Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Infizierung mit trojan.ransom.ed

Infizierung mit trojan.ransom.ed


Log-Analyse und Auswertung: Infizierung mit trojan.ransom.ed

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 21.07.2014, 19:36   #1
ynnoc
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Hallo,

ich habe mir laut Malwarebytes Anti-Malware den Trojaner trojan.ransom.ed eingefangen. Vermutlich bei der Öffnung eines emailattachements. Bisher keine Anzeichen einer Falschfunktion des Computers.

Wie kann ich den denn wieder los werden? Ich bin absolut kein Computer freak...

Danke!

Alt 21.07.2014, 23:05   #2
Bootsektor
Ruhe in Frieden
† 2019
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed




Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Poste mir bitte das Log von Malwarebytes

Schritt 2
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 23.07.2014, 18:50   #3
ynnoc
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Code:
ATTFilter
Scan Date: 21.07.2014
Scan Time: 21:05:39
Logfile: log malbytes.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.21.08
Rootkit Database: v2014.07.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Cornelia

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 278966
Time Elapsed: 7 min, 46 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
Trojan.Ransom.ED, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\object, , [d557a6fc017a201628ecc2dca45d45bb], 

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Trojan.Ransom.ED, C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\store\jump_list.exe, , [d557a6fc017a201628ecc2dca45d45bb], 

Physical Sectors: 0
(No malicious items detected)


(end)
schon mal vielen dank für die unterstützung und hier kommt die frst.txt


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2014 01
Ran by Cornelia (administrator) on CORNELIA-PC on 23-07-2014 19:35:32
Running from C:\Users\Cornelia\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Dropbox, Inc.) C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Huawei Technologies Co., Ltd.) C:\Users\Cornelia\AppData\Roaming\Mobile Partner\ouc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtsFT] => RTFTrack.exe 
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291280 2012-12-21] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [HW_OPENEYE_OUC_Mobile Partner] => C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [110592 2009-07-27] (Huawei Technologies Co., Ltd.)
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: {03edf309-a1f5-11e3-b9c6-0cd2925bf6a7} - E:\AutoRun.exe
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: {03edf31d-a1f5-11e3-b9c6-0cd2925bf6a7} - E:\AutoRun.exe
Startup: C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEE2823BC8635CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{D98F3753-3324-43FD-AA3F-9EC314CB711C}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF ProfilePath: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\congstar\Internetmanager\Bin\addon

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [339456 2010-11-16] () [File not signed]
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-04-18] ()
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3388144 2013-04-18] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [117912 2012-11-19] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-05] (Realtek Semiconductor Corp.)
S3 HSPADataCardusbmdm; system32\DRIVERS\HSPADataCardusbmdm.sys [X]
S3 HSPADataCardusbnmea; system32\DRIVERS\HSPADataCardusbnmea.sys [X]
S3 HSPADataCardusbser; system32\DRIVERS\HSPADataCardusbser.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-23 19:35 - 2014-07-23 19:36 - 00010258 _____ () C:\Users\Cornelia\Downloads\FRST.txt
2014-07-23 19:35 - 2014-07-23 19:35 - 02091520 _____ (Farbar) C:\Users\Cornelia\Downloads\FRST64.exe
2014-07-23 19:35 - 2014-07-23 19:35 - 00000000 ____D () C:\FRST
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\TEMP
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\Licenses
2014-07-20 20:54 - 2014-07-21 20:11 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Nico Mak Computing
2014-07-20 20:52 - 2014-07-20 20:52 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8(1).exe
2014-07-20 20:47 - 2014-07-20 20:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-07-18 22:08 - 2014-07-23 19:15 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-18 22:07 - 2014-07-20 20:49 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-18 22:07 - 2014-07-20 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-18 22:07 - 2014-07-20 20:49 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-18 22:07 - 2014-07-18 22:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-18 22:07 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-18 22:07 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-18 22:07 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-18 22:06 - 2014-07-18 22:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager [1].exe
2014-07-18 22:05 - 2014-07-18 22:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-18 22:02 - 2014-07-18 22:02 - 00788832 _____ ( ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager.exe
2014-07-17 21:09 - 2014-07-17 21:09 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8.exe
2014-07-17 21:02 - 2014-07-17 21:03 - 21407864 _____ (Simply Super Software ) C:\Users\Cornelia\Downloads\trjsetup690.exe
2014-07-17 20:48 - 2014-07-18 21:06 - 00000000 ___HD () C:\Users\Cornelia\AppData\Local\Cioombbpcr
2014-07-17 20:46 - 2014-07-17 20:51 - 00000000 ____D () C:\ProgramData\mrtu
2014-07-13 14:04 - 2014-07-13 14:04 - 02286592 _____ () C:\Users\Cornelia\Downloads\Projektreise2010.pps
2014-07-11 22:56 - 2014-07-11 22:56 - 00004577 _____ () C:\Users\Cornelia\Documents\Links für Kids in Hasselbach.odt
2014-07-11 11:14 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-11 11:14 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-11 11:14 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 11:14 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 11:14 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-11 11:14 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 11:14 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 11:14 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-11 11:14 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-11 11:14 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-11 11:14 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 11:14 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-11 11:14 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-11 11:14 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 11:14 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-11 11:14 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-11 11:14 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-11 11:14 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-11 11:14 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 11:14 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-11 11:14 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-11 11:14 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-11 11:14 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 11:14 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 11:14 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 11:14 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-11 11:14 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-11 11:14 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-11 11:14 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-11 11:14 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-11 11:14 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 11:14 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-11 11:14 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-11 11:14 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-11 11:14 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 11:14 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-11 11:14 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-11 11:14 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-11 11:14 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-11 11:14 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-11 11:14 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-11 11:14 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-11 11:14 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-11 11:14 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 11:14 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-11 11:14 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-11 11:14 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 11:14 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-11 11:14 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-11 11:14 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-11 11:14 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-11 11:14 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 11:14 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-11 11:14 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-11 11:14 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-11 11:14 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-11 11:14 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-11 11:14 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-11 11:14 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 11:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-11 11:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-11 11:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-11 11:14 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 11:13 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 11:13 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 14:40 - 2014-07-09 15:11 - 00000000 ____D () C:\Users\Cornelia\Documents\Albelli Fotobücher
2014-07-09 14:40 - 2014-07-09 14:40 - 00001913 _____ () C:\Users\Cornelia\Desktop\Albelli Fotobücher.lnk
2014-07-09 14:39 - 2014-07-09 20:17 - 00000000 ____D () C:\Users\Cornelia\AppData\Local\Albelli Fotobücher
2014-07-09 14:39 - 2014-07-09 14:40 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Albelli Fotobücher
2014-07-09 14:39 - 2014-07-09 14:39 - 06656320 _____ (Albelli ) C:\Users\Cornelia\Downloads\albelli_DE.exe
2014-07-08 10:55 - 2014-07-08 15:01 - 00047104 _____ () C:\Users\Cornelia\Documents\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-06 20:31 - 2014-07-06 21:13 - 00035840 _____ () C:\Users\Cornelia\Desktop\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-03 21:04 - 2014-07-03 21:04 - 00010620 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.xlsx
2014-07-03 20:55 - 2014-07-03 21:04 - 00004660 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.ods
2014-06-26 20:08 - 2014-06-26 20:08 - 00001426 _____ () C:\WirelessDiagLog.csv
2014-06-25 20:37 - 2014-06-25 20:37 - 00442856 _____ () C:\Users\Cornelia\Documents\G20 GA 2003.docm

==================== One Month Modified Files and Folders =======

2014-07-23 19:36 - 2014-07-23 19:35 - 00010258 _____ () C:\Users\Cornelia\Downloads\FRST.txt
2014-07-23 19:36 - 2014-03-01 12:54 - 01357074 _____ () C:\Windows\WindowsUpdate.log
2014-07-23 19:35 - 2014-07-23 19:35 - 02091520 _____ (Farbar) C:\Users\Cornelia\Downloads\FRST64.exe
2014-07-23 19:35 - 2014-07-23 19:35 - 00000000 ____D () C:\FRST
2014-07-23 19:32 - 2014-04-05 23:04 - 00000000 ___RD () C:\Users\Cornelia\Dropbox
2014-07-23 19:32 - 2014-03-01 22:23 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\DropboxMaster
2014-07-23 19:32 - 2014-03-01 22:19 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Dropbox
2014-07-23 19:32 - 2014-03-01 22:05 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Skype
2014-07-23 19:30 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-23 19:30 - 2009-07-14 06:51 - 00035946 _____ () C:\Windows\setupact.log
2014-07-23 19:27 - 2014-04-07 22:55 - 00000000 ____D () C:\Users\Cornelia\Documents\Outlook-Dateien
2014-07-23 19:27 - 2010-11-21 05:47 - 00137328 _____ () C:\Windows\PFRO.log
2014-07-23 19:15 - 2014-07-18 22:08 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-23 18:58 - 2014-04-05 22:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-21 21:05 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-21 21:05 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\TEMP
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\Licenses
2014-07-21 20:11 - 2014-07-20 20:54 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Nico Mak Computing
2014-07-21 20:01 - 2009-07-14 07:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-07-20 20:52 - 2014-07-20 20:52 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8(1).exe
2014-07-20 20:49 - 2014-07-18 22:07 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-20 20:49 - 2014-07-18 22:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-20 20:49 - 2014-07-18 22:07 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-20 20:47 - 2014-07-20 20:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-07-18 22:07 - 2014-07-18 22:07 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-18 22:06 - 2014-07-18 22:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager [1].exe
2014-07-18 22:05 - 2014-07-18 22:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-18 22:02 - 2014-07-18 22:02 - 00788832 _____ ( ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager.exe
2014-07-18 21:06 - 2014-07-17 20:48 - 00000000 ___HD () C:\Users\Cornelia\AppData\Local\Cioombbpcr
2014-07-18 10:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-17 21:09 - 2014-07-17 21:09 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8.exe
2014-07-17 21:03 - 2014-07-17 21:02 - 21407864 _____ (Simply Super Software ) C:\Users\Cornelia\Downloads\trjsetup690.exe
2014-07-17 20:51 - 2014-07-17 20:46 - 00000000 ____D () C:\ProgramData\mrtu
2014-07-13 14:04 - 2014-07-13 14:04 - 02286592 _____ () C:\Users\Cornelia\Downloads\Projektreise2010.pps
2014-07-12 22:00 - 2014-06-04 18:49 - 00000000 ____D () C:\Users\Cornelia\Documents\Wohnungen WOR_GER
2014-07-12 13:38 - 2009-07-14 06:45 - 00416360 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-12 00:34 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-12 00:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-12 00:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-11 22:56 - 2014-07-11 22:56 - 00004577 _____ () C:\Users\Cornelia\Documents\Links für Kids in Hasselbach.odt
2014-07-11 15:27 - 2014-04-07 22:28 - 00000000 ____D () C:\Users\Cornelia\AppData\Local\Microsoft Help
2014-07-11 11:20 - 2014-04-07 22:28 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-11 11:18 - 2014-03-02 01:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 11:17 - 2014-03-02 01:31 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 20:17 - 2014-07-09 14:39 - 00000000 ____D () C:\Users\Cornelia\AppData\Local\Albelli Fotobücher
2014-07-09 15:11 - 2014-07-09 14:40 - 00000000 ____D () C:\Users\Cornelia\Documents\Albelli Fotobücher
2014-07-09 14:40 - 2014-07-09 14:40 - 00001913 _____ () C:\Users\Cornelia\Desktop\Albelli Fotobücher.lnk
2014-07-09 14:40 - 2014-07-09 14:39 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Albelli Fotobücher
2014-07-09 14:39 - 2014-07-09 14:39 - 06656320 _____ (Albelli ) C:\Users\Cornelia\Downloads\albelli_DE.exe
2014-07-09 10:54 - 2014-04-05 22:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 10:54 - 2014-04-05 22:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 10:54 - 2014-04-05 22:56 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-08 15:01 - 2014-07-08 10:55 - 00047104 _____ () C:\Users\Cornelia\Documents\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-06 21:13 - 2014-07-06 20:31 - 00035840 _____ () C:\Users\Cornelia\Desktop\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-04 09:09 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-07-04 09:09 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-07-04 09:09 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-03 21:04 - 2014-07-03 21:04 - 00010620 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.xlsx
2014-07-03 21:04 - 2014-07-03 20:55 - 00004660 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.ods
2014-06-26 20:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-26 20:08 - 2014-06-26 20:08 - 00001426 _____ () C:\WirelessDiagLog.csv
2014-06-26 15:11 - 2014-04-05 21:54 - 00000000 ____D () C:\Users\Cornelia\Documents\Arbeitgeber
2014-06-25 20:37 - 2014-06-25 20:37 - 00442856 _____ () C:\Users\Cornelia\Documents\G20 GA 2003.docm
2014-06-24 11:56 - 2014-03-01 22:35 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

Some content of TEMP:
====================
C:\Users\Cornelia\AppData\Local\Temp\avgnt.exe
C:\Users\Cornelia\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw67oou.dll
C:\Users\Cornelia\AppData\Local\Temp\ose00000.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-18 10:36

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

und hier die addition

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2014 01
Ran by Cornelia at 2014-07-23 19:36:51
Running from C:\Users\Cornelia\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Albelli Fotobücher (HKCU\...\{EE20E438-B675-4421-AB07-928F0EC9FB22}_is1) (Version:  - Albelli)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.450 - Avira)
Bullzip PDF Printer 10.3.0.2191 (HKLM\...\Bullzip PDF Printer_is1) (Version: 10.3.0.2191 - Bullzip)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5C78021E-3C8E-4EDF-97EA-E9B8D808FD6D}) (Version:  - Microsoft)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.8.0.0548 - Intel Corporation) Hidden
Intel(R) PROSet/Wireless WiFi Software Driver (Version: 15.08.0000.0249 - Intel Corporation) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.7.248 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{e6d17d96-ddaa-476f-bb07-db601024ffb1}) (Version: 15.8.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 15.08.0000.0172 - Intel Corporation) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10206 - Realtek Semiconductor Corp.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 16.002.03.04.511 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.5 - CEWE Stiftung u Co. KGaA)
Qualcomm Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.12 - Qualcomm Atheros Communications Inc.)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 6.2.9200.39041 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Excel 2010 (KB2837600) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4ACD847E-547D-493F-9A86-F73EAE1B5174}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{C0BDC1DE-C35E-422B-8CBD-C1D555468720}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version:  - Microsoft)

==================== Custom CLSID entries: ==========================

CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

30-06-2014 08:34:53 Geplanter Prüfpunkt
11-07-2014 09:15:15 Windows Update
17-07-2014 19:07:29 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {65AD85B4-3FC4-4B93-AEEB-12F71F8D9F90} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-11-16 15:38 - 2010-11-16 15:38 - 00339456 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2014-01-25 03:22 - 2014-01-25 03:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-07-23 19:31 - 2014-07-23 19:31 - 00043008 _____ () c:\users\cornelia\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpw67oou.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\libcef.dll
2014-06-18 15:08 - 2014-06-18 15:08 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-07-09 10:54 - 2014-07-09 10:54 - 17029808 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PnP-Monitor (Standard)
Description: PnP-Monitor (Standard)
Class Guid: {4d36e96e-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardmonitortypen)
Service: monitor
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/23/2014 07:31:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Name des fehlerhaften Moduls: mbamservice.exe, Version: 3.0.2.0, Zeitstempel: 0x5318d363
Ausnahmecode: 0x40000015
Fehleroffset: 0x0007da8a
ID des fehlerhaften Prozesses: 0x870
Startzeit der fehlerhaften Anwendung: 0xmbamservice.exe0
Pfad der fehlerhaften Anwendung: mbamservice.exe1
Pfad des fehlerhaften Moduls: mbamservice.exe2
Berichtskennung: mbamservice.exe3

Error: (07/23/2014 07:31:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2014 07:31:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbamscheduler.exe, Version: 3.0.2.0, Zeitstempel: 0x5339cec3
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x7b8
Startzeit der fehlerhaften Anwendung: 0xmbamscheduler.exe0
Pfad der fehlerhaften Anwendung: mbamscheduler.exe1
Pfad des fehlerhaften Moduls: mbamscheduler.exe2
Berichtskennung: mbamscheduler.exe3

Error: (07/23/2014 07:28:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/21/2014 08:57:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/21/2014 08:03:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/20/2014 09:26:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/20/2014 04:36:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/19/2014 08:45:48 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/19/2014 08:45:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: hnetcfg.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4a5bd9f0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7150e58d
ID des fehlerhaften Prozesses: 0xba8
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3


System errors:
=============
Error: (07/23/2014 07:31:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "MBAMService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/23/2014 07:31:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMScheduler" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (07/23/2014 07:31:21 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MBAMScheduler erreicht.

Error: (07/21/2014 08:58:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "taskbar" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/21/2014 08:04:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "anti_shake" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/21/2014 07:39:23 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (07/20/2014 09:28:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "directaccess" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/20/2014 09:28:06 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.

Error: (07/20/2014 09:25:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎20.‎07.‎2014 um 21:24:15 unerwartet heruntergefahren.

Error: (07/20/2014 04:37:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "beneficiary_kpp" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (07/23/2014 07:31:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamservice.exe3.0.2.05318d363mbamservice.exe3.0.2.05318d363400000150007da8a87001cfa69beb8d5a20C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe3251e6cd-128f-11e4-b585-0cd2925bf6a7

Error: (07/23/2014 07:31:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/23/2014 07:31:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbamscheduler.exe3.0.2.05339cec3MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd7b801cfa69bdeac8845C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dll27b5e4b4-128f-11e4-b585-0cd2925bf6a7

Error: (07/23/2014 07:28:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/21/2014 08:57:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/21/2014 08:03:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/20/2014 09:26:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/20/2014 04:36:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/19/2014 08:45:48 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/19/2014 08:45:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe6.1.7600.163854a5bc100hnetcfg.dll_unloaded0.0.0.04a5bd9f0c00000057150e58dba801cfa313345a9a13C:\Windows\syswow64\svchost.exehnetcfg.dll357858f8-0f10-11e4-8383-0cd2925bf6a7


==================== Memory info =========================== 

Percentage of memory in use: 29%
Total physical RAM: 8092.85 MB
Available physical RAM: 5696.94 MB
Total Pagefile: 16183.88 MB
Available Pagefile: 13808.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:463.81 GB) (Free:333.16 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: D9FA2484)
Partition 1: (Active) - (Size=1000 MB) - (Type=0B)
Partition 2: (Not Active) - (Size=464 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1000 MB) - (Type=12)

==================== End Of Log ============================
__________________
Alt 23.07.2014, 23:18   #4
Bootsektor
Ruhe in Frieden
† 2019
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Hallo,

lass uns mal genauer schauen,
Schritt 1
Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
  • Klicke auf Wählen Sie eine
  • Kopiere nun folgendes in die Suchleiste
    Code:
    ATTFilter
    C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\store\jump_list.exe
  • und klicke auf Öffnen.
  • Klicke auf Scannen!.
  • Warte bitte bis die Datei vollständig hochgeladen wurde. Solltest Du folgende Meldung bekommen
    Zitat:
    Diese Datei wurde bereits von VirusTotal analysiert...
    klicke auf Neu analysieren.
  • Warte bis dir das Analysedatum angezeigt wird und der Scan abgeschlossen ist.
  • Kopiere den Link aus deiner Adresszeile und poste ihn hier.

Schritt 2
Kennst du diese beiden Ordner?
Zitat:
C:\Users\Cornelia\AppData\Local\Cioombbpcr
C:\ProgramData\mrtu

Alt 28.07.2014, 18:23   #5
ynnoc
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


hej,

danke für die Hilfe! Leider klappt das aber nicht. Ich kriege immer die Meldung "Dateiname ungültig".

Sorry.

Und die Ordner kenne ich auch nicht, die sagen mir gar nix.

Ynnoc


Alt 28.07.2014, 21:37   #6
Bootsektor
Ruhe in Frieden
† 2019
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Hallo,

traust du dir zu die Datei zu kopieren und diese dann umzubenennen und sie dann hochzuladen?

Ich schau mir mal die MD5 an, vll bringt uns das schon weiter.

Wir löschen dann auch die dir nicht bekannten Ordner

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
file: C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\store\jump_list.exe
C:\Users\Cornelia\AppData\Local\Cioombbpcr
C:\ProgramData\mrtu

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

__________________
--> Infizierung mit trojan.ransom.ed

Alt 29.07.2014, 20:38   #7
ynnoc
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Hallo,

gestern konnte ich die Datei leider nicht finden, obwohl ich auch in versteckten Ordnern usw gesucht hatte. Ich probier es aber nachher nochmal und lade es hoch nach Umbenennung wenn es klappt.

Hier das Ergebnis von FRST Fixlog:

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-07-2014
Ran by Cornelia at 2014-07-29 21:11:12 Run:2
Running from C:\Users\Cornelia\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
file: C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\store\jump_list.exe
C:\Users\Cornelia\AppData\Local\Cioombbpcr
C:\ProgramData\mrtu
*****************


========================= file: C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\store\jump_list.exe ========================

"C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\store\jump_list.exe" not found.
====== End Of File: ======

"C:\Users\Cornelia\AppData\Local\Cioombbpcr" => File/Directory not found.
"C:\ProgramData\mrtu" => File/Directory not found.

==== End of Fixlog ====
Keine Chance - ich kann die Datei jump_list.exe nicht finden. Ich finde nur meinen Suchauftrag von gestern...
und im C:\Windows\assembly Ordner sind nur MSIL, AMD und x86 Prozessektarchitsarchitekturen, keine weiteren Ordner...

Dort ist aber auch die Microsoft.VisualStudio.Tools.Applications.InteropAdapter Datei, als x86 Prozessarchitektur. Hilft dir das weiter?

lg
ynnoc

Alt 29.07.2014, 22:36   #8
Bootsektor
Ruhe in Frieden
† 2019
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Ok,

lass uns schauen, ob es auf deinem Rechner eine Datei mit dem Namen gibt.

Du hast mit Malwarebytes nichts gelöscht?
Schritt 1
Starte noch einmal FRST
  • gebe in das Eingabefeld folgendes ein
    Code:
    ATTFilter
    jump_list.exe
  • drücke auf search File(s) (mittig unter dem Eingabefeld)
  • FRST erstellt ein Logfile search.txt
  • poste mir dieses
Alt 30.07.2014, 20:55   #9
ynnoc
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Hallo,

hier das Logfile. Ich habe bei Malwarebytes glaub ich auf Quarantäne geklickt, als mir das als Aktion vorgeschlagen wurde.

Code:
ATTFilter
Farbar Recovery Scan Tool (x64) Version: 26-07-2014
Ran by Cornelia at 2014-07-30 20:28:22
Running from C:\Users\Cornelia\Desktop
Boot Mode: Normal

================== Search Files: "jump_list.exe" =============

====== End Of Search ======
viele grüße
ynnoc

So und nun fängt der Laptop auch an zu spinnen. Ich werde beim Start gefragt, ob ich mit Starthilfe starten will, was ich 1mal gemacht habe mit dem Ergebnis, dass gesagt wurde, man kann es nicht reparieren. Außerdem habe ich nach dem Windows start ein ganz langes schwarzes Bild. Malwarebytes findet nun einen pup.optional malware:

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 30.07.2014
Scan Time: 21:31:39
Logfile: malwarelog2.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.30.07
Rootkit Database: v2014.07.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Cornelia

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 283407
Time Elapsed: 8 min, 14 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 13
PUP.Optional.Snapdo.T, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, , [c5eafda8611a4beb6fe3475445bdbd43], 
PUP.Optional.Snapdo.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}, , [c5eafda8611a4beb6fe3475445bdbd43], 
PUP.Optional.WinSecurity.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{F42E9111-A9A5-4482-AD2E-1EF9DA85B0BF}, , [f9b601a4304b2412b4fcfd6733cfdb25], 
PUP.Optional.WinSecurity.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{F42E9111-A9A5-4482-AD2E-1EF9DA85B0BF}, , [f9b601a4304b2412b4fcfd6733cfdb25], 
PUP.Optional.Sanbreel.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64, , [0ea10f964a310531aa195c71000228d8], 
Adware.EoRezo, HKLM\SOFTWARE\WOW6432NODE\FREESOFTTODAY, , [ecc3861fafccf93d0fc49e75e12319e7], 
PUP.Optional.SystemSpeedup, HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\ssd, , [a708d3d27ffc5ed8e656e4eedd25e719], 
PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Deal Keeper, , [535c3570b2c90a2ce965ae21679b8080], 
PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util Deal Keeper, , [08a77e27d9a256e068e7547bbe4418e8], 
PUP.Optional.BlockAndSurf.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\BlockAndSurf, , [dbd4960f8eed1a1cd4197c5033cfba46], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [04ab8223fb806ec8f5c606f18d7539c7], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [634ca6ffd3a8b3837861838af90bbb45], 
PUP.Optional.SystemSpeedup, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\ssd, , [6b44c0e53348231394a7e7ebd32f6997], 

Registry Values: 2
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_118, , [743bc0e52e4dc076a6c98c5853afd030], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, , [634ca6ffd3a8b3837861838af90bbb45]

Registry Data: 6
PUP.Optional.HelperBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}),,[238cfca9aad180b61ff65957b84cbf41]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}),,[a906287dc6b5a78fae6a89279f657e82]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}),,[515ef8adb4c720162aed218f51b3b947]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}),,[02adb7ee94e784b2b862bdf3bc48fd03]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}),,[ecc354518dee42f4c754d0e030d4b44c]
PUP.Optional.HelperBar.A, HKU\S-1-5-21-1430091616-1427986856-2679872343-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRak5VLd2-qQdkN5729vVFWxou9hoxUv82Ac0l78Z5CrmSDj2hiXNYSXS15WI1NS8nT-L_DIEGh_xOef47JeiEw1INKBz3S6lPv4oRIBzQbJEpyMFcown2D46V3faT2wMA2JI2aQ4AaSFtUtr9djOC6nJ0_826F6VXRbHpbVsqoHdGwr-wVT77WYcikdXoA,,&q={searchTerms}),,[832c8520710a2a0c74a2a10fc242966a]

Folders: 6
PUP.Optional.SystemSpeedup, C:\Users\Cornelia\AppData\Roaming\Systweak\ssd, , [57584164ee8d73c3ea2bbe060ff34db3], 
PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System-Protector, , [7f302b7a136848ee6064d3f6d82abb45], 
PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System-Protector\2.1.1000.13665, , [7f302b7a136848ee6064d3f6d82abb45], 
PUP.Optional.AdvancedSystemProtector.A, C:\ProgramData\Systweak\Advanced-System-Protector\signatures, , [7f302b7a136848ee6064d3f6d82abb45], 
PUP.Optional.AdvancedSystemProtector.A, C:\Users\Cornelia\AppData\Roaming\Systweak\Advanced-System-Protector, , [6c4322830774ad898341bd0cac566d93], 
PUP.Optional.AdvancedSystemProtector.A, C:\Users\Cornelia\AppData\Roaming\Systweak\Advanced-System-Protector\2.1.1000.13665, , [6c4322830774ad898341bd0cac566d93], 

Files: 8
PUP.Optional.Conduit.A, C:\Users\Cornelia\AppData\Local\Temp\nsl7B8B.exe, , [f4bb386dd8a386b08ee65a31976a17e9], 
PUP.Optional.Gameo.A, C:\Users\Cornelia\AppData\Local\Temp\is45637729\7671472_stp.EXE, , [8f205d484b3074c273136d124cb516ea], 
PUP.Optional.SnapDo.A, C:\Windows\Installer\688451.msi, , [604f55500b70360035aabdcf6c95966a], 
PUP.Optional.Sanbreel.A, C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys, , [0ea10f964a310531aa195c71000228d8], 
PUP.Optional.Trovi.A, C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\searchplugins\trovi-search.xml, , [c5ea01a46a111b1b3278479853af946c], 
PUP.Optional.SystemSpeedup, C:\Users\Cornelia\AppData\Roaming\Systweak\ssd\SSDPTstub.exe, , [57584164ee8d73c3ea2bbe060ff34db3], 
PUP.Optional.AdvancedSystemProtector.A, C:\Users\Cornelia\AppData\Roaming\Systweak\Advanced-System-Protector\Settings.db, , [6c4322830774ad898341bd0cac566d93], 
PUP.Optional.AdvancedSystemProtector.A, C:\Users\Cornelia\AppData\Roaming\Systweak\Advanced-System-Protector\2.1.1000.13665\ASPLog.txt, , [6c4322830774ad898341bd0cac566d93], 

Physical Sectors: 0
(No malicious items detected)


(end)
grüße
ynnoc

Alt 30.07.2014, 21:11   #10
Bootsektor
Ruhe in Frieden
† 2019
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Ok,

das erklärt natürlich warum die Datei nicht mehr da ist.

Lösche bitte die Funde von Malwarebytes und mache dann ein neues Log mit FRST, hake dabei auch das addition-Feld an.

Alt 31.07.2014, 21:42   #11
ynnoc
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Sorry für die Verwirrungen... Hier die neuen Logs:


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 01
Ran by Cornelia (administrator) on CORNELIA-PC on 31-07-2014 22:09:52
Running from C:\Users\Cornelia\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Users\Cornelia\AppData\Roaming\InetStat\inetstat.exe
(Dropbox, Inc.) C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6346464 2013-01-05] (Realtek semiconductor)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291280 2012-12-21] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [AnyProtect Scanner] => "C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe"
HKLM-x32\...\Run: [BlockAndSurf] => C:\Program Files (x86)\ver7BlockAndSurf\BlockAndSurf.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [InetStat] => C:\Users\Cornelia\AppData\Roaming\InetStat\inetstat.exe [1325536 2014-07-29] ()
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: {03edf309-a1f5-11e3-b9c6-0cd2925bf6a7} - E:\AutoRun.exe
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: {03edf31d-a1f5-11e3-b9c6-0cd2925bf6a7} - E:\AutoRun.exe
Startup: C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEE2823BC8635CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\user.js
FF SearchPlugin: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\searchplugins\Astromenda.xml
FF SearchPlugin: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\searchplugins\SafeFinder Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Astromenda New Tab - C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\Extensions\{849ded12-59e9-4dae-8f86-918b70d213dc} [2014-07-30]
FF Extension: SafeFinder Smartbar - C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\Extensions\{de4e3beb-86d8-b3d9-b2a3-324e4222e97a} [2014-07-29]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\congstar\Internetmanager\Bin\addon
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-04-18] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3388144 2013-04-18] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-31] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-05] (Realtek Semiconductor Corp.)
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 HSPADataCardusbmdm; system32\DRIVERS\HSPADataCardusbmdm.sys [X]
S3 HSPADataCardusbnmea; system32\DRIVERS\HSPADataCardusbnmea.sys [X]
S3 HSPADataCardusbser; system32\DRIVERS\HSPADataCardusbser.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S0 obakajt; System32\drivers\bbhgq.sys [X]

==================== NetSvcs (Whitelisted) ===================
Addition txt:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2014 01
Ran by Cornelia at 2014-07-31 22:10:22
Running from C:\Users\Cornelia\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Albelli Fotobücher (HKCU\...\{EE20E438-B675-4421-AB07-928F0EC9FB22}_is1) (Version:  - Albelli)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
Bullzip PDF Printer 10.3.0.2191 (HKLM\...\Bullzip PDF Printer_is1) (Version: 10.3.0.2191 - Bullzip)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5C78021E-3C8E-4EDF-97EA-E9B8D808FD6D}) (Version:  - Microsoft)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.8.0.0548 - Intel Corporation) Hidden
Intel(R) PROSet/Wireless WiFi Software Driver (Version: 15.08.0000.0249 - Intel Corporation) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.7.248 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{e6d17d96-ddaa-476f-bb07-db601024ffb1}) (Version: 15.8.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 15.08.0000.0172 - Intel Corporation) Hidden
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10206 - Realtek Semiconductor Corp.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.5 - CEWE Stiftung u Co. KGaA)
Realtek USB Card Reader (HKLM-x32\...\{1E496A68-4943-424E-829D-5C3C85B7B8F2}) (Version: 6.2.9200.39041 - Realtek Semiconductor Corp.)
SafeFinder Smartbar (HKLM-x32\...\{FA6289D6-676C-4497-88CC-9E2E15488944}) (Version: 11.49.72.16858 - Linkury Ltd.) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Excel 2010 (KB2837600) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4ACD847E-547D-493F-9A86-F73EAE1B5174}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{C0BDC1DE-C35E-422B-8CBD-C1D555468720}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version:  - Microsoft)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
CustomCLSID: HKU\S-1-5-21-1430091616-1427986856-2679872343-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File

==================== Restore Points  =========================

29-07-2014 18:17:48 Windows Update
30-07-2014 13:35:52 Säuberung (Spybot - Search & Destroy 2.4, Administratorrechte)
30-07-2014 13:41:32 Säuberung (Spybot - Search & Destroy 2.4, Administratorrechte)
30-07-2014 13:44:21 Removed Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
30-07-2014 13:45:02 Entfernt Qualcomm Atheros Communications Inc.(R) AR81Family GigaÀÇÇR

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {12CD0B09-4AFD-4629-A815-135DB6461233} - System32\Tasks\ASP => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {2F9D4C73-56AA-495B-980D-88D342538F8A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {42574D18-4EC3-41B6-B097-1195DFE3DDA8} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {65AD85B4-3FC4-4B93-AEEB-12F71F8D9F90} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-29] (Adobe Systems Incorporated)
Task: {6D14D63B-2B02-47D4-85CF-313AF2B1D648} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {7573B124-4A17-474A-B07A-191E753F7948} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {9E09987F-7A07-404C-B5C6-6DFE0758944E} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {AD3C3580-095D-459A-B25E-E0DCF7B127F7} - System32\Tasks\PC Speed Maximizer Schedule => C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
Task: {B6730E0F-43B2-46D0-932E-64CDA0EE441A} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2014-01-25 03:22 - 2014-01-25 03:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-07-29 21:47 - 2014-07-29 21:47 - 01325536 _____ () C:\Users\Cornelia\AppData\Roaming\InetStat\inetstat.exe
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-07-31 20:56 - 2014-07-31 20:56 - 00043008 _____ () c:\users\cornelia\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpenntkx.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\libcef.dll
2014-07-29 22:05 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-07-29 22:05 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-07-29 22:05 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-07-29 22:05 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-07-29 22:05 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-06-18 15:08 - 2014-06-18 15:08 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-07-09 10:54 - 2014-07-09 10:54 - 17029808 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PnP-Monitor (Standard)
Description: PnP-Monitor (Standard)
Class Guid: {4d36e96e-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardmonitortypen)
Service: monitor
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/31/2014 08:56:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 09:48:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 09:45:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 09:29:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 08:58:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 08:55:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x1320
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3

Error: (07/30/2014 08:32:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x1578
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3

Error: (07/30/2014 03:43:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x19ec
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (07/29/2014 09:41:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x10f4
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3

Error: (07/29/2014 09:41:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x1308
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3


System errors:
=============
Error: (07/31/2014 08:59:12 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (07/31/2014 08:58:27 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
obakajt

Error: (07/31/2014 08:58:10 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.

Error: (07/30/2014 09:49:30 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
obakajt

Error: (07/30/2014 09:49:29 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.

Error: (07/30/2014 09:44:25 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {06622D85-6856-4460-8DE1-A81921B41C4B}

Error: (07/30/2014 09:30:53 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde nicht richtig gestartet.

Error: (07/30/2014 09:29:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/30/2014 09:29:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/30/2014 08:58:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (07/31/2014 08:56:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 09:48:02 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 09:45:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 09:29:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 08:58:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/30/2014 08:55:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.53253518532MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd132001cfac27d614d227C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dll158ee071-181b-11e4-ba41-0cd2925bf6a7

Error: (07/30/2014 08:32:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.53253518532MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd157801cfac24a8037cd6C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dlle72de356-1817-11e4-ba41-0cd2925bf6a7

Error: (07/30/2014 03:43:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b19ec01cfabfc1e908bd7C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll6f53c0e1-17ef-11e4-ba41-0cd2925bf6a7

Error: (07/29/2014 09:41:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.53253518532MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd10f401cfab6528ac8400C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dll66733e04-1758-11e4-ba41-0cd2925bf6a7

Error: (07/29/2014 09:41:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: mbam.exe1.0.0.53253518532MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd130801cfab6515b1379bC:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exeC:\Program Files (x86)\ Malwarebytes Anti-Malware \MSVCR100.dll53de9ae7-1758-11e4-ba41-0cd2925bf6a7


==================== Memory info =========================== 

Percentage of memory in use: 28%
Total physical RAM: 8092.85 MB
Available physical RAM: 5813.56 MB
Total Pagefile: 16183.88 MB
Available Pagefile: 13578.4 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:463.81 GB) (Free:336.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: D9FA2484)
Partition 1: (Active) - (Size=1000 MB) - (Type=0B)
Partition 2: (Not Active) - (Size=464 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1000 MB) - (Type=12)

==================== End Of Log ============================
--- --- ---

--- --- ---


sorry hier das komplette frst log:


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 01
Ran by Cornelia (administrator) on CORNELIA-PC on 31-07-2014 22:09:52
Running from C:\Users\Cornelia\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Users\Cornelia\AppData\Roaming\InetStat\inetstat.exe
(Dropbox, Inc.) C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6346464 2013-01-05] (Realtek semiconductor)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291280 2012-12-21] (Intel Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [AnyProtect Scanner] => "C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe"
HKLM-x32\...\Run: [BlockAndSurf] => C:\Program Files (x86)\ver7BlockAndSurf\BlockAndSurf.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [InetStat] => C:\Users\Cornelia\AppData\Roaming\InetStat\inetstat.exe [1325536 2014-07-29] ()
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: {03edf309-a1f5-11e3-b9c6-0cd2925bf6a7} - E:\AutoRun.exe
HKU\S-1-5-21-1430091616-1427986856-2679872343-1000\...\MountPoints2: {03edf31d-a1f5-11e3-b9c6-0cd2925bf6a7} - E:\AutoRun.exe
Startup: C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Cornelia\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEE2823BC8635CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\user.js
FF SearchPlugin: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\searchplugins\Astromenda.xml
FF SearchPlugin: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\searchplugins\SafeFinder Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Astromenda New Tab - C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\Extensions\{849ded12-59e9-4dae-8f86-918b70d213dc} [2014-07-30]
FF Extension: SafeFinder Smartbar - C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\Extensions\{de4e3beb-86d8-b3d9-b2a3-324e4222e97a} [2014-07-29]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\congstar\Internetmanager\Bin\addon
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-04-18] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3388144 2013-04-18] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-31] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-05] (Realtek Semiconductor Corp.)
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 HSPADataCardusbmdm; system32\DRIVERS\HSPADataCardusbmdm.sys [X]
S3 HSPADataCardusbnmea; system32\DRIVERS\HSPADataCardusbnmea.sys [X]
S3 HSPADataCardusbser; system32\DRIVERS\HSPADataCardusbser.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S0 obakajt; System32\drivers\bbhgq.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-31 22:09 - 2014-07-31 22:09 - 00000000 ____D () C:\Users\Cornelia\Desktop\FRST-OlderVersion
2014-07-30 21:41 - 2014-07-30 21:41 - 01062136 _____ (Bleeping Computer, LLC) C:\Users\Cornelia\Downloads\magdalena64.exe
2014-07-30 21:41 - 2014-07-30 21:41 - 00001666 _____ () C:\Users\Cornelia\Desktop\Rkill.txt
2014-07-30 21:40 - 2014-07-30 21:41 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Cornelia\Downloads\magdalena.exe
2014-07-30 21:01 - 2014-07-31 20:59 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-30 21:00 - 2014-07-30 22:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-30 21:00 - 2014-07-30 22:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-30 21:00 - 2014-07-30 21:00 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-30 21:00 - 2014-07-30 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 21:00 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-30 21:00 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-30 21:00 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-30 20:59 - 2014-07-30 21:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(3).exe
2014-07-30 20:53 - 2014-07-30 20:53 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Cornelia\Downloads\mbam-clean-2.1.1.1001.exe
2014-07-30 20:32 - 2014-07-30 20:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(2).exe
2014-07-30 20:28 - 2014-07-30 20:28 - 00000247 _____ () C:\Users\Cornelia\Desktop\Search.txt
2014-07-30 15:35 - 2014-07-30 15:41 - 00028145 _____ () C:\Windows\wininit.ini
2014-07-30 15:33 - 2014-07-30 21:44 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Systweak
2014-07-30 15:33 - 2014-07-30 21:44 - 00000000 ____D () C:\ProgramData\Systweak
2014-07-30 15:33 - 2014-07-30 15:40 - 00000000 ____D () C:\Program Files (x86)\PennyBee
2014-07-30 15:33 - 2014-07-30 15:33 - 00003338 _____ () C:\Windows\System32\Tasks\ASP
2014-07-30 15:33 - 2014-07-16 16:43 - 00020280 _____ () C:\Windows\system32\roboot64.exe
2014-07-29 22:22 - 2014-07-29 22:34 - 00003266 _____ () C:\Windows\System32\Tasks\PC Speed Maximizer Schedule
2014-07-29 22:16 - 2014-07-29 22:16 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2014-07-29 22:13 - 2014-07-29 22:13 - 00000000 ____D () C:\Program Files (x86)\predm
2014-07-29 22:12 - 2014-07-29 22:13 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-07-29 22:12 - 2014-07-29 22:12 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-07-29 22:10 - 2014-07-29 22:10 - 00000000 ____D () C:\Users\Cornelia\Documents\PC Speed Maximizer
2014-07-29 22:07 - 2014-07-30 22:08 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-07-29 22:07 - 2014-07-30 20:58 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-07-29 22:07 - 2014-07-29 22:28 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-07-29 22:07 - 2014-07-29 22:08 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-07-29 22:07 - 2014-07-29 22:08 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-07-29 22:07 - 2014-07-29 22:08 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-07-29 22:07 - 2014-07-29 22:07 - 00000322 _____ () C:\Users\Cornelia\AppData\Roaming\aps.uninstall.scan.results
2014-07-29 22:06 - 2014-07-29 22:06 - 00002466 _____ () C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-07-29 22:05 - 2014-07-30 22:10 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-07-29 22:05 - 2014-07-30 15:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-07-29 22:05 - 2014-07-29 22:05 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-07-29 22:05 - 2014-07-29 22:05 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-07-29 22:05 - 2014-07-29 22:05 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-07-29 22:05 - 2014-07-29 22:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-07-29 22:05 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-07-29 22:04 - 2014-07-29 16:48 - 00575544 _____ (ClickMeIn Limited) C:\Users\Cornelia\AppData\Local\AnyProtectScannerSetup.exe
2014-07-29 21:49 - 2014-07-29 21:49 - 00000000 __SHD () C:\Users\Cornelia\AppData\Local\EmieUserList
2014-07-29 21:49 - 2014-07-29 21:49 - 00000000 __SHD () C:\Users\Cornelia\AppData\Local\EmieSiteList
2014-07-29 21:47 - 2014-07-29 21:47 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\InetStat
2014-07-29 21:45 - 2014-07-29 21:46 - 00471936 _____ () C:\Users\Cornelia\Downloads\spybot-2.4-Downloader.exe
2014-07-29 21:42 - 2014-07-29 21:42 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8(2).exe
2014-07-29 21:04 - 2014-07-29 21:04 - 00000000 ____D () C:\Users\Cornelia\Downloads\FRST-OlderVersion
2014-07-23 19:36 - 2014-07-23 19:37 - 00026288 _____ () C:\Users\Cornelia\Downloads\Addition.txt
2014-07-23 19:35 - 2014-07-31 22:10 - 00016237 _____ () C:\Users\Cornelia\Desktop\FRST.txt
2014-07-23 19:35 - 2014-07-31 22:09 - 02094080 _____ (Farbar) C:\Users\Cornelia\Desktop\FRST64.exe
2014-07-23 19:35 - 2014-07-31 22:09 - 00000000 ____D () C:\FRST
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\TEMP
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\Licenses
2014-07-20 20:54 - 2014-07-21 20:11 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Nico Mak Computing
2014-07-20 20:52 - 2014-07-20 20:52 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8(1).exe
2014-07-20 20:47 - 2014-07-20 20:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-07-18 22:06 - 2014-07-18 22:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager [1].exe
2014-07-18 22:05 - 2014-07-18 22:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-18 22:02 - 2014-07-18 22:02 - 00788832 _____ ( ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager.exe
2014-07-17 21:09 - 2014-07-17 21:09 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8.exe
2014-07-17 21:02 - 2014-07-17 21:03 - 21407864 _____ (Simply Super Software ) C:\Users\Cornelia\Downloads\trjsetup690.exe
2014-07-13 14:04 - 2014-07-13 14:04 - 02286592 _____ () C:\Users\Cornelia\Downloads\Projektreise2010.pps
2014-07-11 22:56 - 2014-07-11 22:56 - 00004577 _____ () C:\Users\Cornelia\Documents\Links für Kids in Hasselbach.odt
2014-07-11 11:14 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-11 11:14 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-11 11:14 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 11:14 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 11:14 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-11 11:14 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 11:14 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 11:14 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-11 11:14 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-11 11:14 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-11 11:14 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 11:14 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-11 11:14 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-11 11:14 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 11:14 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-11 11:14 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-11 11:14 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-11 11:14 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-11 11:14 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 11:14 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-11 11:14 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-11 11:14 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-11 11:14 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 11:14 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 11:14 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 11:14 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-11 11:14 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-11 11:14 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-11 11:14 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-11 11:14 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-11 11:14 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 11:14 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-11 11:14 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-11 11:14 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-11 11:14 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 11:14 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-11 11:14 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-11 11:14 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-11 11:14 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-11 11:14 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-11 11:14 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-11 11:14 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-11 11:14 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-11 11:14 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 11:14 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-11 11:14 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-11 11:14 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 11:14 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-11 11:14 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-11 11:14 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-11 11:14 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-11 11:14 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 11:14 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-11 11:14 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-11 11:14 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-11 11:14 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-11 11:14 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-11 11:14 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-11 11:14 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 11:14 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-11 11:14 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-11 11:14 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-07-11 11:14 - 2014-05-30 10:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-11 11:14 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-11 11:14 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 11:13 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 11:13 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-09 14:40 - 2014-07-09 15:11 - 00000000 ____D () C:\Users\Cornelia\Documents\Albelli Fotobücher
2014-07-09 14:40 - 2014-07-09 14:40 - 00001913 _____ () C:\Users\Cornelia\Desktop\Albelli Fotobücher.lnk
2014-07-09 14:39 - 2014-07-09 20:17 - 00000000 ____D () C:\Users\Cornelia\AppData\Local\Albelli Fotobücher
2014-07-09 14:39 - 2014-07-09 14:40 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Albelli Fotobücher
2014-07-09 14:39 - 2014-07-09 14:39 - 06656320 _____ (Albelli ) C:\Users\Cornelia\Downloads\albelli_DE.exe
2014-07-08 10:55 - 2014-07-08 15:01 - 00047104 _____ () C:\Users\Cornelia\Documents\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-06 20:31 - 2014-07-06 21:13 - 00035840 _____ () C:\Users\Cornelia\Desktop\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-03 21:04 - 2014-07-03 21:04 - 00010620 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.xlsx
2014-07-03 20:55 - 2014-07-03 21:04 - 00004660 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.ods

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-07-31 22:10 - 2014-07-23 19:35 - 00016237 _____ () C:\Users\Cornelia\Desktop\FRST.txt
2014-07-31 22:09 - 2014-07-31 22:09 - 00000000 ____D () C:\Users\Cornelia\Desktop\FRST-OlderVersion
2014-07-31 22:09 - 2014-07-23 19:35 - 02094080 _____ (Farbar) C:\Users\Cornelia\Desktop\FRST64.exe
2014-07-31 22:09 - 2014-07-23 19:35 - 00000000 ____D () C:\FRST
2014-07-31 22:08 - 2014-04-07 22:55 - 00000000 ____D () C:\Users\Cornelia\Documents\Outlook-Dateien
2014-07-31 22:01 - 2014-03-01 22:05 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Skype
2014-07-31 21:42 - 2014-04-05 22:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-31 21:05 - 2009-07-14 06:45 - 00021856 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-31 21:05 - 2009-07-14 06:45 - 00021856 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-31 20:59 - 2014-07-30 21:01 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-31 20:57 - 2014-04-05 23:04 - 00000000 ___RD () C:\Users\Cornelia\Dropbox
2014-07-31 20:56 - 2014-03-01 22:19 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Dropbox
2014-07-31 20:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-30 22:10 - 2014-07-30 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-30 22:10 - 2014-07-30 21:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-30 22:10 - 2014-07-29 22:05 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-07-30 22:10 - 2014-03-01 16:17 - 00000000 ____D () C:\Users\Cornelia
2014-07-30 22:08 - 2014-07-29 22:07 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-07-30 21:44 - 2014-07-30 15:33 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Systweak
2014-07-30 21:44 - 2014-07-30 15:33 - 00000000 ____D () C:\ProgramData\Systweak
2014-07-30 21:44 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-07-30 21:41 - 2014-07-30 21:41 - 01062136 _____ (Bleeping Computer, LLC) C:\Users\Cornelia\Downloads\magdalena64.exe
2014-07-30 21:41 - 2014-07-30 21:41 - 00001666 _____ () C:\Users\Cornelia\Desktop\Rkill.txt
2014-07-30 21:41 - 2014-07-30 21:40 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Cornelia\Downloads\magdalena.exe
2014-07-30 21:00 - 2014-07-30 21:00 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-07-30 21:00 - 2014-07-30 21:00 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-30 21:00 - 2014-07-30 20:59 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(3).exe
2014-07-30 20:58 - 2014-07-29 22:07 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-07-30 20:57 - 2014-05-08 21:03 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-30 20:57 - 2014-05-08 21:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-30 20:53 - 2014-07-30 20:53 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Cornelia\Downloads\mbam-clean-2.1.1.1001.exe
2014-07-30 20:32 - 2014-07-30 20:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(2).exe
2014-07-30 20:28 - 2014-07-30 20:28 - 00000247 _____ () C:\Users\Cornelia\Desktop\Search.txt
2014-07-30 15:45 - 2014-03-01 17:24 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-07-30 15:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-07-30 15:41 - 2014-07-30 15:35 - 00028145 _____ () C:\Windows\wininit.ini
2014-07-30 15:40 - 2014-07-30 15:33 - 00000000 ____D () C:\Program Files (x86)\PennyBee
2014-07-30 15:36 - 2014-07-29 22:05 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-07-30 15:33 - 2014-07-30 15:33 - 00003338 _____ () C:\Windows\System32\Tasks\ASP
2014-07-29 22:42 - 2014-04-05 22:56 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-29 22:42 - 2014-04-05 22:56 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-29 22:42 - 2014-04-05 22:56 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-29 22:34 - 2014-07-29 22:22 - 00003266 _____ () C:\Windows\System32\Tasks\PC Speed Maximizer Schedule
2014-07-29 22:28 - 2014-07-29 22:07 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-07-29 22:19 - 2014-03-01 22:12 - 00001139 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-07-29 22:16 - 2014-07-29 22:16 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2014-07-29 22:14 - 2014-04-05 21:47 - 00000000 ____D () C:\ProgramData\DatacardService
2014-07-29 22:14 - 2014-04-05 21:47 - 00000000 ____D () C:\Program Files (x86)\Mobile Partner
2014-07-29 22:13 - 2014-07-29 22:13 - 00000000 ____D () C:\Program Files (x86)\predm
2014-07-29 22:13 - 2014-07-29 22:12 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-07-29 22:12 - 2014-07-29 22:12 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-07-29 22:12 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-07-29 22:12 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-07-29 22:10 - 2014-07-29 22:10 - 00000000 ____D () C:\Users\Cornelia\Documents\PC Speed Maximizer
2014-07-29 22:08 - 2014-07-29 22:07 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-07-29 22:08 - 2014-07-29 22:07 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-07-29 22:08 - 2014-07-29 22:07 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-07-29 22:07 - 2014-07-29 22:07 - 00000322 _____ () C:\Users\Cornelia\AppData\Roaming\aps.uninstall.scan.results
2014-07-29 22:06 - 2014-07-29 22:06 - 00002466 _____ () C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-07-29 22:05 - 2014-07-29 22:05 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-07-29 22:05 - 2014-07-29 22:05 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-07-29 22:05 - 2014-07-29 22:05 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-07-29 22:05 - 2014-07-29 22:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-07-29 21:49 - 2014-07-29 21:49 - 00000000 __SHD () C:\Users\Cornelia\AppData\Local\EmieUserList
2014-07-29 21:49 - 2014-07-29 21:49 - 00000000 __SHD () C:\Users\Cornelia\AppData\Local\EmieSiteList
2014-07-29 21:47 - 2014-07-29 21:47 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\InetStat
2014-07-29 21:46 - 2014-07-29 21:45 - 00471936 _____ () C:\Users\Cornelia\Downloads\spybot-2.4-Downloader.exe
2014-07-29 21:42 - 2014-07-29 21:42 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8(2).exe
2014-07-29 21:04 - 2014-07-29 21:04 - 00000000 ____D () C:\Users\Cornelia\Downloads\FRST-OlderVersion
2014-07-29 20:19 - 2014-05-08 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-29 16:48 - 2014-07-29 22:04 - 00575544 _____ (ClickMeIn Limited) C:\Users\Cornelia\AppData\Local\AnyProtectScannerSetup.exe
2014-07-28 23:43 - 2014-03-01 12:54 - 01403910 ____R () C:\Windows\WindowsUpdate.log
2014-07-27 21:36 - 2014-04-05 23:04 - 00001029 _____ () C:\Users\Cornelia\Desktop\Dropbox.lnk
2014-07-27 21:36 - 2014-03-01 22:23 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-24 21:00 - 2014-03-02 04:36 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-23 19:37 - 2014-07-23 19:36 - 00026288 _____ () C:\Users\Cornelia\Downloads\Addition.txt
2014-07-23 19:30 - 2009-07-14 06:51 - 00035946 ____R () C:\Windows\setupact.log
2014-07-23 19:27 - 2010-11-21 05:47 - 00137328 ____R () C:\Windows\PFRO.log
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\TEMP
2014-07-21 20:12 - 2014-07-21 20:12 - 00000000 ____D () C:\ProgramData\Licenses
2014-07-21 20:11 - 2014-07-20 20:54 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Nico Mak Computing
2014-07-21 20:01 - 2009-07-14 07:37 - 00000000 ____D () C:\Windows\DigitalLocker
2014-07-20 20:52 - 2014-07-20 20:52 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8(1).exe
2014-07-20 20:47 - 2014-07-20 20:47 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-07-18 22:06 - 2014-07-18 22:06 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager [1].exe
2014-07-18 22:05 - 2014-07-18 22:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-18 22:02 - 2014-07-18 22:02 - 00788832 _____ ( ) C:\Users\Cornelia\Downloads\mbam-setup-2.0.2.1012_CB-DL-Manager.exe
2014-07-18 10:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-17 21:09 - 2014-07-17 21:09 - 04892480 _____ (WinZip International LLC ) C:\Users\Cornelia\Downloads\wzmp_8.exe
2014-07-17 21:03 - 2014-07-17 21:02 - 21407864 _____ (Simply Super Software ) C:\Users\Cornelia\Downloads\trjsetup690.exe
2014-07-16 16:43 - 2014-07-30 15:33 - 00020280 _____ () C:\Windows\system32\roboot64.exe
2014-07-13 14:04 - 2014-07-13 14:04 - 02286592 _____ () C:\Users\Cornelia\Downloads\Projektreise2010.pps
2014-07-12 22:00 - 2014-06-04 18:49 - 00000000 ____D () C:\Users\Cornelia\Documents\Wohnungen WOR_GER
2014-07-12 13:38 - 2009-07-14 06:45 - 00416360 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-12 00:34 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-12 00:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-12 00:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-11 22:56 - 2014-07-11 22:56 - 00004577 _____ () C:\Users\Cornelia\Documents\Links für Kids in Hasselbach.odt
2014-07-11 15:27 - 2014-04-07 22:28 - 00000000 ____D () C:\Users\Cornelia\AppData\Local\Microsoft Help
2014-07-11 11:20 - 2014-04-07 22:28 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-07-11 11:18 - 2014-03-02 01:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 11:17 - 2014-03-02 01:31 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-09 20:17 - 2014-07-09 14:39 - 00000000 ____D () C:\Users\Cornelia\AppData\Local\Albelli Fotobücher
2014-07-09 15:11 - 2014-07-09 14:40 - 00000000 ____D () C:\Users\Cornelia\Documents\Albelli Fotobücher
2014-07-09 14:40 - 2014-07-09 14:40 - 00001913 _____ () C:\Users\Cornelia\Desktop\Albelli Fotobücher.lnk
2014-07-09 14:40 - 2014-07-09 14:39 - 00000000 ____D () C:\Users\Cornelia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Albelli Fotobücher
2014-07-09 14:39 - 2014-07-09 14:39 - 06656320 _____ (Albelli ) C:\Users\Cornelia\Downloads\albelli_DE.exe
2014-07-08 15:01 - 2014-07-08 10:55 - 00047104 _____ () C:\Users\Cornelia\Documents\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-06 21:13 - 2014-07-06 20:31 - 00035840 _____ () C:\Users\Cornelia\Desktop\Kopie von Sommerfest 2  Orgaztabelle.xls
2014-07-04 09:09 - 2011-04-12 09:43 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-07-04 09:09 - 2011-04-12 09:43 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-07-04 09:09 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-03 21:04 - 2014-07-03 21:04 - 00010620 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.xlsx
2014-07-03 21:04 - 2014-07-03 20:55 - 00004660 _____ () C:\Users\Cornelia\Documents\Ausgaben Juli 2014.ods

Some content of TEMP:
====================
C:\Users\Cornelia\AppData\Local\Temp\avgnt.exe
C:\Users\Cornelia\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpenntkx.dll
C:\Users\Cornelia\AppData\Local\Temp\ose00000.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-29 20:52

==================== End Of Log ============================
--- --- ---

--- --- ---

Alt 31.07.2014, 22:46   #12
Bootsektor
Ruhe in Frieden
† 2019
 
Infizierung mit trojan.ransom.ed - Standard

Infizierung mit trojan.ransom.ed


Puh,

da hast du ja fleissig eingesammelt... ein Haufen Adware...
Wie sieht es nach diesen Schritten aus?

Was ist das hier?

Zitat:
(Bleeping Computer, LLC) C:\Users\Cornelia\Downloads\magdalena64.exe
Schritt 1
Bitte deinstalliere folgende Programme (falls vorhanden) :

SafeFinder Smartbar


Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Programm auswählen --> entfernen

Falls du ein Programm nicht deinstallieren kannst, lade dir von hier den Revo-uninstaller herunter und deinstalliere es damit, wähle dabei den moderaten Modus.

Schritt 2

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
HKLM-x32\...\Run: [AnyProtect Scanner] => "C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe"
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_cmi_14_31_ff&cd=2XzuyEtN2Y1L1QzutBtDtC0AtDyCtAzztAyEyDzy0DyCtAyCtN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEyCyC0FzyyByDyBtG0Czy0E0DtG0DyEzz0EtGyBzzyCyDtGtDtB0A0EtB0AtByD0Bzz0AyE2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyBtAtB0AtDzzzy0CtGtAtByDyCtGyB0C0DtDtG0E0B0FzztGyB0DtBzy0CtAzy0A0D0FtDzz2Q&cr=425765688&ir=
FF SearchPlugin: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\searchplugins\Astromenda.xml
FF SearchPlugin: C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\searchplugins\SafeFinder Search.xml
FF Extension: Astromenda New Tab - C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\Extensions\{849ded12-59e9-4dae-8f86-918b70d213dc} [2014-07-30]
FF Extension: SafeFinder Smartbar - C:\Users\Cornelia\AppData\Roaming\Mozilla\Firefox\Profiles\6s88xg61.default\Extensions\{de4e3beb-86d8-b3d9-b2a3-324e4222e97a} 
[2014-07-29]
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {12CD0B09-4AFD-4629-A815-135DB6461233} - System32\Tasks\ASP => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {42574D18-4EC3-41B6-B097-1195DFE3DDA8} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {9E09987F-7A07-404C-B5C6-6DFE0758944E} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {AD3C3580-095D-459A-B25E-E0DCF7B127F7} - System32\Tasks\PC Speed Maximizer Schedule => C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
Task: {B6730E0F-43B2-46D0-932E-64CDA0EE441A} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
S0 obakajt; System32\drivers\bbhgq.sys [X]
C:\Program Files (x86)\RegClean Pro
C:\Program Files (x86)\AnyProtectEx
C:\Users\Cornelia\AppData\Roaming\Systweak
C:\ProgramData\Systweak
C:\Program Files (x86)\PennyBee
C:\Windows\System32\Tasks\ASP
C:\Windows\system32\roboot64.exe
C:\Windows\System32\Tasks\PC Speed Maximizer Schedule
C:\Program Files (x86)\predm
C:\Users\Cornelia\Documents\PC Speed Maximizer
2014-07-29 22:07 - 2014-07-30 22:08 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-07-29 22:07 - 2014-07-30 20:58 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-07-29 22:07 - 2014-07-29 22:28 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-07-29 22:07 - 2014-07-29 22:08 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-07-29 22:07 - 2014-07-29 22:08 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-07-29 22:07 - 2014-07-29 22:08 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
C:\Users\Cornelia\AppData\Roaming\aps.uninstall.scan.results
2014-07-29 22:05 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-07-29 22:04 - 2014-07-29 16:48 - 00575544 _____ (ClickMeIn Limited) C:\Users\Cornelia\AppData\Local\AnyProtectScannerSetup.exe
folder: C:\Windows\Addins
folder: C:\System32\drivers\bbhgq.sys 
reboot:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 3
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.
Antwort

Themen zu Infizierung mit trojan.ransom.ed
adware.eorezo, anti-malware, infizierung, malwarebytes anti-malware, pup.optional.blockandsurf.a, pup.optional.conduit.a, pup.optional.dealkeeper.a, pup.optional.firstseentoday.a, pup.optional.gameo.a, pup.optional.helperbar.a, pup.optional.installcore.a, pup.optional.sanbreel.a, pup.optional.snapdo.a, pup.optional.snapdo.t, pup.optional.systemspeedup, pup.optional.trovi.a, pup.optional.winsecurity.a, trojan.ransom.ed, trojaner, vermutlich


« Windows 7: Selbstständige Eingabe von Passwörtern | internet extrem langsam und es gehen immer fenster von alleine auf »


Ähnliche Themen: Infizierung mit trojan.ransom.ed


  1. Trojan-Ransom.Win32.Blocker.cbsn & Trojan-Spy.Win.32.Zbot.nsur eingefangen -.-
    Plagegeister aller Art und deren Bekämpfung - 12.04.2014 (23)
  2. Nach spontanen mbam scan: Trojan.Phex.THAGen6 und Trojan.Ransom.ED
    Log-Analyse und Auswertung - 22.12.2013 (1)
  3. Trojan.Ransom.SUGen/PUM.Hijack.StartMenu/und Trojan Ransom
    Plagegeister aller Art und deren Bekämpfung - 16.04.2013 (2)
  4. Mehrere Trojaner im Temp Ordner (Trojan.Citadel.IE, Trojan.Ransom.CT, Trojan.Zlob)
    Log-Analyse und Auswertung - 14.04.2013 (7)
  5. Trojan.Ransom.ED, Trojan.Agent.ED und Trojan.FakeMS.PRGen auf laptop
    Log-Analyse und Auswertung - 13.04.2013 (9)
  6. Trojan.Ransom.ED, Trojan.Agent.ED, Trojan.FakeMS.PRGen und Bublik b. durch Email erhalten?
    Plagegeister aller Art und deren Bekämpfung - 02.04.2013 (29)
  7. Bublik b.; Trojan.Ransom.ED; Trojan.Agent.ED und Trojan.FakeMS.PRGen in Email?
    Mülltonne - 28.03.2013 (0)
  8. Vista: Trojan.Ransom.Gen; Trojan.0Access; Trojan.Agent; Firewall inaktiv
    Plagegeister aller Art und deren Bekämpfung - 28.03.2013 (3)
  9. BKA-Trojaner u.a. (Trojan.Bublik, Trojan-Ransom.Foreign, Worm.Cridex, Trojan.Yakes)
    Log-Analyse und Auswertung - 17.03.2013 (4)
  10. Trojan.Agent, Trojan.Delf, Trojan.Ransom.Gen
    Plagegeister aller Art und deren Bekämpfung - 12.02.2013 (18)
  11. Trojan.Downloader, Riskware.tool.ck, exploit.drop.gs & Trojan.Ransom.SUGen in different locations!
    Plagegeister aller Art und deren Bekämpfung - 12.12.2012 (1)
  12. 2 Funde Trojan.Ransom.SUGen Trojan.Ransom
    Plagegeister aller Art und deren Bekämpfung - 10.12.2012 (15)
  13. BKA-Virus, PUM.UserWLoad, Trojan.Delf, Trojan.Ransom.Gen, alles auf einmal
    Log-Analyse und Auswertung - 18.11.2012 (23)
  14. Hilfe Virus! Internet tot!Trojan.Ransom.FGen Trojan.0Access
    Log-Analyse und Auswertung - 07.10.2012 (13)
  15. Auf meinem PC: PUM.Disabled.SecurityCenter, Exploit.Drop.GS, Trojan.Delf, Trojan.Ransom.Gen
    Plagegeister aller Art und deren Bekämpfung - 02.10.2012 (29)
  16. TR/Ransom.294912 (Antivir) / Trojan-Ransom.Win32.Gimemo.vyp (Kaspersky)
    Log-Analyse und Auswertung - 20.07.2012 (18)
  17. TR/TR/Ransom.EJ.39 Infizierung
    Log-Analyse und Auswertung - 11.01.2012 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Infizierung mit trojan.ransom.ed - Hallo, ich habe mir laut Malwarebytes Anti-Malware den Trojaner trojan.ransom.ed eingefangen. Vermutlich bei der Öffnung eines emailattachements. Bisher keine Anzeichen einer Falschfunktion des Computers. Wie kann ich den denn wieder - Infizierung mit trojan.ransom.ed...
Archiv
Du betrachtest: Infizierung mit trojan.ransom.ed auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129