kann webssearches nicht deinstallieren und popups stoppen internetseiten bis ich auf download klick

Inao · 22.10.2014, 17:12

Hallo,
meine google chrome Einstellungen werden immer wieder von webssearches.de umgestellt. Des Weiteren kommt öfter ein Fenster von Java, dass die Internetseite solange einfriert bis ich auf `Download´ klick. Außerdem hatte ich mal einen ADP - Werbeblocker, der jetzt weg ist und ich nun mit Werbepopups überlagert werde und sich Gewinnspielseiten öffnen etc.

schrauber · 22.10.2014, 17:20

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Inao · 24.10.2014, 08:32

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-10-2014
Ran by ina (administrator) on INA_NOTEBOOK on 24-10-2014 09:30:11
Running from C:\Users\ina\Downloads
Loaded Profile: ina (Available profiles: ina)
Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files (x86)\35556262-902E-49AE-8622-66E14F1F041C\arrmeapsie64.exe
() C:\Windows\score.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\Search Extensions\Client.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.17074_none_6233bc1f5106b696\TiWorker.exe
(Smartbar) C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\ina\Downloads\FRST64 (2).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKU\S-1-5-21-4251072410-3384136539-3598520572-1001\...\Run: [Browser Infrastructure Helper] => C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.exe [28192 2014-08-27] (Smartbar)
AppInit_DLLs: C:\Users\ina\AppData\Local\Smartbar\Application\Resources\crdlil64.dll => C:\Users\ina\AppData\Local\Smartbar\Application\Resources\crdlil64.dll [77856 2014-10-08] ()
AppInit_DLLs-x32: C:\Users\ina\AppData\Local\Smartbar\Application\Resources\crdlil.dll => C:\Users\ina\AppData\Local\Smartbar\Application\Resources\crdlil.dll [67104 2014-10-08] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:64499;https=127.0.0.1:64499
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMRsTk_xkWWRNTkI90qgdlAcdu6pLCIwR9S_rd6tKxhYWVhz2p-xxBk5-sDXeC8eeQR0j5wXDDWGYyQHRUUHiAToFBOVlZ_QJBqXMJq99DiJzJqtANtjZIqKNEKWn-Qcqg,,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2F8DFDFCC3B6CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMRsTk_xkWWRNTkI90qgdlAcdu6pLCIwR9S_rd6tKxhYWVhz2p-xxBk5-sDXeC8eeQR0j5wXDDWGYyQHRUUHiAToFBOVlZ_QJBqXMJq99DiJzJqtANtjZIqKNEKWn-Qcqg,,&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1413981860&from=adks&uid=KINGSTONXSV300S37A120G_50026B723506793A&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1413981860&from=adks&uid=KINGSTONXSV300S37A120G_50026B723506793A
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1413981860&from=adks&uid=KINGSTONXSV300S37A120G_50026B723506793A
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1413981860&from=adks&uid=KINGSTONXSV300S37A120G_50026B723506793A&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe www.mystartsearch.com/?type=sc&ts=1411896623&from=tugs&uid=KINGSTONXSV300S37A120G_50026B723506793A
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1413981860&from=adks&uid=KINGSTONXSV300S37A120G_50026B723506793A&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1413981860&from=adks&uid=KINGSTONXSV300S37A120G_50026B723506793A&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMRsTk_xkWWRNTkI90qgdlAcdu6pLCIwR9S_rd6tKxhYWVhz2p-xxBk5-sDXeC8eeQR0j5wXDDWGYyQHRUUHiAToFBOVlZ_QJBqXMJq99DiJzJqtANtjZIqKNEKWn-QcrA,,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMRsTk_xkWWRNTkI90qgdlAcdu6pLCIwR9S_rd6tKxhYWVhz2p-xxBk5-sDXeC8eeQR0j5wXDDWGYyQHRUUHiAToFBOVlZ_QJBqXMJq99DiJzJqtANtjZIqKNEKWn-Qcqg,,&q={searchTerms}
BHO: Shopping Helper SmartbarEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} ->  No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Shopping Helper SmartbarEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} ->  No File
Toolbar: HKLM - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-21]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://istart.webssearches.com/?type=sc&ts=1413981860&from=adks&uid=KINGSTONXSV300S37A120G_50026B723506793A

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 CouponArificService64; C:\Program Files (x86)\35556262-902E-49AE-8622-66E14F1F041C\arrmeapsie64.exe [172544 2014-09-29] () [File not signed]
R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
R2 scores; C:\Windows\score.exe [4834816 2014-10-02] () [File not signed]
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [X]
S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [129536 2013-07-05] (Advanced Micro Devices) [File not signed]
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-09-29] (NetFilterSDK.com)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U3 axrirpow; \??\C:\Users\ina\AppData\Local\Temp\axrirpow.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-24 09:29 - 2014-10-24 09:30 - 02112000 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (2).exe
2014-10-22 18:22 - 2014-10-22 18:22 - 02110976 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (1).exe
2014-10-22 18:22 - 2014-10-22 18:22 - 01102336 _____ (Farbar) C:\Users\ina\Downloads\FRST (1).exe
2014-10-22 17:59 - 2014-10-22 17:59 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (10).exe
2014-10-22 17:50 - 2014-10-22 17:50 - 00380416 _____ () C:\Users\ina\Downloads\Gmer-19357.exe
2014-10-22 17:47 - 2014-10-22 17:47 - 00029521 _____ () C:\Users\ina\Downloads\Addition.txt
2014-10-22 17:46 - 2014-10-24 09:30 - 00011625 _____ () C:\Users\ina\Downloads\FRST.txt
2014-10-22 17:46 - 2014-10-24 09:30 - 00000000 ____D () C:\FRST
2014-10-22 17:46 - 2014-10-22 17:46 - 02110976 _____ (Farbar) C:\Users\ina\Downloads\FRST64.exe
2014-10-22 17:45 - 2014-10-22 17:45 - 01102336 _____ (Farbar) C:\Users\ina\Downloads\FRST.exe
2014-10-22 17:44 - 2014-10-22 17:44 - 00000468 _____ () C:\Users\ina\Downloads\defogger_disable.log
2014-10-22 17:44 - 2014-10-22 17:44 - 00000000 _____ () C:\Users\ina\defogger_reenable
2014-10-22 17:43 - 2014-10-22 17:43 - 00050477 _____ () C:\Users\ina\Downloads\Defogger.exe
2014-10-22 17:25 - 2014-10-22 17:25 - 00616896 _____ () C:\Users\ina\Downloads\avira_de_av___ws-Downloader.exe
2014-10-22 14:57 - 2014-10-22 14:57 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (9).exe
2014-10-22 14:55 - 2014-10-22 14:57 - 00018040 _____ () C:\Users\ina\Downloads\software_removal_tool.log
2014-10-22 14:55 - 2014-10-22 14:55 - 04703560 _____ (Google) C:\Users\ina\Downloads\software_removal_tool.exe
2014-10-22 14:45 - 2014-10-22 14:56 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-10-22 14:45 - 2014-10-22 14:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Speedup
2014-10-22 14:45 - 2014-10-22 14:45 - 00000000 ____D () C:\Program Files (x86)\System Speedup
2014-10-22 14:45 - 2014-07-17 18:49 - 00020328 _____ () C:\Windows\system32\roboot64.exe
2014-10-22 14:43 - 2014-10-24 09:27 - 00000000 ____D () C:\Program Files\CouponArific
2014-10-22 14:43 - 2014-10-22 14:43 - 00004328 _____ () C:\Windows\System32\Tasks\RocketTab Update Task
2014-10-22 14:43 - 2014-10-22 14:43 - 00003542 _____ () C:\Windows\System32\Tasks\RocketTab
2014-10-22 14:43 - 2014-10-22 14:43 - 00000000 ____D () C:\Program Files (x86)\Search Extensions
2014-10-22 14:43 - 2014-10-22 14:43 - 00000000 ____D () C:\Program Files (x86)\35556262-902E-49AE-8622-66E14F1F041C
2014-10-22 14:42 - 2014-10-22 14:42 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (8).exe
2014-10-22 13:58 - 2014-10-22 13:58 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (7).exe
2014-10-22 13:58 - 2014-10-22 13:58 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (6).exe
2014-10-22 13:57 - 2014-10-22 13:57 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (5).exe
2014-10-22 13:57 - 2014-10-22 13:57 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (4).exe
2014-10-22 13:57 - 2014-10-22 13:57 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (3).exe
2014-10-22 13:57 - 2014-10-22 13:57 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (2).exe
2014-10-22 13:54 - 2014-10-22 13:54 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup (1).exe
2014-10-22 13:53 - 2014-10-22 13:53 - 00071024 _____ (Premium Installer ) C:\Users\ina\Downloads\setup.exe
2014-10-22 13:51 - 2014-10-22 13:51 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014 (2).zip
2014-10-22 13:51 - 2014-10-22 13:51 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014 (1).zip
2014-10-17 08:23 - 2014-10-17 08:23 - 00307896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 13:57 - 2014-10-10 06:47 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 13:57 - 2014-10-10 06:47 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 13:57 - 2014-10-08 06:26 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 13:57 - 2014-09-18 01:24 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 13:57 - 2014-09-18 00:56 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 07:57 - 2014-09-20 07:18 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 07:57 - 2014-09-20 07:17 - 02236928 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 07:57 - 2014-09-20 07:17 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 07:57 - 2014-09-20 07:17 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-10-16 07:57 - 2014-09-20 07:17 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 19280896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 07:57 - 2014-09-20 07:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 07:57 - 2014-09-20 07:15 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 07:57 - 2014-09-20 07:15 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 07:57 - 2014-09-20 07:15 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 13757952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 07:57 - 2014-09-20 05:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 07:57 - 2014-09-20 05:56 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 07:57 - 2014-09-20 05:56 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 07:57 - 2014-09-20 05:56 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 07:57 - 2014-09-20 05:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 07:57 - 2014-09-20 05:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 07:57 - 2014-09-20 03:06 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-10-16 07:54 - 2014-09-30 00:49 - 00705480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 07:54 - 2014-09-30 00:49 - 00104904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-16 07:52 - 2014-09-13 07:29 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 07:52 - 2014-09-13 06:02 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-16 07:52 - 2014-09-03 04:48 - 00510464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 07:52 - 2014-09-03 04:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 07:52 - 2014-07-07 07:53 - 01125376 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 07:52 - 2014-07-07 07:52 - 03248128 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 07:52 - 2014-07-07 07:52 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 07:52 - 2014-07-07 07:52 - 00300544 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 07:52 - 2014-07-07 07:51 - 05982208 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 07:52 - 2014-07-07 06:01 - 01049600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 07:52 - 2014-07-07 06:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 07:52 - 2014-07-07 06:00 - 05095424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 07:52 - 2014-07-07 05:59 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 07:47 - 2014-07-12 06:41 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL
2014-10-16 07:47 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 07:47 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 07:47 - 2014-07-12 06:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 07:47 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 07:47 - 2014-07-12 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 07:47 - 2014-07-12 06:16 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL
2014-10-16 07:47 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-16 07:47 - 2014-07-12 06:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-16 07:47 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-16 07:47 - 2014-07-12 06:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-16 07:47 - 2014-07-12 06:15 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-16 07:47 - 2014-07-12 02:02 - 00478352 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-16 07:47 - 2014-07-12 02:00 - 00478352 _____ () C:\Windows\system32\locale.nls
2014-10-16 07:47 - 2014-07-09 00:33 - 00181248 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
2014-10-16 07:47 - 2014-07-09 00:32 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2014-10-16 07:47 - 2014-07-09 00:32 - 00340480 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
2014-10-16 07:47 - 2014-07-09 00:30 - 01220608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2014-10-16 07:47 - 2014-07-07 07:52 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2014-10-16 07:47 - 2014-07-07 07:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-10-16 07:47 - 2014-07-04 12:52 - 00328000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-10-16 07:47 - 2014-07-03 03:59 - 01824784 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-16 07:47 - 2014-07-03 02:30 - 01408952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-16 07:47 - 2014-06-28 09:01 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2014-10-16 07:47 - 2014-06-28 08:57 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-10-16 07:47 - 2014-06-28 08:56 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2014-10-16 07:47 - 2014-06-25 09:09 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-10-16 07:47 - 2014-06-25 09:07 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-10-16 07:47 - 2014-06-18 01:27 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-10-16 07:47 - 2014-06-18 01:23 - 02238464 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-10-16 07:47 - 2014-06-11 16:47 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-10-16 07:47 - 2014-06-11 06:40 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-10-16 07:47 - 2014-06-11 00:44 - 01403896 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-10-16 07:47 - 2014-05-30 01:31 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-10-16 07:47 - 2014-05-30 01:03 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-10-16 07:47 - 2014-02-04 12:57 - 01271664 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-15 21:24 - 2014-09-28 06:18 - 04068352 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 21:24 - 2014-08-30 07:48 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-10-15 21:24 - 2014-08-30 07:46 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-15 21:24 - 2014-08-30 06:05 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-10-15 21:24 - 2014-08-30 06:03 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-15 21:24 - 2014-06-13 01:34 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-10-15 21:24 - 2014-06-13 01:29 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-10-15 21:22 - 2014-08-02 00:08 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-10-15 21:22 - 2014-07-24 15:50 - 00447296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-10-15 21:22 - 2014-07-17 01:28 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-10-15 21:22 - 2014-07-17 00:59 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-10-15 21:22 - 2014-07-17 00:59 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-10-15 21:22 - 2014-07-12 08:45 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-10-15 21:22 - 2014-07-12 06:36 - 00674304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-10-15 21:22 - 2014-07-12 06:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-10-15 21:22 - 2014-07-12 06:34 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-10-15 21:22 - 2014-07-12 06:34 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-10-15 21:22 - 2014-06-28 08:57 - 01341952 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-10-15 21:22 - 2014-06-28 04:23 - 01126400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-10-12 18:55 - 2014-10-12 18:55 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014.zip
2014-10-12 17:15 - 2014-10-12 17:15 - 00060148 _____ () C:\Windows\SysWOW64\CCCInstall_201410121715369076.log
2014-10-12 17:09 - 2014-10-12 17:09 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-10-08 07:24 - 2014-10-22 14:44 - 00002508 _____ () C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-10-08 07:24 - 2014-10-22 14:43 - 00000005 _____ () C:\end
2014-10-08 07:23 - 2014-10-08 07:23 - 00000000 ____D () C:\Users\ina\AppData\Local\Smartbar
2014-10-08 07:23 - 2014-10-08 07:23 - 00000000 ____D () C:\Users\ina\AppData\Local\LPT
2014-09-29 22:13 - 2014-09-29 22:13 - 00046376 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\netfilter64.sys
2014-09-29 19:45 - 2014-09-29 19:45 - 00488141 _____ () C:\Users\ina\Downloads\extension_1_7_4 (1).crx
2014-09-28 18:18 - 2014-09-28 18:19 - 31382256 _____ (DVDVideoSoft Ltd. ) C:\Users\ina\Downloads\FreeYouTubeToMP3Converter_3.12.44.922.exe
2014-09-28 17:58 - 2014-09-28 17:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-28 17:57 - 2014-09-28 18:10 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-09-28 17:55 - 2014-09-28 17:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\ina\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-28 16:17 - 2014-09-28 16:17 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-09-28 16:17 - 2014-09-28 16:17 - 00000000 _____ () C:\autoexec.bat
2014-09-28 16:10 - 2014-09-28 16:11 - 112794960 _____ (Apple Inc.) C:\Users\ina\Downloads\iTunes64Setup (1).exe
2014-09-28 16:07 - 2014-09-28 16:07 - 00000000 ____D () C:\Users\ina\AppData\Roaming\RHEng
2014-09-28 16:00 - 2014-09-28 16:00 - 00488141 _____ () C:\Users\ina\Downloads\extension_1_7_4.crx
2014-09-28 15:58 - 2014-09-28 15:58 - 00000000 ____D () C:\Program Files (x86)\FlasshCouPon
2014-09-28 15:57 - 2014-09-28 15:57 - 00000000 ____D () C:\Program Files (x86)\DeialssFiNdERPro
2014-09-28 15:57 - 2014-09-28 15:57 - 00000000 ____D () C:\Program Files (x86)\CliCkForSeale
2014-09-28 13:21 - 2014-09-28 13:21 - 00003126 _____ () C:\Windows\System32\Tasks\{00D21B4B-BCF2-4AA2-8ED4-311608004353}
2014-09-28 13:20 - 2014-09-28 13:20 - 00301608 _____ (VuuPC Limited) C:\Users\ina\AppData\Local\nsm6184.tmp
2014-09-28 12:38 - 2014-09-28 13:21 - 00000000 ____D () C:\Users\ina\AppData\Roaming\InetStat
2014-09-28 12:38 - 2014-09-28 12:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
2014-09-28 11:59 - 2014-09-28 11:59 - 00003154 _____ () C:\Windows\System32\Tasks\{5F43D8E9-FAA5-4B76-9488-53FBD2FCB334}
2014-09-28 11:34 - 2014-09-28 11:34 - 00000000 ____D () C:\Program Files (x86)\predm
2014-09-28 11:32 - 2014-10-16 07:56 - 00000000 ___HD () C:\Users\Public\Temp
2014-09-28 11:31 - 2014-10-24 09:26 - 00001702 _____ () C:\Windows\Tasks\GHQVNLG.job
2014-09-28 11:31 - 2014-10-24 09:26 - 00001348 _____ () C:\Windows\Tasks\MI.job
2014-09-28 11:31 - 2014-10-12 19:30 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-09-28 11:31 - 2014-09-28 11:31 - 00004712 _____ () C:\Windows\System32\Tasks\GHQVNLG
2014-09-28 11:31 - 2014-09-28 11:31 - 00004360 _____ () C:\Windows\System32\Tasks\MI
2014-09-28 11:31 - 2014-09-28 11:31 - 00003096 _____ () C:\Windows\System32\Tasks\{5AD8E795-57DF-4470-9B03-7BDF9929CCE7}
2014-09-28 11:31 - 2014-09-28 11:31 - 00000000 ____D () C:\Users\ina\Documents\Optimizer Pro
2014-09-28 11:31 - 2014-09-28 11:31 - 00000000 ____D () C:\Users\ina\AppData\Local\globalUpdate
2014-09-28 11:30 - 2014-09-28 12:36 - 00000444 __RSH () C:\ProgramData\ntuser.pol
2014-09-28 11:30 - 2014-09-28 11:30 - 00004030 _____ () C:\Windows\System32\Tasks\LaunchSignup
2014-09-28 11:30 - 2014-09-28 11:30 - 00000000 ____D () C:\Users\ina\AppData\Local\com
2014-09-28 11:30 - 2014-09-28 11:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PepperZip
2014-09-28 11:29 - 2014-10-02 18:56 - 04834816 _____ () C:\Windows\score.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-24 09:28 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-10-24 09:26 - 2013-09-21 14:13 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-22 17:44 - 2013-09-21 14:13 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-22 17:44 - 2013-09-21 14:11 - 00000000 ____D () C:\Users\ina
2014-10-22 15:07 - 2013-09-21 14:11 - 01766753 _____ () C:\Windows\WindowsUpdate.log
2014-10-22 15:01 - 2013-10-08 19:42 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-10-22 15:01 - 2012-07-26 12:27 - 00746048 _____ () C:\Windows\system32\perfh007.dat
2014-10-22 15:01 - 2012-07-26 12:27 - 00151906 _____ () C:\Windows\system32\perfc007.dat
2014-10-22 15:01 - 2012-07-26 09:28 - 01734214 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-22 14:56 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-22 14:46 - 2013-09-21 13:59 - 00088714 _____ () C:\Windows\PFRO.log
2014-10-22 14:44 - 2013-09-21 14:11 - 00001658 _____ () C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-17 08:23 - 2014-07-13 16:11 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-17 08:23 - 2012-07-26 10:12 - 00000000 ___RD () C:\Windows\ToastData
2014-10-17 08:23 - 2012-07-26 10:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 08:23 - 2012-07-26 09:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-10-17 08:23 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-10-17 08:22 - 2013-09-21 15:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 08:19 - 2013-09-21 15:02 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-13 07:08 - 2013-09-21 14:17 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4251072410-3384136539-3598520572-1001
2014-10-12 17:15 - 2013-09-21 14:42 - 00000000 ____D () C:\ProgramData\AMD
2014-10-12 17:15 - 2012-07-26 09:21 - 00041956 _____ () C:\Windows\setupact.log
2014-10-12 17:09 - 2013-10-01 13:15 - 00000000 ____D () C:\Users\ina\AppData\Roaming\DVDVideoSoft
2014-09-29 10:47 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\rescache
2014-09-28 18:12 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Speech
2014-09-28 18:11 - 2014-07-08 08:32 - 00000000 ____D () C:\ProgramData\CliCkForSeale
2014-09-28 18:11 - 2014-05-25 09:34 - 00000000 ____D () C:\ProgramData\FlasshCouPon
2014-09-28 18:11 - 2014-05-20 12:39 - 00000000 ____D () C:\ProgramData\DeialssFiNdERPro
2014-09-28 16:08 - 2013-10-01 13:16 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-09-28 15:58 - 2014-05-20 12:39 - 00000000 ____D () C:\ProgramData\4af564ee61a3c46e
2014-09-28 15:54 - 2014-05-04 13:20 - 00000000 ____D () C:\Users\ina\AppData\Roaming\Dropbox
2014-09-28 14:19 - 2014-05-04 13:22 - 00000000 ___RD () C:\Users\ina\Dropbox
2014-09-28 12:39 - 2014-01-19 10:29 - 00000000 ____D () C:\ProgramData\Adobe
2014-09-28 12:39 - 2014-01-19 10:29 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-28 12:38 - 2012-07-26 10:12 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-09-28 11:39 - 2012-07-26 07:26 - 00000194 _____ () C:\Windows\win.ini
2014-09-28 11:30 - 2012-07-26 10:12 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-09-28 11:30 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy

Some content of TEMP:
====================
C:\Users\ina\AppData\Local\Temp\228663.exe.exe
C:\Users\ina\AppData\Local\Temp\35556262-902E-49AE-8622-66E14F1F041C.exe
C:\Users\ina\AppData\Local\Temp\5-er8mug.dll
C:\Users\ina\AppData\Local\Temp\adks_webssearches.exe
C:\Users\ina\AppData\Local\Temp\BackupSetup.exe
C:\Users\ina\AppData\Local\Temp\catalyst_mobility_64-bit_util.exe
C:\Users\ina\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwgpfwy.dll
C:\Users\ina\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\ina\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\ina\AppData\Local\Temp\HD_Quality_DE_setup.exe
C:\Users\ina\AppData\Local\Temp\ICReinstall_FreeYouTubeToMP3Converter.exe
C:\Users\ina\AppData\Local\Temp\installer.exe
C:\Users\ina\AppData\Local\Temp\jOjN2.dll
C:\Users\ina\AppData\Local\Temp\jOjN2.exe
C:\Users\ina\AppData\Local\Temp\Reporter.exe
C:\Users\ina\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\ina\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\ina\AppData\Local\Temp\setup_337.exe
C:\Users\ina\AppData\Local\Temp\setup_403.exe
C:\Users\ina\AppData\Local\Temp\SHelp2.exe
C:\Users\ina\AppData\Local\Temp\SHSetup.exe
C:\Users\ina\AppData\Local\Temp\ssupsetup_binstall3.exe
C:\Users\ina\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\ina\AppData\Local\Temp\System.Data.SQLite26097.dll
C:\Users\ina\AppData\Local\Temp\System.Data.SQLite27678.dll
C:\Users\ina\AppData\Local\Temp\System.Data.SQLite33470.dll
C:\Users\ina\AppData\Local\Temp\System.Data.SQLite67623.dll
C:\Users\ina\AppData\Local\Temp\systweak.exe
C:\Users\ina\AppData\Local\Temp\tmd_34012957.exe
C:\Users\ina\AppData\Local\Temp\tmp33D8.exe
C:\Users\ina\AppData\Local\Temp\tmp8A11.exe
C:\Users\ina\AppData\Local\Temp\uninst1.exe
C:\Users\ina\AppData\Local\Temp\vcredist_x64.exe
C:\Users\ina\AppData\Local\Temp\VOPackage.exe
C:\Users\ina\AppData\Local\Temp\xJdp8.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-22 15:07

==================== End Of Log ============================

--- --- ---

schrauber · 24.10.2014, 17:31

Addition.txt fehlt noch

Inao · 25.10.2014, 08:01

hallo,
.. was ist das? oder bzw wo find ich das?

schrauber · 25.10.2014, 19:06

FRST hat die auch erstellt

Zitat:

C:\Users\ina\Downloads\Addition.txt

Inao · 26.10.2014, 12:20

ich glaub es ist im anhang

schrauber · 26.10.2014, 18:36

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Inao · 27.10.2014, 08:05

Code:

ATTFilter

ï»¿Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2014
Ran by ina at 2014-10-22 17:47:38
Running from C:\Users\ina\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 14.0.0.110 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.8 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.2.8 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{959C941C-EA43-44DE-F18B-0849766AC19A}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
BrowserSafeguard with RocketTab (HKLM-x32\...\RocketTab) (Version:  - BrowserSafeguard with RocketTab) <==== ATTENTION
Compatibility Pack fÃ¼r 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
CouponARific (HKLM\...\CouponARific) (Version:  - CouponARific) <==== ATTENTION
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version:  - Samsung Electronics Co., Ltd.)
SaveItCoupons (HKLM-x32\...\{37476589-E48E-439E-A706-56189E2ED4C4}_is1) (Version:  - SaveItCoupons) <==== ATTENTION
Shopping Helper Smartbar (HKLM-x32\...\{C64BEB42-B25D-4674-BB55-4099CB720110}) (Version: 11.113.63.19229 - ReSoft Ltd.) <==== ATTENTION
webssearches uninstall (HKLM-x32\...\webssearches uninstall) (Version:  - webssearches) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4251072410-3384136539-3598520572-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\ina\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File

==================== Restore Points  =========================

16-10-2014 05:43:17 Windows Modules Installer

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {579002A1-8F1B-405C-BCC0-25A1AA7CFE0D} - System32\Tasks\MI => C:\Users\ina\AppData\Roaming\MI.exe <==== ATTENTION
Task: {6EB5BC01-E456-4ACE-A265-C043ABEE5E8E} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {949CBEA9-F985-4923-8B46-C2CDC7C8C0AE} - System32\Tasks\GHQVNLG => C:\Users\ina\AppData\Roaming\GHQVNLG.exe <==== ATTENTION
Task: {A6E784D0-F292-4E22-88D5-FD0400230AD0} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\Search Extensions\uninstall.exe [2014-10-22] () <==== ATTENTION
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {ADFD81C4-3E51-45AF-B3D0-EB390AD5BFBF} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-10-17] (Microsoft Corporation)
Task: {BF84C9B8-1E06-41D7-97F1-E3DD07ED45B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
Task: {C5B52FEA-C656-433E-864C-F64963A0D47E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-21] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {EF13CD0D-8855-4EE4-BD03-C44A5E88BB43} - System32\Tasks\RocketTab => C:\Windows\system32\cmd.exe [2012-07-26] (Microsoft Corporation) <==== ATTENTION
Task: {FF41C5F1-2239-4F97-96D4-CBCEC4EA0BBB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-21] (Google Inc.)
Task: C:\Windows\Tasks\GHQVNLG.job => C:\Users\ina\AppData\Roaming\GHQVNLG.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\MI.job => C:\Users\ina\AppData\Roaming\MI.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-01-27 08:32 - 2011-01-27 08:32 - 00027648 _____ () C:\Windows\System32\ssb7mlm.dll
2011-08-31 00:48 - 2011-08-31 00:48 - 01058816 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\ssb7mdu.dll
2014-09-29 22:13 - 2014-09-29 22:13 - 00172544 _____ () C:\Program Files (x86)\35556262-902E-49AE-8622-66E14F1F041C\arrmeapsie64.exe
2014-09-29 22:13 - 2014-09-29 22:13 - 00110080 _____ () C:\Program Files (x86)\35556262-902E-49AE-8622-66E14F1F041C\nfapi.dll
2014-09-29 22:13 - 2014-09-29 22:13 - 00456192 _____ () C:\Program Files (x86)\35556262-902E-49AE-8622-66E14F1F041C\ProtocolFilters.dll
2014-09-28 11:29 - 2014-10-02 18:56 - 04834816 _____ () C:\Windows\score.exe
2014-08-27 16:34 - 2014-08-27 16:34 - 00050208 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00086048 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\srau.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00165920 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 02425376 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00066592 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\spbl.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00158240 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00014368 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\siem.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00067616 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\sppsm.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00696864 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00014880 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00078880 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00027168 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2014-08-27 16:35 - 2014-08-27 16:35 - 00070176 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\srut.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00029216 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\srsbs.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00065568 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00150560 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\smti.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00073760 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\smsp.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00011808 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\sidc.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00030752 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\smtu.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00038432 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\smta.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00031264 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\srom.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00047136 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\srbu.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00024096 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\sgml.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00061984 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00024608 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\srpdm.dll
2014-08-27 16:33 - 2014-08-27 16:33 - 00043552 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\MACTrackBarLib.dll
2014-08-27 16:33 - 2014-08-27 16:33 - 00026656 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00035360 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00193056 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\sgmu.dll
2014-05-12 11:21 - 2014-05-12 11:21 - 00061440 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\AxInterop.WMPLib.dll
2014-08-27 16:34 - 2014-08-27 16:34 - 00255008 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\srns.dll
2014-05-16 14:47 - 2014-05-08 01:29 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll
2014-08-27 16:19 - 2014-10-19 16:20 - 00322048 _____ () C:\Users\ina\AppData\Local\Smartbar\Application\Resources\crdli.dll
2014-05-16 14:47 - 2014-05-08 01:29 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll
2014-05-16 14:47 - 2014-05-08 01:29 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll
2014-05-16 14:47 - 2014-05-08 01:29 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll
2014-10-12 17:22 - 2014-02-10 13:44 - 04592128 _____ () C:\Users\ina\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll
2014-10-12 17:22 - 2014-02-10 13:44 - 00112128 _____ () C:\Users\ina\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll
2014-05-16 14:47 - 2014-05-08 01:29 - 13695816 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-4251072410-3384136539-3598520572-500 - Administrator - Disabled)
Gast (S-1-5-21-4251072410-3384136539-3598520572-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4251072410-3384136539-3598520572-1003 - Limited - Enabled)
ina (S-1-5-21-4251072410-3384136539-3598520572-1001 - Administrator - Enabled) => C:\Users\ina

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/22/2014 05:21:02 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004F074
Befehlszeilenargumente:
RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 05:21:02 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004F074
Befehlszeilenargumente:
RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 02:57:23 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004F074
Befehlszeilenargumente:
RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 02:57:22 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004F074
Befehlszeilenargumente:
RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (10/22/2014 02:47:31 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004F074
Befehlszeilenargumente:
RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 02:47:30 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004F074
Befehlszeilenargumente:
RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (10/22/2014 02:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 34.0.1847.137, Zeitstempel: 0x536ab5d1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.17046, Zeitstempel: 0x53b485c4
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00078c9e
ID des fehlerhaften Prozesses: 0x9d4
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
VollstÃ¤ndiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (10/22/2014 02:44:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 34.0.1847.137, Zeitstempel: 0x536ab5d1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.17046, Zeitstempel: 0x53b485c4
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00078c9e
ID des fehlerhaften Prozesses: 0x434
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
VollstÃ¤ndiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (10/22/2014 02:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 34.0.1847.137, Zeitstempel: 0x536ab5d1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.17046, Zeitstempel: 0x53b485c4
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00078c9e
ID des fehlerhaften Prozesses: 0x9d8
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3
VollstÃ¤ndiger Name des fehlerhaften Pakets: chrome.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: chrome.exe5

Error: (10/22/2014 01:46:04 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004F074
Befehlszeilenargumente:
RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable


System errors:
=============
Error: (10/22/2014 02:56:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ZoneAlarm Privacy Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/22/2014 02:56:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (10/22/2014 02:56:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AMD FUEL Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/22/2014 02:46:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ZoneAlarm Privacy Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/22/2014 02:46:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3

Error: (10/22/2014 02:46:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AMD FUEL Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/22/2014 02:46:39 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am â€Ž22.â€Ž10.â€Ž2014 um 14:28:28 unerwartet heruntergefahren.

Error: (10/19/2014 08:13:56 PM) (Source: DCOM) (EventID: 10010) (User: ina_notebook)
Description: {1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}

Error: (10/19/2014 09:31:11 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ZoneAlarm Privacy Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/19/2014 09:31:10 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AODDriver4.2.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%3


Microsoft Office Sessions:
=========================
Error: (10/22/2014 05:21:02 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004F074RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 05:21:02 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004F074RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 02:57:23 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004F074RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 02:57:22 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004F074RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (10/22/2014 02:47:31 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004F074RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable

Error: (10/22/2014 02:47:30 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004F074RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=UserLogon;SessionId=1

Error: (10/22/2014 02:44:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe34.0.1847.137536ab5d1ntdll.dll6.2.9200.1704653b485c4c000014200078c9e9d401cfedf5eec95cedC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Windows\SYSTEM32\ntdll.dll2c7aaaab-59e9-11e4-be94-e81132cce1e9

Error: (10/22/2014 02:44:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe34.0.1847.137536ab5d1ntdll.dll6.2.9200.1704653b485c4c000014200078c9e43401cfedf5e7f3c1dbC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Windows\SYSTEM32\ntdll.dll25ae3f9e-59e9-11e4-be94-e81132cce1e9

Error: (10/22/2014 02:44:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe34.0.1847.137536ab5d1ntdll.dll6.2.9200.1704653b485c4c000014200078c9e9d801cfedf5e753dbe3C:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Windows\SYSTEM32\ntdll.dll251371dd-59e9-11e4-be94-e81132cce1e9

Error: (10/22/2014 01:46:04 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004F074RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=a98bcd6d-5343-4603-8afe-5908e4611112;NotificationInterval=1440;Trigger=NetworkAvailable


CodeIntegrity Errors:
===================================
  Date: 2014-09-29 19:40:01.563
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-09-28 18:12:17.194
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-09-21 08:36:24.054
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-09-17 07:30:56.461
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-09-12 07:01:08.741
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-09-01 08:44:02.198
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-08-27 13:03:32.100
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-08-20 08:27:58.338
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-08-15 17:50:22.238
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2014-07-14 09:51:58.386
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Processor: AMD A6-3410MX APU with Radeon(tm) HD Graphics
Percentage of memory in use: 41%
Total physical RAM: 5611.8 MB
Available physical RAM: 3308.63 MB
Total Pagefile: 6507.8 MB
Available Pagefile: 4047.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.45 GB) (Free:50.55 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 46F64532)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 27.10.2014, 18:59

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

BrowserSafeguard with RocketTab (HKLM-x32\...\RocketTab) (Version: - BrowserSafeguard with RocketTab) <==== ATTENTION

CouponARific

SaveItCoupons

Shopping Helper Smartbar

webssearches uninstall
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Inao · 29.10.2014, 22:56

Code:

ATTFilter

ComboFix 14-10-29.01 - ina 29.10.2014  18:47:26.2.4 - x64
Microsoft Windows 8 Pro  6.2.9200.0.1252.49.1031.18.5612.4459 [GMT 1:00]
ausgeführt von:: c:\users\ina\Downloads\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
C:\END
c:\users\ina\AppData\Local\nsm6184.tmp
c:\users\ina\AppData\Roaming\InetStat\inetstat.exe
c:\windows\score.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_globalUpdate
-------\Legacy_scores
-------\Service_scores
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-09-28 bis 2014-10-29  ))))))))))))))))))))))))))))))
.
.
2014-10-29 17:50 . 2014-10-29 17:50	--------	d-----w-	c:\users\ina\AppData\Local\temp
2014-10-29 17:16 . 2014-10-29 17:16	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-10-25 07:00 . 2014-10-25 07:00	1533360	----a-w-	c:\users\ina\AppData\Roaming\XEJXLA.exe
2014-10-25 06:59 . 2014-10-25 06:59	2031536	----a-w-	c:\users\ina\AppData\Roaming\MFDIWH.exe
2014-10-24 07:32 . 2014-10-14 19:59	11627712	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{12968FE2-6334-4378-9681-7BCA3FD6EE62}\mpengine.dll
2014-10-22 15:46 . 2014-10-24 07:30	--------	d-----w-	C:\FRST
2014-10-22 12:45 . 2014-07-17 16:49	20328	----a-w-	c:\windows\system32\roboot64.exe
2014-10-22 12:45 . 2014-10-22 12:45	--------	d-----w-	c:\program files (x86)\System Speedup
2014-10-22 12:45 . 2014-10-22 12:56	--------	d-----w-	c:\programdata\IePluginServices
2014-10-22 12:43 . 2014-10-29 17:18	--------	d-----w-	c:\program files\CouponArific
2014-10-22 12:43 . 2014-10-22 12:43	--------	d-----w-	c:\program files (x86)\35556262-902E-49AE-8622-66E14F1F041C
2014-10-18 10:42 . 2014-10-18 10:42	269992	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10248.bin
2014-10-16 11:57 . 2014-09-17 22:56	2885120	----a-w-	c:\windows\system32\msi.dll
2014-10-16 11:57 . 2014-09-17 23:24	2416128	----a-w-	c:\windows\SysWow64\msi.dll
2014-10-16 11:57 . 2014-10-10 04:47	275968	----a-w-	c:\windows\system32\generaltel.dll
2014-10-16 11:57 . 2014-10-10 04:47	693248	----a-w-	c:\windows\system32\aepdu.dll
2014-10-16 11:57 . 2014-10-08 04:26	556544	----a-w-	c:\windows\system32\aeinv.dll
2014-10-16 05:54 . 2014-09-29 22:49	705480	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-10-16 05:54 . 2014-09-29 22:49	104904	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-10-16 05:47 . 2014-07-12 06:46	3262976	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-10-15 19:24 . 2014-09-28 04:18	4068352	----a-w-	c:\windows\system32\win32k.sys
2014-10-15 19:24 . 2014-08-30 04:05	8858112	----a-w-	c:\windows\SysWow64\twinui.dll
2014-10-15 19:24 . 2014-06-12 23:34	754176	----a-w-	c:\windows\SysWow64\actxprxy.dll
2014-10-15 19:24 . 2014-06-12 23:29	2146304	----a-w-	c:\windows\system32\actxprxy.dll
2014-10-15 19:24 . 2014-08-30 05:48	10115072	----a-w-	c:\windows\system32\twinui.dll
2014-10-15 19:24 . 2014-08-30 05:46	2306560	----a-w-	c:\windows\system32\authui.dll
2014-10-15 19:24 . 2014-08-30 04:03	2037760	----a-w-	c:\windows\SysWow64\authui.dll
2014-10-08 05:23 . 2014-10-08 05:23	--------	d-----w-	c:\users\ina\AppData\Local\LPT
2014-10-08 05:23 . 2014-10-08 05:23	--------	d-----w-	c:\users\ina\AppData\Local\Smartbar
2014-09-29 20:13 . 2014-09-29 20:13	46376	----a-w-	c:\windows\system32\drivers\netfilter64.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-17 06:19 . 2013-09-21 13:02	103265616	----a-w-	c:\windows\system32\MRT.exe
2014-09-22 06:42 . 2013-09-21 12:58	278152	------w-	c:\windows\system32\MpSigStub.exe
2014-09-09 20:06 . 2012-07-26 08:13	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-28 11:34 . 2014-09-10 05:18	59400	----a-w-	c:\windows\system32\wuauclt.exe
2014-08-28 06:05 . 2014-09-10 05:18	35328	----a-w-	c:\windows\SysWow64\wuapp.exe
2014-08-28 06:05 . 2014-09-10 05:18	86528	----a-w-	c:\windows\SysWow64\wudriver.dll
2014-08-28 06:05 . 2014-09-10 05:18	630272	----a-w-	c:\windows\SysWow64\wuapi.dll
2014-08-28 06:05 . 2014-09-10 05:18	128000	----a-w-	c:\windows\SysWow64\wuwebv.dll
2014-08-28 06:02 . 2014-09-10 05:18	40448	----a-w-	c:\windows\system32\wuapp.exe
2014-08-28 06:01 . 2014-09-10 05:18	100352	----a-w-	c:\windows\system32\wudriver.dll
2014-08-28 06:01 . 2014-09-10 05:18	253440	----a-w-	c:\windows\system32\WUSettingsProvider.dll
2014-08-28 06:01 . 2014-09-10 05:18	144384	----a-w-	c:\windows\system32\wuwebv.dll
2014-08-28 06:01 . 2014-09-10 05:18	3285504	----a-w-	c:\windows\system32\wuaueng.dll
2014-08-28 06:01 . 2014-09-10 05:18	775168	----a-w-	c:\windows\system32\wuapi.dll
2014-08-28 06:01 . 2014-09-10 05:18	1623552	----a-w-	c:\windows\system32\wucltux.dll
2014-08-28 06:01 . 2014-09-10 05:18	17920	----a-w-	c:\windows\system32\wuaext.dll
2014-08-28 06:01 . 2014-09-10 05:18	176640	----a-w-	c:\windows\system32\storewuauth.dll
2014-08-21 10:41 . 2014-08-11 06:42	4	----a-w-	c:\users\ina\AppData\Roaming\appdataFr2.bin
2014-08-20 23:40 . 2014-09-12 18:37	732880	----a-w-	c:\windows\system32\NotificationUI.exe
2014-08-20 17:05 . 2014-09-12 18:37	694784	----a-w-	c:\windows\system32\WSShared.dll
2014-08-20 17:05 . 2014-09-12 18:37	198656	----a-w-	c:\windows\system32\Windows.ApplicationModel.Store.dll
2014-08-20 17:05 . 2014-09-12 18:37	163840	----a-w-	c:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-08-20 17:02 . 2014-09-12 18:37	567808	----a-w-	c:\windows\SysWow64\WSShared.dll
2014-08-20 17:02 . 2014-09-12 18:37	124928	----a-w-	c:\windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-08-09 08:30 . 2014-09-14 19:17	148480	----a-w-	c:\windows\system32\poqexec.exe
2014-08-09 08:29 . 2014-09-14 19:17	144896	----a-w-	c:\windows\system32\tssdisai.dll
2014-07-31 23:40 . 2014-09-10 05:18	1287680	----a-w-	c:\windows\system32\schedsvc.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-12 43848]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"PromptOnSecureDesktop"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
R2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
R2 ZAPrivacyService;ZoneAlarm Privacy Service;c:\program files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe;c:\program files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW86.sys;c:\windows\SYSNATIVE\drivers\AtihdW86.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 globalUpdatem;globalUpdate Update Service (globalUpdatem);c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe;c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\System32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S1 netfilter64;netfilter64;c:\windows\system32\drivers\netfilter64.sys;c:\windows\SYSNATIVE\drivers\netfilter64.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 CouponArificService64;CouponArificService64;c:\program files (x86)\35556262-902E-49AE-8622-66E14F1F041C\arrmeapsie64.exe;c:\program files (x86)\35556262-902E-49AE-8622-66E14F1F041C\arrmeapsie64.exe [x]
S3 RTL8168;Realtek 8168 NT-Treiber;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-16 12:44	1077576	----a-w-	c:\program files (x86)\Google\Chrome\Application\34.0.1847.137\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-29 c:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job
- c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-10-25 06:59]
.
2014-10-29 c:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job
- c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-10-25 06:59]
.
2014-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-21 12:13]
.
2014-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-21 12:13]
.
2014-10-29 c:\windows\Tasks\MFDIWH.job
- c:\users\ina\AppData\Roaming\MFDIWH.exe [2014-10-25 06:59]
.
2014-10-29 c:\windows\Tasks\XEJXLA.job
- c:\users\ina\AppData\Roaming\XEJXLA.exe [2014-10-25 07:00]
.
.
--------- X64 Entries -----------
.
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://tikotin.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <-loopback>
uSearchAssistant = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_CN_Cx0CEU-cMTeldOutkMRsTk_xkWWRNTkI90qgdlAcdu6pLCIwR9S_rd6tKxhYWVhz2p-xxBk5-sDXeC8eeQR0j5wXDDWGYyQHRUUHiAToFBOVlZ_QJBqXMJq99DiJzJqtANtjZIqKNEKWn-Qcqw,,&q={searchTerms}
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -
Trusted Zone: samsungsetup.com\www
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - (no file)
BHO-{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)
Wow6432Node-HKCU-Run-Browser Infrastructure Helper - c:\users\ina\AppData\Local\Smartbar\Application\Smartbar.exe
BHO-{11111111-1111-1111-1111-110611311167} - c:\program files (x86)\CinemaXPro 1.4V25.10\CinemaXPro 1.4V25.10-bho64.dll
BHO-{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-10-29  18:53:42 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-10-29 17:53
.
Vor Suchlauf: 8 Verzeichnis(se), 68.373.340.160 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 67.980.115.968 Bytes frei
.
- - End Of File - - F86B6B0BFA7F6861D93BEA423CE6E0F8
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 30.10.2014, 20:14

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Inao · 31.10.2014, 13:22

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Protection, 31.10.2014 12:55:03, SYSTEM, INA_NOTEBOOK, Protection, Malware Protection, Starting, 
Protection, 31.10.2014 12:55:03, SYSTEM, INA_NOTEBOOK, Protection, Malware Protection, Started, 
Protection, 31.10.2014 12:55:03, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Starting, 
Protection, 31.10.2014 12:55:03, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Started, 
Update, 31.10.2014 12:55:03, SYSTEM, INA_NOTEBOOK, Manual, Rootkit Database, 2014.9.18.1, 2014.10.22.1, 
Update, 31.10.2014 12:55:07, SYSTEM, INA_NOTEBOOK, Manual, Malware Database, 2014.9.19.5, 2014.10.31.4, 
Protection, 31.10.2014 12:55:07, SYSTEM, INA_NOTEBOOK, Protection, Refresh, Starting, 
Protection, 31.10.2014 12:55:07, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Stopping, 
Protection, 31.10.2014 12:55:08, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Stopped, 
Protection, 31.10.2014 12:55:15, SYSTEM, INA_NOTEBOOK, Protection, Refresh, Success, 
Protection, 31.10.2014 12:55:15, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Starting, 
Protection, 31.10.2014 12:55:15, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Started, 
Detection, 31.10.2014 13:01:52, SYSTEM, INA_NOTEBOOK, Protection, Malware Protection, File, PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, Quarantine, [0f3142d90a72e84eb69878997291649c]
Detection, 31.10.2014 13:02:40, SYSTEM, INA_NOTEBOOK, Protection, Malware Protection, File, PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantine Failed, 5, Zugriff verweigert  , [66daa378cbb1db5bff4f63aebd46c53b]
Scan, 31.10.2014 13:02:52, SYSTEM, INA_NOTEBOOK, Manual, Start: % 1 "% 2", Dauer: % 1 min 6 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, 1178-Malwareerkennung, 
Protection, 31.10.2014 13:03:46, SYSTEM, INA_NOTEBOOK, Protection, Malware Protection, Starting, 
Protection, 31.10.2014 13:03:46, SYSTEM, INA_NOTEBOOK, Protection, Malware Protection, Started, 
Protection, 31.10.2014 13:03:47, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Starting, 
Protection, 31.10.2014 13:03:47, SYSTEM, INA_NOTEBOOK, Protection, Malicious Website Protection, Started, 

(end)

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 8 Pro x64
Ran by ina on 31.10.2014 at 13:11:57,81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPCDE.TMP-A396F11E.pf
Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPCROE.TMP-5C7C562C.pf



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31.10.2014 at 13:16:18,17
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

ATTFilter

# AdwCleaner v4.002 - Bericht erstellt am 31/10/2014 um 13:08:33
# DB v2014-10-26.6
# Aktualisiert 27/10/2014 von Xplode
# Betriebssystem : Windows 8 Pro  (64 bits)
# Benutzername : ina - INA_NOTEBOOK
# Gestartet von : C:\Users\ina\Downloads\AdwCleaner_4.002.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : netfilter64

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\ina\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Program Files (x86)\globalUpdate
Ordner Gelöscht : C:\Users\ina\AppData\Local\globalUpdate
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat
Ordner Gelöscht : C:\Users\ina\AppData\Roaming\InetStat
Ordner Gelöscht : C:\Users\ina\Documents\Optimizer Pro
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PepperZip
Ordner Gelöscht : C:\Program Files (x86)\predm
Ordner Gelöscht : C:\Users\ina\AppData\Roaming\RHEng
Ordner Gelöscht : C:\ProgramData\CliCkForSeale
Ordner Gelöscht : C:\Program Files (x86)\CliCkForSeale
Ordner Gelöscht : C:\ProgramData\DeialssFiNdERPro
Ordner Gelöscht : C:\Program Files (x86)\DeialssFiNdERPro
Ordner Gelöscht : C:\ProgramData\FlasshCouPon
Ordner Gelöscht : C:\Program Files (x86)\FlasshCouPon
Ordner Gelöscht : C:\ProgramData\SualesChEcker
Ordner Gelöscht : C:\Program Files (x86)\SualesChEcker
Datei Gelöscht : C:\Windows\System32\drivers\netfilter64.sys
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Tasks ] *****

Task Gelöscht : LaunchSignup

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
Verknüpfung Desinfiziert : C:\Users\ina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\ina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\ina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\ejocekekgcaldnmjngfdbmbeebcekelc
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ejocekekgcaldnmjngfdbmbeebcekelc
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\ejocekekgcaldnmjngfdbmbeebcekelc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SalesChecakerr.SalesChecakerr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SalesChecakerr.SalesChecakerr.2.2
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ColickFoRSaale.ColickFoRSaale
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ColickFoRSaale.ColickFoRSaale.1.9
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DDeALSFindeirPro.DDeALSFindeirPro
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DDeALSFindeirPro.DDeALSFindeirPro.4.33
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\FlAsHCoupon.FlAsHCoupon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\FlAsHCoupon.FlAsHCoupon.1.6
Schlüssel Gelöscht : HKLM\SOFTWARE\5b6dadfb26aed15
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4277F7CF-0000-46CF-BA49-D624465C4BAB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F1963E76-845B-474C-8C7F-D69A96D8AA34}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{414C8505-4A43-0EB9-8CBF-E97FC025CDD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA85D8BB-D3B9-9978-1DD4-441FC602EDED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F39ED429-FF17-9BE5-A975-48211188F3BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FE263A3D-E9C0-FE4E-CC4B-B0A9B1DEC067}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA85D8BB-D3B9-9978-1DD4-441FC602EDED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F39ED429-FF17-9BE5-A975-48211188F3BD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE263A3D-E9C0-FE4E-CC4B-B0A9B1DEC067}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA85D8BB-D3B9-9978-1DD4-441FC602EDED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F39ED429-FF17-9BE5-A975-48211188F3BD}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FE263A3D-E9C0-FE4E-CC4B-B0A9B1DEC067}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{414C8505-4A43-0EB9-8CBF-E97FC025CDD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CA85D8BB-D3B9-9978-1DD4-441FC602EDED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F39ED429-FF17-9BE5-A975-48211188F3BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FE263A3D-E9C0-FE4E-CC4B-B0A9B1DEC067}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{414C8505-4A43-0EB9-8CBF-E97FC025CDD7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CA85D8BB-D3B9-9978-1DD4-441FC602EDED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{F39ED429-FF17-9BE5-A975-48211188F3BD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{FE263A3D-E9C0-FE4E-CC4B-B0A9B1DEC067}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKCU\Software\genesis
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\weDownload
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
Schlüssel Gelöscht : HKLM\SOFTWARE\XTRM Group Ltd.
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{779D1843-0043-65D2-D781-8614F17B6222}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8B114619-78B7-1CFF-55EF-74266954F883}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.17116


-\\ Google Chrome v34.0.1847.137


*************************

AdwCleaner[R0].txt - [15663 octets] - [31/10/2014 13:07:07]
AdwCleaner[S0].txt - [15968 octets] - [31/10/2014 13:08:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [16029 octets] ##########

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014 01
Ran by ina (administrator) on INA_NOTEBOOK on 31-10-2014 13:18:15
Running from C:\Users\ina\Downloads
Loaded Profile: ina (Available profiles: ina)
Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\swriter.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\ina\Downloads\FRST64 (3).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2F8DFDFCC3B6CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: CinemaXPro 1.4V25.10 -> {11111111-1111-1111-1111-110611311167} -> C:\Program Files (x86)\CinemaXPro 1.4V25.10\CinemaXPro 1.4V25.10-bho64.dll No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-21]
CHR StartMenuInternet: Google Chrome - Chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [X]
S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [129536 2013-07-05] (Advanced Micro Devices) [File not signed]
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-31] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-31 13:17 - 2014-10-31 13:18 - 02113536 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (3).exe
2014-10-31 13:16 - 2014-10-31 13:16 - 00001025 _____ () C:\Users\ina\Desktop\JRT.txt
2014-10-31 13:11 - 2014-10-31 13:11 - 01706144 _____ (Thisisu) C:\Users\ina\Downloads\JRT.exe
2014-10-31 13:11 - 2014-10-31 13:11 - 00000000 ____D () C:\Windows\ERUNT
2014-10-31 13:07 - 2014-10-31 13:09 - 00000000 ____D () C:\AdwCleaner
2014-10-31 13:06 - 2014-10-31 13:06 - 01998336 _____ () C:\Users\ina\Downloads\AdwCleaner_4.002.exe
2014-10-31 13:05 - 2014-10-31 13:05 - 00002396 _____ () C:\Users\ina\Desktop\mbam.txt
2014-10-31 12:55 - 2014-10-31 13:09 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-31 12:54 - 2014-10-31 12:54 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-31 12:54 - 2014-10-31 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-31 12:54 - 2014-10-31 12:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-31 12:54 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-31 12:54 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-31 12:54 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-31 12:53 - 2014-10-31 12:53 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\ina\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-31 12:50 - 2014-10-31 12:50 - 00011805 _____ () C:\ComboFix.txt
2014-10-30 07:23 - 2014-10-31 12:22 - 00000000 ____D () C:\Windows\system32\AutoUpdateLicense
2014-10-29 22:56 - 2014-10-22 04:34 - 00010777 _____ () C:\Windows\system32\AutoconfigV2.cab
2014-10-29 22:56 - 2014-10-22 04:33 - 00581016 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2014-10-29 22:56 - 2014-10-22 04:33 - 00462760 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-10-29 22:56 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-29 22:56 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 22:56 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-29 22:56 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-10-29 22:56 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 22:56 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-10-29 18:36 - 2014-10-31 12:51 - 00000000 ____D () C:\Qoobox
2014-10-29 18:36 - 2014-10-29 18:52 - 00000000 ____D () C:\Windows\erdnt
2014-10-29 18:36 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-29 18:36 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-29 18:36 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-29 18:34 - 2014-10-31 12:27 - 05591672 ____R (Swearware) C:\Users\ina\Downloads\ComboFix.exe
2014-10-29 18:16 - 2014-10-29 18:16 - 00001268 _____ () C:\Users\ina\Desktop\Revo Uninstaller.lnk
2014-10-29 18:16 - 2014-10-29 18:16 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-29 18:15 - 2014-10-29 18:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\ina\Downloads\revosetup95.exe
2014-10-25 07:58 - 2014-10-31 13:08 - 00001152 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-24 08:29 - 2014-10-24 08:30 - 02112000 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (2).exe
2014-10-22 17:22 - 2014-10-22 17:22 - 02110976 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (1).exe
2014-10-22 17:22 - 2014-10-22 17:22 - 01102336 _____ (Farbar) C:\Users\ina\Downloads\FRST (1).exe
2014-10-22 16:50 - 2014-10-22 16:50 - 00380416 _____ () C:\Users\ina\Downloads\Gmer-19357.exe
2014-10-22 16:47 - 2014-10-22 16:47 - 00029521 _____ () C:\Users\ina\Downloads\Addition.txt
2014-10-22 16:46 - 2014-10-31 13:18 - 00008251 _____ () C:\Users\ina\Downloads\FRST.txt
2014-10-22 16:46 - 2014-10-31 13:18 - 00000000 ____D () C:\FRST
2014-10-22 16:46 - 2014-10-22 16:46 - 02110976 _____ (Farbar) C:\Users\ina\Downloads\FRST64.exe
2014-10-22 16:45 - 2014-10-22 16:45 - 01102336 _____ (Farbar) C:\Users\ina\Downloads\FRST.exe
2014-10-22 16:44 - 2014-10-22 16:44 - 00000468 _____ () C:\Users\ina\Downloads\defogger_disable.log
2014-10-22 16:44 - 2014-10-22 16:44 - 00000000 _____ () C:\Users\ina\defogger_reenable
2014-10-22 16:43 - 2014-10-22 16:43 - 00050477 _____ () C:\Users\ina\Downloads\Defogger.exe
2014-10-22 16:25 - 2014-10-22 16:25 - 00616896 _____ () C:\Users\ina\Downloads\avira_de_av___ws-Downloader.exe
2014-10-22 13:55 - 2014-10-22 13:57 - 00018040 _____ () C:\Users\ina\Downloads\software_removal_tool.log
2014-10-22 13:55 - 2014-10-22 13:55 - 04703560 _____ (Google) C:\Users\ina\Downloads\software_removal_tool.exe
2014-10-22 12:51 - 2014-10-22 12:51 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014 (2).zip
2014-10-22 12:51 - 2014-10-22 12:51 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014 (1).zip
2014-10-17 07:23 - 2014-10-17 07:23 - 00307896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 12:57 - 2014-10-10 05:47 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 12:57 - 2014-10-10 05:47 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 12:57 - 2014-10-08 05:26 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 12:57 - 2014-09-18 00:24 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 12:57 - 2014-09-17 23:56 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 06:57 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 06:57 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 06:57 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 06:57 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-10-16 06:57 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 06:57 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 06:57 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 06:57 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 06:57 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 06:57 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 06:57 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 06:57 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 06:57 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 06:57 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-10-16 06:54 - 2014-09-29 23:49 - 00705480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 06:54 - 2014-09-29 23:49 - 00104904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-16 06:52 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 06:52 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-16 06:52 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 06:52 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 06:52 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 06:52 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 06:52 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 06:52 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 06:52 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 06:52 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 06:52 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 06:52 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 06:52 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 06:47 - 2014-07-12 05:41 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-16 06:47 - 2014-07-12 05:15 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-16 06:47 - 2014-07-12 01:02 - 00478352 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-16 06:47 - 2014-07-12 01:00 - 00478352 _____ () C:\Windows\system32\locale.nls
2014-10-16 06:47 - 2014-07-08 23:33 - 00181248 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
2014-10-16 06:47 - 2014-07-08 23:32 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2014-10-16 06:47 - 2014-07-08 23:32 - 00340480 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
2014-10-16 06:47 - 2014-07-08 23:30 - 01220608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2014-10-16 06:47 - 2014-07-07 06:52 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2014-10-16 06:47 - 2014-07-07 06:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-10-16 06:47 - 2014-07-04 11:52 - 00328000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-10-16 06:47 - 2014-07-03 02:59 - 01824784 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-16 06:47 - 2014-07-03 01:30 - 01408952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-16 06:47 - 2014-06-28 08:01 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2014-10-16 06:47 - 2014-06-28 07:57 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-10-16 06:47 - 2014-06-28 07:56 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2014-10-16 06:47 - 2014-06-25 08:09 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-10-16 06:47 - 2014-06-25 08:07 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-10-16 06:47 - 2014-06-18 00:27 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-10-16 06:47 - 2014-06-18 00:23 - 02238464 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-10-16 06:47 - 2014-06-11 15:47 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-10-16 06:47 - 2014-06-11 05:40 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-10-16 06:47 - 2014-06-10 23:44 - 01403896 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-10-16 06:47 - 2014-05-30 00:31 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-10-16 06:47 - 2014-05-30 00:03 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-10-16 06:47 - 2014-02-04 11:57 - 01271664 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-15 20:24 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 20:24 - 2014-08-30 06:48 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-10-15 20:24 - 2014-08-30 06:46 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-15 20:24 - 2014-08-30 05:05 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-10-15 20:24 - 2014-08-30 05:03 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-15 20:24 - 2014-06-13 00:34 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-10-15 20:24 - 2014-06-13 00:29 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-10-15 20:22 - 2014-08-01 23:08 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-10-15 20:22 - 2014-07-24 14:50 - 00447296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-10-15 20:22 - 2014-07-17 00:28 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-10-15 20:22 - 2014-07-16 23:59 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-10-15 20:22 - 2014-07-16 23:59 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-10-15 20:22 - 2014-07-12 07:45 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-10-15 20:22 - 2014-07-12 05:36 - 00674304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-10-15 20:22 - 2014-07-12 05:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-10-15 20:22 - 2014-07-12 05:34 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-10-15 20:22 - 2014-07-12 05:34 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-10-15 20:22 - 2014-06-28 07:57 - 01341952 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-10-15 20:22 - 2014-06-28 03:23 - 01126400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-10-12 17:55 - 2014-10-12 17:55 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014.zip
2014-10-12 16:15 - 2014-10-12 16:15 - 00060148 _____ () C:\Windows\SysWOW64\CCCInstall_201410121715369076.log
2014-10-12 16:09 - 2014-10-12 16:09 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-10-08 06:24 - 2014-10-31 13:10 - 00001358 _____ () C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-31 13:18 - 2013-09-21 13:17 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4251072410-3384136539-3598520572-1001
2014-10-31 13:16 - 2012-07-26 11:27 - 00746048 _____ () C:\Windows\system32\perfh007.dat
2014-10-31 13:16 - 2012-07-26 11:27 - 00151906 _____ () C:\Windows\system32\perfc007.dat
2014-10-31 13:16 - 2012-07-26 08:28 - 01734214 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-31 13:10 - 2013-09-21 13:11 - 02070245 _____ () C:\Windows\WindowsUpdate.log
2014-10-31 13:09 - 2013-09-21 13:13 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-31 13:09 - 2013-09-21 12:59 - 00444932 _____ () C:\Windows\PFRO.log
2014-10-31 13:09 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-31 13:08 - 2013-09-21 13:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-10-31 13:08 - 2013-09-21 13:11 - 00000991 _____ () C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-31 13:03 - 2013-09-21 13:58 - 00000000 ____D () C:\Windows\Panther
2014-10-31 13:03 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-10-31 12:44 - 2013-09-21 13:13 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-31 12:39 - 2012-07-26 06:26 - 00000215 _____ () C:\Windows\system.ini
2014-10-31 12:21 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-10-30 07:24 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-10-30 07:23 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore
2014-10-29 18:53 - 2012-07-26 06:37 - 00000000 __RHD () C:\Users\Default
2014-10-29 18:50 - 2012-07-26 06:26 - 69206016 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 12582912 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-10-29 18:29 - 2014-06-25 08:35 - 00000000 ____D () C:\Users\ina\AppData\Local\Adobe
2014-10-27 07:36 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache
2014-10-26 12:19 - 2014-01-17 14:43 - 00861696 ___SH () C:\Users\ina\Downloads\Thumbs.db
2014-10-25 07:58 - 2014-09-28 10:32 - 00000000 ___HD () C:\Users\Public\Temp
2014-10-22 16:44 - 2013-09-21 13:11 - 00000000 ____D () C:\Users\ina
2014-10-22 14:01 - 2013-10-08 18:42 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-10-17 07:23 - 2014-07-13 15:11 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-17 07:23 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ToastData
2014-10-17 07:23 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 07:22 - 2013-09-21 14:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 07:19 - 2013-09-21 14:02 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-12 16:15 - 2013-09-21 13:42 - 00000000 ____D () C:\ProgramData\AMD
2014-10-12 16:15 - 2012-07-26 08:21 - 00041956 _____ () C:\Windows\setupact.log
2014-10-12 16:09 - 2013-10-01 12:15 - 00000000 ____D () C:\Users\ina\AppData\Roaming\DVDVideoSoft

Some content of TEMP:
====================
C:\Users\ina\AppData\Local\temp\Quarantine.exe
C:\Users\ina\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-22 14:07

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 01.11.2014, 11:29

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Inao · 02.11.2014, 12:52

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6737dc125027ca479d97e12a23fe5a6c
# engine=20891
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-11-02 11:37:33
# local_time=2014-11-02 12:37:33 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 91007 19319142 0 0
# scanned=153010
# found=24
# cleaned=0
# scan_time=2244
sh=8B67C4946B050285FE89EFE36AB6DC2F7B3E2D2F ft=1 fh=d91722da20002316 vn="Variante von Win64/Riskware.NetFilter.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\netfilter64.sys.vir"
sh=4A081BA60A6E697C18AF4EDD978A6FF0AAB1ED9B ft=1 fh=b0decd1966604748 vn="Variante von Win32/Agent.WGA Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Windows\score.exe.vir"
sh=9521C9F35D6A53E82B4DA589FB9B088BF8232B65 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1JNV7VEN\91[1].js"
sh=A836A8346F791EC8A83B51BC78E84B2F6659E6DA ft=1 fh=0a2e45c370149901 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1JNV7VEN\wajam_validate[1].exe"
sh=F2B5EA93330A06242705514EC724F7AB14B76D39 ft=1 fh=2b2bce695aca85d3 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCQ0Q2WF\35556262-902E-49AE-8622-66E14F1F041C[1].exe"
sh=259DCCE37348257452226F2AE24DE93D621D6408 ft=1 fh=08b4c259ba05d113 vn="Win32/Systweak.K evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCQ0Q2WF\ssupsetup_sbinstall3_sbinstall3[1].exe"
sh=676E035A75BC042EEA403A6536DEAC5ADFBD62CC ft=1 fh=89866503941329da vn="Win32/AdWare.1ClickDownload.AW Anwendung" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UB7ZS3DW\ReimageRepair_setup_CR[1].exe"
sh=2C1F82E05E4DBA6ECEB9E4242CD50FD6CF12266C ft=1 fh=fe873f7819cf7ef7 vn="Variante von MSIL/Adware.iBryte.G Anwendung" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UB7ZS3DW\rt-installer[1].exe"
sh=BA053B18FFC154F07EFA659216A893A3FE504F3F ft=1 fh=351a811c1b7a96f2 vn="Win32/Reporter.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UB7ZS3DW\ssupsetup_binstall3[1].exe"
sh=9FF19861E72D4C41A05683D0721840CC7EC37392 ft=1 fh=0e561590459aa758 vn="Variante von Win32/LiMo.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UN0XV7AH\adks_webssearches_20141010[1].exe"
sh=DDD7E789E67132CF6C5D8169B2F46E3498FCA60F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\AppData\Roaming\GHQVNLG"
sh=9413821E4285C46DAF48156B472065FC2D763FE8 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\AppData\Roaming\MI"
sh=2D5FE7A1096A782CF0497A1537CA49EE2D804455 ft=1 fh=4e896d988c6f2172 vn="Variante von Win32/DownloadGuide.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\ina\Downloads\avira_de_av___ws-Downloader.exe"
sh=1CB924B91A413F1029D2DE58E87D358431DF6B44 ft=1 fh=05c7e0a454aed5c3 vn="Variante von Win32/Toolbar.CrossRider.BM evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Public\Temp\2EA455B90F7B46509877A232C1E39567\setup.exe"
sh=FB6671A49A884070C6EF715D2F1FAD2BDBBBC136 ft=1 fh=2af0db3e042baa77 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll"
sh=6DCC13A366785A704F46E8E25942B34855909256 ft=1 fh=d5332291222fca7d vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\Smartbar.Resources.LanguageSettings.resources.dll"
sh=0350DF22B6626CFD0AD4EB6007A2461F11CEEE10 ft=1 fh=209276bd891a8712 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\spbe.dll"
sh=45A9E5328644E080C54C5F698851F45538944E18 ft=1 fh=e8d62f7bd8f8b91a vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\spbl.dll"
sh=B65091119509CD666CCCA7B15B877C4B022A7833 ft=1 fh=4367817249f0c42e vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\sppsm.dll"
sh=74170C095222A2C20A4890317F06F305E8F3AD4D ft=1 fh=c7c1dc6906c45ff4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\spusm.dll"
sh=A9CBD104B9E7095FA2149353191B54C6BE529B89 ft=1 fh=175322f6e29cd6c3 vn="Variante von MSIL/Toolbar.Linkury.C evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\srbs.dll"
sh=04DB138EADC252C1A2A992522B885B1EC49FC51B ft=1 fh=2b5a7693da531107 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\srbu.dll"
sh=FA84A01F54889BF65D7FF7FEE70C0ABB2022EB34 ft=1 fh=55bc1129650c5700 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\srptc.dll"
sh=0245CD046791D326380C1B884024FD7C2F3FF831 ft=1 fh=ec54f2db7e2fe2a1 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\MSID11A.tmp-\srpu.dll"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.89  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java version out of Date! 
 Adobe Reader XI  
 Google Chrome 34.0.1847.131  
 Google Chrome 34.0.1847.137  
 Google Chrome chMntz.log..  
 Google Chrome update.dll..  
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 Windows Defender MsMpEng.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-11-2014
Ran by ina (administrator) on INA_NOTEBOOK on 02-11-2014 12:51:34
Running from C:\Users\ina\Downloads
Loaded Profiles: ina &  (Available profiles: ina)
Platform: Windows 8 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\ina\Downloads\FRST64 (4).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2F8DFDFCC3B6CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: CinemaXPro 1.4V25.10 -> {11111111-1111-1111-1111-110611311167} -> C:\Program Files (x86)\CinemaXPro 1.4V25.10\CinemaXPro 1.4V25.10-bho64.dll No File
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\ina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-21]
CHR StartMenuInternet: Google Chrome - Chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [X]
S2 ZAPrivacyService; "C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [129536 2013-07-05] (Advanced Micro Devices) [File not signed]
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-02] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 12:51 - 2014-11-02 12:51 - 02114048 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (4).exe
2014-11-02 12:48 - 2014-11-02 12:48 - 00854448 _____ () C:\Users\ina\Downloads\SecurityCheck.exe
2014-11-02 11:58 - 2014-11-02 11:58 - 02347384 _____ (ESET) C:\Users\ina\Downloads\esetsmartinstaller_deu.exe
2014-10-31 13:17 - 2014-10-31 13:18 - 02113536 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (3).exe
2014-10-31 13:11 - 2014-10-31 13:11 - 01706144 _____ (Thisisu) C:\Users\ina\Downloads\JRT.exe
2014-10-31 13:11 - 2014-10-31 13:11 - 00000000 ____D () C:\Windows\ERUNT
2014-10-31 13:07 - 2014-10-31 13:23 - 00000000 ____D () C:\AdwCleaner
2014-10-31 13:06 - 2014-10-31 13:06 - 01998336 _____ () C:\Users\ina\Downloads\AdwCleaner_4.002.exe
2014-10-31 12:55 - 2014-11-02 11:53 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-31 12:54 - 2014-10-31 12:54 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-31 12:54 - 2014-10-31 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-31 12:54 - 2014-10-31 12:54 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-31 12:54 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-31 12:54 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-31 12:54 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-31 12:53 - 2014-10-31 12:53 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\ina\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-31 12:50 - 2014-10-31 12:50 - 00011805 _____ () C:\ComboFix.txt
2014-10-30 07:23 - 2014-10-31 12:22 - 00000000 ____D () C:\Windows\system32\AutoUpdateLicense
2014-10-29 22:56 - 2014-10-22 04:34 - 00010777 _____ () C:\Windows\system32\AutoconfigV2.cab
2014-10-29 22:56 - 2014-10-22 04:33 - 00581016 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe
2014-10-29 22:56 - 2014-10-22 04:33 - 00462760 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe
2014-10-29 22:56 - 2014-10-22 02:08 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-29 22:56 - 2014-10-22 02:08 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 22:56 - 2014-10-22 02:01 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-29 22:56 - 2014-10-22 02:01 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2014-10-29 22:56 - 2014-10-22 02:01 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-29 22:56 - 2014-10-22 02:00 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2014-10-29 18:36 - 2014-10-31 12:51 - 00000000 ____D () C:\Qoobox
2014-10-29 18:36 - 2014-10-29 18:52 - 00000000 ____D () C:\Windows\erdnt
2014-10-29 18:36 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-29 18:36 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-29 18:36 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-29 18:36 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-29 18:34 - 2014-10-31 12:27 - 05591672 ____R (Swearware) C:\Users\ina\Downloads\ComboFix.exe
2014-10-29 18:16 - 2014-10-29 18:16 - 00001268 _____ () C:\Users\ina\Desktop\Revo Uninstaller.lnk
2014-10-29 18:16 - 2014-10-29 18:16 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-29 18:15 - 2014-10-29 18:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\ina\Downloads\revosetup95.exe
2014-10-25 07:58 - 2014-10-31 13:08 - 00001152 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-24 08:29 - 2014-10-24 08:30 - 02112000 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (2).exe
2014-10-22 17:22 - 2014-10-22 17:22 - 02110976 _____ (Farbar) C:\Users\ina\Downloads\FRST64 (1).exe
2014-10-22 17:22 - 2014-10-22 17:22 - 01102336 _____ (Farbar) C:\Users\ina\Downloads\FRST (1).exe
2014-10-22 16:50 - 2014-10-22 16:50 - 00380416 _____ () C:\Users\ina\Downloads\Gmer-19357.exe
2014-10-22 16:47 - 2014-10-22 16:47 - 00029521 _____ () C:\Users\ina\Downloads\Addition.txt
2014-10-22 16:46 - 2014-11-02 12:51 - 00008175 _____ () C:\Users\ina\Downloads\FRST.txt
2014-10-22 16:46 - 2014-11-02 12:51 - 00000000 ____D () C:\FRST
2014-10-22 16:46 - 2014-10-22 16:46 - 02110976 _____ (Farbar) C:\Users\ina\Downloads\FRST64.exe
2014-10-22 16:45 - 2014-10-22 16:45 - 01102336 _____ (Farbar) C:\Users\ina\Downloads\FRST.exe
2014-10-22 16:44 - 2014-10-22 16:44 - 00000468 _____ () C:\Users\ina\Downloads\defogger_disable.log
2014-10-22 16:44 - 2014-10-22 16:44 - 00000000 _____ () C:\Users\ina\defogger_reenable
2014-10-22 16:43 - 2014-10-22 16:43 - 00050477 _____ () C:\Users\ina\Downloads\Defogger.exe
2014-10-22 16:25 - 2014-10-22 16:25 - 00616896 _____ () C:\Users\ina\Downloads\avira_de_av___ws-Downloader.exe
2014-10-22 13:55 - 2014-10-22 13:57 - 00018040 _____ () C:\Users\ina\Downloads\software_removal_tool.log
2014-10-22 13:55 - 2014-10-22 13:55 - 04703560 _____ (Google) C:\Users\ina\Downloads\software_removal_tool.exe
2014-10-22 12:51 - 2014-10-22 12:51 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014 (2).zip
2014-10-22 12:51 - 2014-10-22 12:51 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014 (1).zip
2014-10-17 07:23 - 2014-10-17 07:23 - 00307896 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 12:57 - 2014-10-10 05:47 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 12:57 - 2014-10-10 05:47 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 12:57 - 2014-10-08 05:26 - 00556544 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 12:57 - 2014-09-18 00:24 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 12:57 - 2014-09-17 23:56 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 06:57 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 06:57 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 06:57 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 06:57 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-10-16 06:57 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 06:57 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 06:57 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 06:57 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 06:57 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 06:57 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 06:57 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 06:57 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 06:57 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 06:57 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 06:57 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 06:57 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-10-16 06:54 - 2014-09-29 23:49 - 00705480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-16 06:54 - 2014-09-29 23:49 - 00104904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-16 06:52 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 06:52 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-16 06:52 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 06:52 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 06:52 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 06:52 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 06:52 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 06:52 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 06:52 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 06:52 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 06:52 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 06:52 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 06:52 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 06:47 - 2014-07-12 05:41 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\KBDRUM.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 06:47 - 2014-07-12 05:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRUM.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-16 06:47 - 2014-07-12 05:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-16 06:47 - 2014-07-12 05:15 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-16 06:47 - 2014-07-12 01:02 - 00478352 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-16 06:47 - 2014-07-12 01:00 - 00478352 _____ () C:\Windows\system32\locale.nls
2014-10-16 06:47 - 2014-07-08 23:33 - 00181248 _____ (Microsoft Corp.) C:\Windows\system32\Defrag.exe
2014-10-16 06:47 - 2014-07-08 23:32 - 01539584 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2014-10-16 06:47 - 2014-07-08 23:32 - 00340480 _____ (Microsoft Corporation) C:\Windows\system32\defragsvc.dll
2014-10-16 06:47 - 2014-07-08 23:30 - 01220608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2014-10-16 06:47 - 2014-07-07 06:52 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2014-10-16 06:47 - 2014-07-07 06:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2014-10-16 06:47 - 2014-07-04 11:52 - 00328000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-10-16 06:47 - 2014-07-03 02:59 - 01824784 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-16 06:47 - 2014-07-03 01:30 - 01408952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-16 06:47 - 2014-06-28 08:01 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2014-10-16 06:47 - 2014-06-28 07:57 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-10-16 06:47 - 2014-06-28 07:56 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2014-10-16 06:47 - 2014-06-25 08:09 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-10-16 06:47 - 2014-06-25 08:07 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-10-16 06:47 - 2014-06-18 00:27 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-10-16 06:47 - 2014-06-18 00:23 - 02238464 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-10-16 06:47 - 2014-06-11 15:47 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-10-16 06:47 - 2014-06-11 05:40 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-10-16 06:47 - 2014-06-10 23:44 - 01403896 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-10-16 06:47 - 2014-05-30 00:31 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-10-16 06:47 - 2014-05-30 00:03 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-10-16 06:47 - 2014-02-04 11:57 - 01271664 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-15 20:24 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 20:24 - 2014-08-30 06:48 - 10115072 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-10-15 20:24 - 2014-08-30 06:46 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-15 20:24 - 2014-08-30 05:05 - 08858112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-10-15 20:24 - 2014-08-30 05:03 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-15 20:24 - 2014-06-13 00:34 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-10-15 20:24 - 2014-06-13 00:29 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-10-15 20:22 - 2014-08-01 23:08 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-10-15 20:22 - 2014-07-24 14:50 - 00447296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-10-15 20:22 - 2014-07-17 00:28 - 00027648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-10-15 20:22 - 2014-07-16 23:59 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-10-15 20:22 - 2014-07-16 23:59 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-10-15 20:22 - 2014-07-12 07:45 - 01549824 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-10-15 20:22 - 2014-07-12 05:36 - 00674304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-10-15 20:22 - 2014-07-12 05:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2014-10-15 20:22 - 2014-07-12 05:34 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-10-15 20:22 - 2014-07-12 05:34 - 00250368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-10-15 20:22 - 2014-06-28 07:57 - 01341952 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-10-15 20:22 - 2014-06-28 03:23 - 01126400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-10-12 17:55 - 2014-10-12 17:55 - 01327064 _____ () C:\Users\ina\Downloads\Studienarbeiten für den 20.10.2014.zip
2014-10-12 16:15 - 2014-10-12 16:15 - 00060148 _____ () C:\Windows\SysWOW64\CCCInstall_201410121715369076.log
2014-10-12 16:09 - 2014-10-12 16:09 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-10-08 06:24 - 2014-10-31 13:10 - 00001358 _____ () C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 12:48 - 2014-01-17 14:43 - 00861696 ___SH () C:\Users\ina\Downloads\Thumbs.db
2014-11-02 12:44 - 2013-09-21 13:13 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-02 12:16 - 2013-09-21 13:11 - 01115969 _____ () C:\Windows\WindowsUpdate.log
2014-11-02 12:04 - 2013-09-21 13:17 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4251072410-3384136539-3598520572-1001
2014-11-02 11:53 - 2013-09-21 13:13 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-02 11:52 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-10-31 13:16 - 2012-07-26 11:27 - 00746048 _____ () C:\Windows\system32\perfh007.dat
2014-10-31 13:16 - 2012-07-26 11:27 - 00151906 _____ () C:\Windows\system32\perfc007.dat
2014-10-31 13:16 - 2012-07-26 08:28 - 01734214 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-31 13:09 - 2013-09-21 12:59 - 00444932 _____ () C:\Windows\PFRO.log
2014-10-31 13:09 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-31 13:08 - 2013-09-21 13:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-10-31 13:08 - 2013-09-21 13:11 - 00000991 _____ () C:\Users\ina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-31 13:03 - 2013-09-21 13:58 - 00000000 ____D () C:\Windows\Panther
2014-10-31 13:03 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-10-31 12:39 - 2012-07-26 06:26 - 00000215 _____ () C:\Windows\system.ini
2014-10-30 12:25 - 2013-09-21 13:58 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-30 07:24 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-10-30 07:23 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore
2014-10-29 18:53 - 2012-07-26 06:37 - 00000000 __RHD () C:\Users\Default
2014-10-29 18:50 - 2012-07-26 06:26 - 69206016 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 12582912 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-10-29 18:50 - 2012-07-26 06:26 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-10-29 18:29 - 2014-06-25 08:35 - 00000000 ____D () C:\Users\ina\AppData\Local\Adobe
2014-10-27 07:36 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache
2014-10-25 07:58 - 2014-09-28 10:32 - 00000000 ___HD () C:\Users\Public\Temp
2014-10-22 16:44 - 2013-09-21 13:11 - 00000000 ____D () C:\Users\ina
2014-10-22 14:01 - 2013-10-08 18:42 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-10-17 07:23 - 2014-07-13 15:11 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-17 07:23 - 2012-07-26 09:12 - 00000000 ___RD () C:\Windows\ToastData
2014-10-17 07:23 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 07:22 - 2013-09-21 14:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 07:19 - 2013-09-21 14:02 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-12 16:15 - 2013-09-21 13:42 - 00000000 ____D () C:\ProgramData\AMD
2014-10-12 16:15 - 2012-07-26 08:21 - 00041956 _____ () C:\Windows\setupact.log
2014-10-12 16:09 - 2013-10-01 12:15 - 00000000 ____D () C:\Users\ina\AppData\Roaming\DVDVideoSoft

Some content of TEMP:
====================
C:\Users\ina\AppData\Local\temp\Quarantine.exe
C:\Users\ina\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-22 14:07

==================== End Of Log ============================

--- --- ---

--- --- ---

24.10.2014, 17:31	#4
schrauber /// the machine /// TB-Ausbilder	kann webssearches nicht deinstallieren und popups stoppen internetseiten bis ich auf download klick Addition.txt fehlt noch __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

kann webssearches nicht deinstallieren und popups stoppen internetseiten bis ich auf download klick

Log-Analyse und Auswertung: kann webssearches nicht deinstallieren und popups stoppen internetseiten bis ich auf download klick