox.htm
2014-02-13 16:45 - 2014-02-13 16:45 - 00000000 ____D () C:\Users\AlexSal\Desktop\Erstifahrt - Dropbox-Dateien
2014-02-13 15:34 - 2014-02-13 15:34 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-02-12 19:04 - 2014-02-12 19:04 - 01037530 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(3).exe
2014-02-12 19:03 - 2014-02-12 19:03 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner(2).exe
2014-02-12 11:13 - 2014-02-12 11:13 - 00930440 _____ (CNET Download.com) C:\Users\AlexSal\Downloads\cbsidlm-cbsi176-Junkware_Removal_Tool-ORG-75910255(1).exe
2014-02-12 11:12 - 2014-02-12 11:12 - 00930440 _____ (CNET Download.com) C:\Users\AlexSal\Downloads\cbsidlm-cbsi176-Junkware_Removal_Tool-ORG-75910255.exe
2014-02-12 11:10 - 2014-02-12 11:10 - 00660504 _____ () C:\Users\AlexSal\Downloads\ZipSetup.exe
2014-02-12 11:09 - 2014-02-12 11:09 - 01032220 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(2).exe
2014-02-12 11:08 - 2014-02-12 11:08 - 01037530 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT_6.1.1.exe
2014-02-12 11:07 - 2014-02-12 11:07 - 01037530 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(1).exe
2014-02-12 08:35 - 2014-02-12 08:35 - 00001254 _____ () C:\Users\AlexSal\Desktop\AdwCleaner[S2].txt
2014-02-12 08:31 - 2014-02-12 08:31 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner-3.018(2).exe
2014-02-10 18:39 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2014-02-10 18:32 - 2014-02-10 18:32 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-02-10 18:32 - 2014-02-10 18:32 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-02-10 18:32 - 2014-02-10 18:32 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-02-10 18:32 - 2014-02-10 18:32 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-02-10 18:32 - 2014-02-10 18:32 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-02-10 18:32 - 2014-02-10 18:32 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-02-10 18:32 - 2014-02-10 18:32 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-02-10 18:30 - 2014-02-10 18:39 - 00011243 _____ () C:\Windows\IE11_main.log
2014-02-02 18:14 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-02-02 18:14 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-02-02 18:14 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-02-02 18:14 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-02-02 18:14 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-02-02 18:14 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-02-02 18:14 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-02-02 18:14 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-02-02 18:14 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-02-02 18:14 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-02-02 18:14 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-02-02 18:14 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-02-02 18:14 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-02-02 18:14 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-02-02 18:14 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-02-02 18:14 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-02-02 18:14 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-02-02 18:14 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2014-02-02 18:14 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-02-02 18:14 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2014-02-02 18:14 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-02-02 18:14 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-02-02 18:14 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2014-02-02 18:14 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2014-02-02 18:14 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2014-02-02 18:14 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2014-02-02 18:14 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-02-02 18:14 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2014-02-02 18:14 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2014-02-02 18:14 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2014-02-02 18:14 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-02-02 18:14 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2014-02-02 18:14 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2014-02-02 18:13 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-02-02 18:13 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-02-02 18:13 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-02-02 18:13 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-02-02 18:13 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-02-02 18:13 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-02-02 18:13 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-02-02 18:13 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-02-02 18:13 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-02-02 18:13 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-02-02 18:13 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-02-02 18:13 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-02-02 18:13 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-02-02 18:13 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-02-02 18:13 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2014-02-02 18:13 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-02-02 18:13 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-02-02 18:13 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-02-02 18:13 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-02-02 18:13 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-02-02 18:13 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-02-02 18:13 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-02-02 18:13 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-02-02 18:13 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-02-02 18:13 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-02-02 18:08 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-02-02 18:08 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-02-02 18:08 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-02-02 18:07 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-02-02 17:59 - 2014-02-20 07:54 - 01150285 _____ () C:\Windows\WindowsUpdate.log
2014-01-30 14:47 - 2014-01-30 14:47 - 00028034 _____ () C:\Users\AlexSal\Downloads\Addition.txt
2014-01-30 14:46 - 2014-02-20 08:36 - 00017688 _____ () C:\Users\AlexSal\Downloads\FRST.txt
2014-01-30 14:46 - 2014-02-20 08:36 - 00000000 ____D () C:\FRST
2014-01-30 14:46 - 2014-01-30 14:46 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64(1).exe
2014-01-29 23:00 - 2014-01-29 23:00 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner(1).exe
2014-01-29 22:30 - 2014-01-29 22:30 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184(1).exe
2014-01-29 22:29 - 2014-01-29 22:29 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184.exe
2014-01-29 22:26 - 2014-01-29 22:26 - 01037068 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT.exe
2014-01-29 22:21 - 2014-01-29 22:21 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64.exe
2014-01-29 21:49 - 2014-01-29 21:49 - 00000000 _____ () C:\autoexec.bat
2014-01-29 21:48 - 2014-01-29 21:48 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-01-29 21:47 - 2014-01-29 22:44 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-01-29 21:47 - 2014-01-29 21:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\AlexSal\Downloads\SpyHunter-Installer.exe
2014-01-29 21:39 - 2014-01-29 21:39 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner.exe
2014-01-29 21:27 - 2014-01-29 21:27 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner-3.018(1).exe
2014-01-29 21:19 - 2014-02-20 07:54 - 00003416 _____ () C:\Windows\setupact.log
2014-01-29 21:19 - 2014-02-19 17:24 - 00024206 _____ () C:\Windows\PFRO.log
2014-01-29 21:19 - 2014-01-29 21:19 - 00000000 _____ () C:\Windows\setuperr.log
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Malwarebytes
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-01-29 19:56 - 2014-01-29 19:56 - 00002104 _____ () C:\Users\AlexSal\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-01-29 19:53 - 2014-02-20 07:54 - 00000000 ____D () C:\AdwCleaner
2014-01-29 19:52 - 2014-01-29 19:52 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner-3.018.exe
2014-01-29 17:29 - 2014-01-29 17:29 - 00444656 _____ () C:\Users\AlexSal\Downloads\TheWolfofWallStreet.exe
2014-01-26 13:13 - 2014-01-26 13:13 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-01-26 13:13 - 2014-01-26 13:13 - 00000826 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-01-26 13:13 - 2014-01-26 13:13 - 00000000 ____D () C:\Program Files\CCleaner
2014-01-26 13:12 - 2014-01-26 13:12 - 04721920 _____ (Piriform Ltd) C:\Users\AlexSal\Downloads\ccsetup410.exe
2014-01-26 11:46 - 2014-02-20 07:54 - 00001053 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-26 11:46 - 2014-02-15 20:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-24 23:47 - 2014-01-24 23:47 - 00066106 _____ () C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht.htm
2014-01-24 23:47 - 2014-01-24 23:47 - 00000000 ____D () C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht-Dateien
2014-01-23 12:06 - 2014-02-13 15:02 - 00000000 ____D () C:\Users\AlexSal\Desktop\Klausurvorbereitung Uwi

==================== One Month Modified Files and Folders =======

2014-02-20 08:37 - 2014-01-30 14:46 - 00017688 _____ () C:\Users\AlexSal\Downloads\FRST.txt
2014-02-20 08:36 - 2014-02-20 08:36 - 02153472 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64(2).exe
2014-02-20 08:36 - 2014-01-30 14:46 - 00000000 ____D () C:\FRST
2014-02-20 08:35 - 2014-02-20 08:35 - 00004449 _____ () C:\Users\AlexSal\Desktop\JRT.txt
2014-02-20 08:29 - 2014-02-20 08:29 - 00000000 ____D () C:\Windows\ERUNT
2014-02-20 08:27 - 2014-02-20 08:27 - 01037734 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(4).exe
2014-02-20 08:27 - 2009-07-14 05:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-20 08:27 - 2009-07-14 05:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-20 08:26 - 2013-06-21 17:08 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Skype
2014-02-20 08:25 - 2014-02-02 17:59 - 01150285 _____ () C:\Windows\WindowsUpdate.log
2014-02-20 08:22 - 2013-11-29 08:23 - 00000000 ___RD () C:\Users\AlexSal\Dropbox
2014-02-20 08:22 - 2013-11-19 15:14 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Dropbox
2014-02-20 08:21 - 2013-12-30 22:15 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Spotify
2014-02-20 07:55 - 2014-02-20 07:55 - 00004926 _____ () C:\Users\AlexSal\Desktop\AdwCleaner[S3].txt
2014-02-20 07:54 - 2014-01-29 21:19 - 00003416 _____ () C:\Windows\setupact.log
2014-02-20 07:54 - 2014-01-29 19:53 - 00000000 ____D () C:\AdwCleaner
2014-02-20 07:54 - 2014-01-26 11:46 - 00001053 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-20 07:54 - 2013-06-19 02:01 - 00001003 _____ () C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-20 07:54 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-20 07:52 - 2014-02-20 07:52 - 01241834 _____ () C:\Users\AlexSal\Downloads\adwcleaner(3).exe
2014-02-20 07:49 - 2012-04-26 06:12 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-20 07:35 - 2013-04-28 18:45 - 00654610 _____ () C:\Windows\system32\perfh007.dat
2014-02-20 07:35 - 2013-04-28 18:45 - 00130192 _____ () C:\Windows\system32\perfc007.dat
2014-02-20 07:35 - 2009-07-14 06:13 - 01516102 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-19 17:30 - 2014-02-19 17:30 - 00035609 _____ () C:\ComboFix.txt
2014-02-19 17:30 - 2014-02-19 17:17 - 00000000 ____D () C:\Qoobox
2014-02-19 17:30 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-02-19 17:28 - 2014-02-19 17:17 - 00000000 ____D () C:\Windows\erdnt
2014-02-19 17:25 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-02-19 17:24 - 2014-01-29 21:19 - 00024206 _____ () C:\Windows\PFRO.log
2014-02-19 17:11 - 2014-02-19 17:11 - 00002094 _____ () C:\Users\AlexSal\Desktop\Avira Free Antivirus Profil Vollständige Systemprüfung.LNK
2014-02-19 17:09 - 2014-02-19 17:09 - 05183254 ____R (Swearware) C:\Users\AlexSal\Downloads\ComboFix.exe
2014-02-18 09:54 - 2013-06-21 19:46 - 00000000 ____D () C:\Users\AlexSal\AppData\Local\CrashDumps
2014-02-17 17:58 - 2013-07-02 20:08 - 00000000 ____D () C:\Users\AlexSal\AppData\Local\Google
2014-02-15 21:24 - 2013-06-21 03:30 - 00000000 ____D () C:\Users\AlexSal\Desktop\Alex
2014-02-15 20:10 - 2014-01-26 11:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-15 08:53 - 2014-02-15 08:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 18:17 - 2014-02-13 18:17 - 00077349 _____ () C:\Users\AlexSal\Desktop\Stickstoffkreislauf – Wikipedia.htm
2014-02-13 18:17 - 2014-02-13 18:17 - 00000000 ____D () C:\Users\AlexSal\Desktop\Stickstoffkreislauf – Wikipedia-Dateien
2014-02-13 16:45 - 2014-02-13 16:45 - 03221891 _____ () C:\Users\AlexSal\Desktop\Erstifahrt - Dropbox.htm
2014-02-13 16:45 - 2014-02-13 16:45 - 00000000 ____D () C:\Users\AlexSal\Desktop\Erstifahrt - Dropbox-Dateien
2014-02-13 15:34 - 2014-02-13 15:34 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-02-13 15:02 - 2014-01-23 12:06 - 00000000 ____D () C:\Users\AlexSal\Desktop\Klausurvorbereitung Uwi
2014-02-13 15:01 - 2013-10-07 22:08 - 00000000 ____D () C:\Users\AlexSal\Desktop\Z plochy
2014-02-13 14:20 - 2013-12-09 16:41 - 00000000 ____D () C:\Users\AlexSal\Desktop\Fahhradunfall
2014-02-12 19:04 - 2014-02-12 19:04 - 01037530 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(3).exe
2014-02-12 19:03 - 2014-02-12 19:03 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner(2).exe
2014-02-12 11:46 - 2013-06-19 02:01 - 00000000 ___RD () C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-12 11:42 - 2013-06-19 01:55 - 00111448 _____ () C:\Users\AlexSal\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-12 11:42 - 2009-07-14 05:45 - 00436352 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-12 11:21 - 2012-04-26 06:09 - 00000000 ____D () C:\ProgramData\BackupManager
2014-02-12 11:21 - 2012-04-26 06:09 - 00000000 ____D () C:\Program Files (x86)\NTI
2014-02-12 11:13 - 2014-02-12 11:13 - 00930440 _____ (CNET Download.com) C:\Users\AlexSal\Downloads\cbsidlm-cbsi176-Junkware_Removal_Tool-ORG-75910255(1).exe
2014-02-12 11:12 - 2014-02-12 11:12 - 00930440 _____ (CNET Download.com) C:\Users\AlexSal\Downloads\cbsidlm-cbsi176-Junkware_Removal_Tool-ORG-75910255.exe
2014-02-12 11:10 - 2014-02-12 11:10 - 00660504 _____ () C:\Users\AlexSal\Downloads\ZipSetup.exe
2014-02-12 11:09 - 2014-02-12 11:09 - 01032220 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(2).exe
2014-02-12 11:08 - 2014-02-12 11:08 - 01037530 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT_6.1.1.exe
2014-02-12 11:07 - 2014-02-12 11:07 - 01037530 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT(1).exe
2014-02-12 08:35 - 2014-02-12 08:35 - 00001254 _____ () C:\Users\AlexSal\Desktop\AdwCleaner[S2].txt
2014-02-12 08:31 - 2014-02-12 08:31 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner-3.018(2).exe
2014-02-12 08:15 - 2014-01-01 20:10 - 00000000 ____D () C:\Users\AlexSal\AppData\Local\Spotify
2014-02-11 08:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-10 18:43 - 2007-07-12 02:49 - 00000000 ____D () C:\Windows\Panther
2014-02-10 18:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-02-10 18:39 - 2014-02-10 18:30 - 00011243 _____ () C:\Windows\IE11_main.log
2014-02-10 18:32 - 2014-02-10 18:32 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-02-10 18:32 - 2014-02-10 18:32 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-02-10 18:32 - 2014-02-10 18:32 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-02-10 18:32 - 2014-02-10 18:32 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-02-10 18:32 - 2014-02-10 18:32 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-02-10 18:32 - 2014-02-10 18:32 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-02-10 18:32 - 2014-02-10 18:32 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-02-10 18:32 - 2014-02-10 18:32 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-02-10 18:32 - 2014-02-10 18:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-02-06 13:16 - 2014-02-19 18:42 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-19 18:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-19 18:42 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-19 18:42 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-19 18:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-19 18:42 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-19 18:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-19 18:42 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-19 18:42 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-19 18:42 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-19 18:42 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-19 18:42 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-19 18:42 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-19 18:42 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-19 18:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-19 18:42 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-19 18:42 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-19 18:42 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-19 18:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-19 18:42 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-19 18:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-19 18:42 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-19 18:42 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-19 18:42 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-19 18:42 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-19 18:42 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-19 18:42 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-19 18:42 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:25 - 2014-02-19 18:42 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:24 - 2014-02-19 18:42 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-19 18:42 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-19 18:42 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-19 18:42 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-19 18:42 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-19 18:42 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-19 18:42 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-19 18:42 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-19 18:42 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-19 18:42 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-05 18:49 - 2012-04-26 06:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-05 18:49 - 2012-04-26 06:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-05 18:49 - 2012-04-26 06:12 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-03 08:29 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-02-02 19:59 - 2013-06-19 02:01 - 00000000 ___RD () C:\Users\AlexSal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-02 19:58 - 2013-06-27 21:12 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-02-02 19:58 - 2013-06-27 21:12 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-01-30 14:47 - 2014-01-30 14:47 - 00028034 _____ () C:\Users\AlexSal\Downloads\Addition.txt
2014-01-30 14:46 - 2014-01-30 14:46 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64(1).exe
2014-01-29 23:00 - 2014-01-29 23:00 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner(1).exe
2014-01-29 22:44 - 2014-01-29 21:47 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-01-29 22:30 - 2014-01-29 22:30 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184(1).exe
2014-01-29 22:29 - 2014-01-29 22:29 - 02800104 _____ (AVAST Software) C:\Users\AlexSal\Downloads\avast-browser-cleanup_9.0.0.184.exe
2014-01-29 22:26 - 2014-01-29 22:26 - 01037068 _____ (Thisisu) C:\Users\AlexSal\Downloads\JRT.exe
2014-01-29 22:21 - 2014-01-29 22:21 - 02079744 _____ (Farbar) C:\Users\AlexSal\Downloads\FRST64.exe
2014-01-29 21:49 - 2014-01-29 21:49 - 00000000 _____ () C:\autoexec.bat
2014-01-29 21:48 - 2014-01-29 21:48 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-01-29 21:47 - 2014-01-29 21:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\AlexSal\Downloads\SpyHunter-Installer.exe
2014-01-29 21:39 - 2014-01-29 21:39 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner.exe
2014-01-29 21:27 - 2014-01-29 21:27 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner-3.018(1).exe
2014-01-29 21:19 - 2014-01-29 21:19 - 00000000 _____ () C:\Windows\setuperr.log
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Malwarebytes
2014-01-29 20:12 - 2014-01-29 20:12 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-01-29 19:56 - 2014-01-29 19:56 - 00002104 _____ () C:\Users\AlexSal\Desktop\Avira Free Antivirus Profil Schnelle Systemprüfung.LNK
2014-01-29 19:52 - 2014-01-29 19:52 - 01166132 _____ () C:\Users\AlexSal\Downloads\adwcleaner-3.018.exe
2014-01-29 17:29 - 2014-01-29 17:29 - 00444656 _____ () C:\Users\AlexSal\Downloads\TheWolfofWallStreet.exe
2014-01-26 13:14 - 2013-07-04 08:09 - 00000000 ____D () C:\Users\AlexSal\AppData\Roaming\Azureus
2014-01-26 13:14 - 2013-06-28 13:47 - 00000000 ____D () C:\Windows\Minidump
2014-01-26 13:13 - 2014-01-26 13:13 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-01-26 13:13 - 2014-01-26 13:13 - 00000826 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-01-26 13:13 - 2014-01-26 13:13 - 00000000 ____D () C:\Program Files\CCleaner
2014-01-26 13:12 - 2014-01-26 13:12 - 04721920 _____ (Piriform Ltd) C:\Users\AlexSal\Downloads\ccsetup410.exe
2014-01-24 23:47 - 2014-01-24 23:47 - 00066106 _____ () C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht.htm
2014-01-24 23:47 - 2014-01-24 23:47 - 00000000 ____D () C:\Users\AlexSal\Desktop\Die ökologische Krise des Kapitalismus - Arbeitermacht-Dateien

Some content of TEMP:
====================
C:\Users\AlexSal\AppData\Local\Temp\avgnt.exe
C:\Users\AlexSal\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-18 08:05

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2014
Ran by AlexSal at 2014-02-20 08:39:57
Running from C:\Users\AlexSal\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 clear.fi SDK - MVP 2 (x32 Version: 2.0.1505 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.0.1502 - CyberLink Corp.) Hidden
Acer Crystal Eye Webcam (x32 Version: 1.5.3501.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.5.3501.00 - CyberLink Corp.) Hidden
Acer ePower Management (x32 Version: 6.00.3010 - Acer Incorporated)
Acer eRecovery Management (x32 Version: 5.00.3508 - Acer Incorporated)
Acer Games (x32 Version: 1.0.2.5 - WildTangent)
Acer Instant Update Service (Version: 1.00.3004 - Acer Incorporated)
Acer Registration (x32 Version: 1.04.3506 - Acer Incorporated)
Acer Theft Shield (Version: 1.00.3005 - Acer Incorporated)
Acer Updater (x32 Version: 1.02.3501 - Acer Incorporated)
Acer USB Charge Manager (x32 Version: 1.00.3002 - Acer Incorporated)
Acer VCM (x32 Version: 4.05.3501 - Acer Incorporated)
Adobe AIR (x32 Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.6.0.19120 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Atheros Bluetooth Suite (64) (Version: 7.4.0.125 - Atheros)
Avira Free Antivirus (x32 Version: 14.0.2.344 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Broadcom NetLink Controller (Version: 15.0.6.1 - Broadcom Corporation)
CCleaner (Version: 4.10 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco AnyConnect Secure Mobility Client  (x32 Version: 3.1.05152 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05152 - Cisco Systems, Inc.) Hidden
clear.fi Media (x32 Version: 2.00.3004 - Acer Incorporated)
clear.fi Photo (x32 Version: 2.00.3004 - Acer Incorporated)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Home Theater v4 (x32 Version: 7.2.7000.7 - Dolby Laboratories Inc)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
eBay Worldwide (x32 Version: 2.2.0409 - OEM)
ETDWare PS/2-X64 10.6.10.8_WHQL (Version: 10.6.10.8 - ELAN Microelectronic Corp.)
ExpressCache (Version: 1.0.82 - Diskeeper Corporation)
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fooz Kids (x32 Version: 3.1.2 - FUHU, Inc.)
Fooz Kids (x32 Version: 3.1.2 - FUHU, Inc.) Hidden
Fooz Kids Platform (x32 Version: 2.1 - FUHU, Inc.)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GeoGebra 4.2 (x32 Version: 4.2.60.0 - International GeoGebra Institute)
Google+ Auto Backup (x32 Version: 1.0.21.81 - Google)
Identity Card (x32 Version: 1.00.3501 - Acer Incorporated)
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 8.0.4.1441 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (x32 Version:  - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2712 - Intel Corporation)
Intel(R) Rapid Start Technology (x32 Version: 1.0.0.1022 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.23.605.1 - Intel Corporation)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kobo (x32 Version: 2.1.5 - Kobo Inc.)
Launch Manager (x32 Version: 5.1.15 - Acer Inc.)
McAfee Internet Security Suite (x32 Version: 11.0.678 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 365 Home Premium - de-de (Version: 15.0.4551.1512 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5139.5005 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (x32 Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (x32 Version: 27.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
Norton Online Backup (x32 Version: 2.1.17869 - Symantec Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9006 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9006 - NTI Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
PDF24 Creator 6.0.1 (x32 Version:  - PDF24.org)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
PhotoScape (x32 Version:  - )
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6612 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (x32 Version: 6.1.7601.28104 - Realtek Semiconductor Corp.)
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sleep Memory Optimizer (x32 Version: 1.00.3004 - Acer Incorporated)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Smart Timer (x32 Version: 1.00.3004 - Acer Incorporated)
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0 - Intel)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97 - WildTangent) Hidden
VLC media player 2.1.0 (x32 Version: 2.1.0 - VideoLAN)
Vuze (Version: 5.0.0.0 - Azureus Software, Inc.)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Welcome Center (x32 Version: 1.02.3507 - Acer Incorporated)
WildTangent Games App (Acer Games) (x32 Version: 4.0.5.32 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinZip 17.5 (x32 Version: 17.5.10562 - WinZip Computing, S.L. )
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

12-02-2014 10:20:17 Konfiguriert Backup Manager V3
12-02-2014 10:44:43 Removed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
19-02-2014 16:28:42 Windows Update
19-02-2014 17:42:38 Windows Update
20-02-2014 06:29:29 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2014-01-05 08:26 - 00000971 ____N C:\Windows\system32\Drivers\etc\hosts

141.39.208.68	vpn.leuphana.de ###Cisco AnyConnect VPN client modified this file. Please do not modify contents until this comment is removed.


==================== Scheduled Tasks (whitelisted) =============

Task: {05EF9B26-3D89-4F67-BD95-8890BA127539} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-10-31] (Microsoft Corporation)
Task: {21CF157E-5AD9-4F7B-B155-5B359F624FF1} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-15] (Microsoft Corporation)
Task: {440F77D3-C778-45B1-ABFD-BCBF95E8CC23} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-07] (Acer Incorporated)
Task: {4F26350B-95AA-40A1-A0C0-4CD6E0C93969} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-05-20] (CyberLink)
Task: {52682665-1850-453F-8E46-E57E82FCA22B} - System32\Tasks\{B8ABCC0A-4F8C-480D-8A54-9D96E283B5F5} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.5.0.158&amp;LastError=12002
Task: {54C10E2B-C64C-41E0-A3B7-925CCB9D96A6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {67A0452F-8850-4B5D-B7A5-B7F9578A8DD1} - System32\Tasks\Smart Timer Task Scheduler => Smart_Timer.exe
Task: {A1D60D55-A6B8-401B-BC05-2938E02DF2F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {AB449415-8385-489C-AA5B-9433EC7F4B41} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {B92DEADC-87CA-4110-B7A8-46643774F883} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {F3E54CCE-7485-4386-BFFE-E99171C1C3F9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-05] (Adobe Systems Incorporated)
Task: {F74111C6-4594-40D4-A88C-18E67F5CAC2C} - \Desk 365 RunAsStdUser No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-04-28 09:08 - 2012-03-15 05:48 - 00127320 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2013-06-27 21:04 - 2013-08-23 14:45 - 00386216 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2rui.dll
2013-06-27 21:04 - 2013-10-31 09:08 - 00520872 _____ () C:\Program Files\Microsoft Office 15\ClientX64\c2r64.dll
2013-06-27 21:04 - 2013-10-31 09:07 - 00618152 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll
2012-06-07 13:38 - 2012-06-07 13:38 - 00235664 _____ () C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe
2012-06-07 13:38 - 2012-06-07 13:38 - 00114320 _____ () C:\Program Files\Acer\Acer Theft Shield\SysCtrl.dll
2012-06-07 13:38 - 2012-06-07 13:38 - 00197776 _____ () C:\Program Files\Acer\Acer Theft Shield\LogMgr2.dll
2012-06-07 13:38 - 2012-06-07 13:38 - 00141456 _____ () C:\Program Files\Acer\Acer Theft Shield\WHNCtrl.dll
2012-06-07 13:38 - 2012-06-07 13:38 - 00259728 _____ () C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe
2012-06-07 13:38 - 2012-06-07 13:38 - 00213648 _____ () C:\Program Files\Acer\Acer Theft Shield\CommPtl.dll
2012-04-26 06:43 - 2012-03-26 10:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-12-30 22:17 - 2014-01-16 08:05 - 00603648 _____ () C:\Users\AlexSal\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
2012-04-07 04:29 - 2012-04-07 04:29 - 00040552 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
2012-04-07 04:29 - 2012-04-07 04:29 - 00022120 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
2013-09-07 08:10 - 2013-09-07 07:55 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-12-30 22:17 - 2014-01-16 08:05 - 36967424 _____ () C:\Users\AlexSal\AppData\Roaming\Spotify\Data\libcef.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\AlexSal\AppData\Roaming\Dropbox\bin\libcef.dll
2013-12-30 22:17 - 2014-01-16 08:05 - 00887808 _____ () C:\Users\AlexSal\AppData\Roaming\Spotify\Data\libglesv2.dll
2013-12-30 22:17 - 2014-01-16 08:05 - 00109568 _____ () C:\Users\AlexSal\AppData\Roaming\Spotify\Data\libegl.dll
2013-04-28 09:10 - 2012-02-01 15:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-04-28 09:07 - 2012-03-06 08:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-02-15 08:52 - 2014-02-15 08:53 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-02-05 18:49 - 2014-02-05 18:49 - 16287624 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-02-19 17:23:29.889
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-02-19 17:23:29.839
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 74%
Total physical RAM: 3933.36 MB
Available physical RAM: 994.85 MB
Total Pagefile: 7864.89 MB
Available Pagefile: 4178.27 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:450.16 GB) (Free:378.47 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 827584C3)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 19 GB) (Disk ID: 51EE9DC1)
Partition 1: (Not Active) - (Size=4 GB) - (Type=84)
Partition 2: (Not Active) - (Size=15 GB) - (Type=73)

==================== End Of Log ============================

cosinus · 20.02.2014, 10:28

Sieht aus, als hättest du JRT vorher nicht neu runtergeladen....

SoloAlex · 08.03.2014, 16:29

Ja ich habe endlich gecheckt wie es funktioniert, und habe den benutzt den ich vor ein Paar Tagen früher runtergeladen habe.
Mein Notebook scheint immer noch nicht clean zu sein

12.02.2014, 22:15	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus? Alle Logs von Avira mit Funden posten ggf Screenshots erstellen und hier posten __________________ --> statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus?

13.02.2014, 10:06	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus? Was lädste denn da runter? Illegales Zeug, wolltest nen Film haben und hast nen Fake bekommen oder wie __________________ Logfiles bitte immer in CODE-Tags posten

20.02.2014, 10:28	#14
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus? Sieht aus, als hättest du JRT vorher nicht neu runtergeladen.... __________________ Logfiles bitte immer in CODE-Tags posten

statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus?

Plagegeister aller Art und deren Bekämpfung: statt Google-Homepage jetzt "awsomehp.com" bei Firefox/Virus?