Zu viele Werbungen im Browser

SP4RK1NG · 29.10.2014, 16:54

Ich hab schon oft Google gefragt aber trotzdem keine Lösung für mein Problem gefunden.
Ständig habe ich Werbungen im Browser von den Seiten Zalando, Otto.de usw. die Wörter sind unterstrichen oder es Öffnen sich manchmal neue Fenster mit Werbung. Das geht tierisch auf die nerven und verlangsamt das Surfen im Internet.
Ich habe oft über adwcleaner gelesen, hab den auch ausprobiert, aber leider hilft er nicht. Die Werbungen sind nach wie vor da.

Was kann ich noch machen?
Und welches antivir Programm würdet ihr mir empfehlen? Es muss bitte kostenlos sein.
Ich hab Avira aber es scheint nicht so gut zu sein.

Freue mich über eure Antworten.

cosinus · 29.10.2014, 17:01

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

M-K-D-B · 29.10.2014, 17:01

edit

SP4RK1NG · 29.10.2014, 17:20

Ich habe noch 395 Funde.

FRST.txt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-10-2014 01
Ran by acer (administrator) on ACER-PC on 29-10-2014 16:07:54
Running from C:\Users\acer\Desktop
Loaded Profile: acer (Available profiles: acer)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-19] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-02] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [38872 2012-07-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Google Update] => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)
HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Akamai NetSession Interface] => C:\Users\acer\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\MountPoints2: {8512f947-4be6-11e1-8e2a-806e6f6e6963} - D:\.\AutorunX\AutorunX.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [5085416 2014-10-29] (Avira)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6137481703E0CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - C5B99FE4EBF6436E96255EC4E534CB93 URL = hxxp://yandex.ru/yandsearch?win=47&clid=135294&text={searchTerms}
SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c
SearchScopes: HKCU - {5308F6B2-D7C7-435F-ACE1-67C822EDD299} URL = hxxp://search.softonic.com/MON00016/tb_v1?q={searchTerms}&SearchSource=4&cc=
SearchScopes: HKCU - {F8BEEF2E-FAD3-41CA-B81F-232B4C13BF87} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=48201c1f-2234-406e-9170-e11d675ac164&apn_sauid=AB8CEBA9-3173-427A-ABA0-8BF924B7B29E
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: No Name -> {e5d4f4fd-a039-4670-8354-633c30a5f54e} ->  No File
Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default
FF NewTab: hxxp://www.sweet-page.com/newtab/?type=nt&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB
FF DefaultSearchEngine: sweet-page
FF SearchEngineOrder.1: Ask.com
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: sweet-page
FF Homepage: hxxp://www.sweet-page.com/?type=hp&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 -> C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 -> C:\Users\acer\AppData\LocalLow\Sony Online Entertainment\npsoe.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin HKCU: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002435.xml
FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002613.xml
FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\ybqs-yandex.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Яндекс.Бар - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\yasearch@yandex.ru [2013-06-11]
FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: Adblock Plus - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-01]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-02-20]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]

Chrome: 
=======
CHR HomePage: Default -> 
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Movies Toolbar) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaifmhgonleehnkppkhhchcbhhigac [2013-12-01]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-02]
CHR Extension: (YouTube) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-01]
CHR Extension: (Adblock Plus) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-11]
CHR Extension: (Google-Suche) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-01]
CHR Extension: (hxxp://www.facebook.com/?ref=logo) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpipgdjaiclliilaeaehcgkihcbcmooo [2012-05-21]
CHR Extension: (Stylish) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-02-01]
CHR Extension: (hxxp://www.yandex.ru/) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfjacpammignfpjljfmgpdebpnjfpcjl [2012-05-21]
CHR Extension: (WebSite Recommendation) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\jopdpbolklklaiookikgmdinfbooiipj [2013-12-07]
CHR Extension: (F2B Dark Electrique - Neon Blue on Black) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\modaobgliiinjfofblifbikbemfealmf [2012-05-21]
CHR Extension: (Google Wallet) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-02-01]
CHR Extension: (Google Mail) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-01]
CHR HKCU\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx [2012-08-13]
CHR HKLM-x32\...\Chrome\Extension: [aaaaifmhgonleehnkppkhhchcbhhigac] - C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC\toolbar.crx [2013-08-29]
CHR HKLM-x32\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx [2012-08-13]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 Update Deal Keeper; "C:\Program Files (x86)\Deal Keeper\updateDealKeeper.exe" [X]
S2 Util Deal Keeper; "C:\Program Files (x86)\Deal Keeper\bin\utilDealKeeper.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-16] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-16] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-29 16:07 - 2014-10-29 16:08 - 00019995 _____ () C:\Users\acer\Desktop\FRST.txt
2014-10-29 16:07 - 2014-10-29 16:07 - 00000000 ____D () C:\FRST
2014-10-29 16:05 - 2014-10-29 16:05 - 02113536 _____ (Farbar) C:\Users\acer\Desktop\FRST64.exe
2014-10-29 14:26 - 2014-10-29 14:26 - 00003320 _____ () C:\Windows\System32\Tasks\AviraSpeedup
2014-10-29 14:26 - 2014-10-29 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-10-29 14:12 - 2014-10-29 14:12 - 01998336 _____ () C:\Users\acer\Desktop\AdwCleaner_4.002.exe
2014-10-24 19:33 - 2014-10-25 13:45 - 00000000 ____D () C:\Users\acer\Desktop\Музыка 2
2014-10-24 16:25 - 2014-10-24 16:25 - 00000000 ____D () C:\Users\acer\Desktop\Ёлка
2014-10-23 17:32 - 2014-10-23 17:32 - 00000000 ____D () C:\Users\acer\Desktop\DeSmuMe1
2014-10-17 15:41 - 2014-10-17 15:41 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-12 14:02 - 2014-10-12 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-29 16:06 - 2012-02-01 18:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job
2014-10-29 15:54 - 2014-02-12 22:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-29 15:42 - 2014-02-08 20:23 - 00000288 _____ () C:\Windows\Tasks\Funmoods Chat.job
2014-10-29 15:42 - 2012-01-31 09:39 - 01262459 _____ () C:\Windows\WindowsUpdate.log
2014-10-29 15:42 - 2009-07-14 05:51 - 00683673 _____ () C:\Windows\setupact.log
2014-10-29 14:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-10-29 14:51 - 2012-02-19 03:32 - 00000000 ____D () C:\Users\acer\AppData\Local\Akamai
2014-10-29 14:50 - 2014-01-12 01:27 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-10-29 14:49 - 2009-07-14 19:18 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-10-29 14:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-10-29 14:31 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-29 14:31 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-29 14:27 - 2009-07-14 18:58 - 00696370 _____ () C:\Windows\system32\perfh007.dat
2014-10-29 14:27 - 2009-07-14 18:58 - 00147634 _____ () C:\Windows\system32\perfc007.dat
2014-10-29 14:27 - 2009-07-14 06:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-29 14:26 - 2013-07-30 12:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-29 14:20 - 2012-01-31 12:18 - 00342912 _____ () C:\Windows\PFRO.log
2014-10-29 14:20 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-29 14:19 - 2014-09-13 11:50 - 00000000 ____D () C:\AdwCleaner
2014-10-29 14:19 - 2012-01-31 11:36 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-29 14:19 - 2012-01-31 09:47 - 00001168 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-29 14:19 - 2012-01-31 09:47 - 00000981 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2014-10-29 14:12 - 2012-07-09 21:08 - 00000000 ____D () C:\Users\acer\Desktop\PC
2014-10-29 13:55 - 2012-01-31 09:47 - 00000000 ____D () C:\Users\acer
2014-10-26 16:43 - 2013-02-24 23:22 - 03159040 ___SH () C:\Users\acer\Desktop\Thumbs.db
2014-10-23 16:10 - 2012-04-25 12:48 - 00000000 ____D () C:\Users\acer\Desktop\Mein Ordner
2014-10-23 16:06 - 2012-02-01 18:40 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job
2014-10-22 16:01 - 2012-02-01 18:40 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA
2014-10-22 16:01 - 2012-02-01 18:40 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core
2014-10-17 15:41 - 2014-08-05 09:04 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-17 15:41 - 2013-07-30 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-16 14:03 - 2013-07-30 12:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-16 14:03 - 2013-07-30 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-16 14:03 - 2013-07-30 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-12 17:49 - 2012-02-01 19:13 - 00000000 ____D () C:\Users\acer\AppData\Roaming\Skype
2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ____D () C:\ProgramData\Skype
2014-10-04 16:07 - 2014-05-11 18:38 - 00000499 _____ () C:\Users\acer\Desktop\7.txt

Some content of TEMP:
====================
C:\Users\acer\AppData\Local\Temp\AskSLib.dll
C:\Users\acer\AppData\Local\Temp\avgnt.exe
C:\Users\acer\AppData\Local\Temp\bdfilters.dll
C:\Users\acer\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\acer\AppData\Local\Temp\Delta.exe
C:\Users\acer\AppData\Local\Temp\DeltaTB.exe
C:\Users\acer\AppData\Local\Temp\DivXSetup.exe
C:\Users\acer\AppData\Local\Temp\drm_dyndata_7380006.dll
C:\Users\acer\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\acer\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\acer\AppData\Local\Temp\gface_swap.exe
C:\Users\acer\AppData\Local\Temp\hcuninstaller_20131028_134921_3792.exe
C:\Users\acer\AppData\Local\Temp\i4jdel0.exe
C:\Users\acer\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll
C:\Users\acer\AppData\Local\Temp\IminentSetup.exe
C:\Users\acer\AppData\Local\Temp\MybabylonTB.exe
C:\Users\acer\AppData\Local\Temp\nsaBB1C.exe
C:\Users\acer\AppData\Local\Temp\nskC1C1.exe
C:\Users\acer\AppData\Local\Temp\nsp1A96.exe
C:\Users\acer\AppData\Local\Temp\nsp1E3F.exe
C:\Users\acer\AppData\Local\Temp\nsq6C41.exe
C:\Users\acer\AppData\Local\Temp\nsv16BF.exe
C:\Users\acer\AppData\Local\Temp\propsys.dll
C:\Users\acer\AppData\Local\Temp\qdf_n_pe.dll
C:\Users\acer\AppData\Local\Temp\Quarantine.exe
C:\Users\acer\AppData\Local\Temp\SkypeSetup.exe
C:\Users\acer\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\acer\AppData\Local\Temp\sqlite3.dll
C:\Users\acer\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\acer\AppData\Local\Temp\TuneUpUtilities2013_de-DE.exe
C:\Users\acer\AppData\Local\Temp\Uninstaller-4088.exe
C:\Users\acer\AppData\Local\Temp\WSSetup.exe
C:\Users\acer\AppData\Local\Temp\YgoUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-27 19:18

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition.txt

Code:

ATTFilter

 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-10-2014 01
Ran by acer at 2014-10-29 16:09:12
Running from C:\Users\acer\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader 9.5.2 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.2 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Ashampoo Burning Studio FREE v.1.14.5 (HKLM-x32\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)
ATI AVIVO64 Codecs (Version: 10.7.0.40702 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{BADFD936-E907-C666-A6E1-3C04C06E4260}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C1200}) (Version: 12.18.0.3051 - APN, LLC)
Avira System Speedup (HKLM-x32\...\AviraSpeedup) (Version: 1.3.1.9930 - Avira System Speedup)
Bamboo (HKLM\...\Pen Tablet Driver) (Version: 5.2.5-5 - Wacom Technology Corp.)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - )
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Broadcom Gigabit NetLink Controller (HKLM\...\{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}) (Version: 12.26.02 - Broadcom Corporation)
ccc-core-static (x32 Version: 2009.0702.1239.20840 - Ihr Firmenname) Hidden
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.24 - DivX, LLC)
Google Chrome (HKCU\...\Google Chrome) (Version: 38.0.2125.104 - Google Inc.)
Happy Cloud Client (HKCU\...\HappyCloud) (Version: 3.59 - Happy Cloud, Inc.)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movies Toolbar for Chrome (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaCR) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION
Movies Toolbar for Internet Explorer (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION
Mozilla Firefox 12.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 12.0 (x86 de)) (Version: 12.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
PowerTeacher Version 23.04.026.P34 (HKLM-x32\...\PowerTeacher_is1) (Version: 23.04.026.P34 - admigro media GmbH)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5911 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)
Senus 2012 (HKLM-x32\...\Senus 2012) (Version: 2012 - Senus)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.2.0 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
Update for Funmoods Chat (HKCU\...\Funmoods Chat) (Version:  - Update for Funmoods Chat) <==== ATTENTION
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Vegas Pro 11.0 (HKLM-x32\...\{6BE7495E-8DF1-11E1-BB7D-F04DA23A5C58}) (Version: 11.0.682 - Sony)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
WebTablet FB Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.0.0.1 - Wacom Technology Corp.)
WebTablet IE Plugin (HKLM-x32\...\Wacom WebTabletPlugin for IE) (Version: 1.1.0.12 - Wacom Technology Corp.)
WebTablet Netscape Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Netscape) (Version: 1.1.0.10 - Wacom Technology Corp.)
WinRAR 4.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\acer\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================

16-10-2014 18:42:59 Geplanter Prüfpunkt
23-10-2014 18:54:49 Geplanter Prüfpunkt
29-10-2014 13:25:01 Avira System Speedup(1.3.1.9930)
29-10-2014 13:44:07 Wiederherstellungsvorgang

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - System32\Tasks\Funmoods Chat => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {0E581D78-090E-4B3F-AD54-0D14A0FE299D} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {0E7D64A6-726E-4520-97EE-93D347538AE7} - System32\Tasks\{B838A91B-D1E3-401C-9EA5-16C1B1C9DD79} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)
Task: {36598214-6DC8-4F89-A570-7DC3D33FD8BF} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {39BC67C8-1301-43CD-AC38-AE940BA98B60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {4C446A1C-E962-4CA1-8D3E-88EB4082CEB4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {54C625ED-6DB0-4300-ACF8-4C6FAD13148B} - System32\Tasks\{6C9FA6D1-EA02-43B7-852D-72304E2BC18A} => C:\Program Files (x86)\JoWooD\NfH_Compilation\NfH1\bin\game.exe
Task: {6C29B57E-6178-47CC-A301-5FBF818442E7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {74D4980C-87D8-47F2-8ED9-7B030B88CC9F} - System32\Tasks\{2EE2B7AA-5C0C-44A2-9C18-7743C493ABC2} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)
Task: {751AB0DB-7059-4856-82B6-104D01065C1A} - System32\Tasks\AviraSpeedup => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [2014-10-29] (Avira)
Task: {DE0E5CE5-8C3C-4C97-9202-C28256F3A581} - System32\Tasks\VKSaverUpdate => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-02-01 22:26 - 2012-01-09 19:44 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll
2012-09-22 20:00 - 2011-09-08 16:48 - 01183096 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2013-02-13 03:37 - 2013-02-13 03:37 - 01263952 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2009-05-13 10:44 - 2009-05-13 10:44 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-01-31 10:19 - 2012-01-31 10:19 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-10-20 19:37 - 2014-10-10 03:03 - 01042760 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\libglesv2.dll
2014-10-20 19:37 - 2014-10-10 03:03 - 00211272 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\libegl.dll
2014-10-20 19:37 - 2014-10-10 03:04 - 08910664 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\pdf.dll
2014-10-20 19:37 - 2014-10-10 03:03 - 01681224 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\ffmpegsumo.dll
2014-10-20 19:37 - 2014-10-10 03:04 - 14902600 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup
MSCONFIG\startupreg: ApnTBMon => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: VKSaver => C:\ProgramData\VKSaver\VKSaver.exe

========================= Accounts: ==========================

acer (S-1-5-21-3090159671-3938598571-1968455546-1000 - Administrator - Enabled) => C:\Users\acer
Administrator (S-1-5-21-3090159671-3938598571-1968455546-500 - Administrator - Disabled)
Gast (S-1-5-21-3090159671-3938598571-1968455546-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3090159671-3938598571-1968455546-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (10/29/2014 03:09:12 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (10/29/2014 02:05:06 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (10/28/2014 03:07:15 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (10/27/2014 07:19:39 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (10/27/2014 01:32:07 PM) (Source: TabletServicePen) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (10/26/2014 07:00:03 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (10/26/2014 04:44:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm iexplore.exe, Version 8.0.7601.17514 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1490

Startzeit: 01cff133aa404715

Endzeit: 31

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Berichts-ID: fb4ef70a-5d26-11e4-8240-00262d55e02a

Error: (10/26/2014 04:03:23 PM) (Source: TabletServicePen) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (10/25/2014 02:01:01 PM) (Source: TabletServicePen) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (10/23/2014 07:49:31 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (10/29/2014 02:20:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/29/2014 02:20:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/29/2014 02:20:35 PM) (Source: amdsata) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\RaidPort0 gefunden.

Error: (10/29/2014 01:55:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/29/2014 01:55:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/29/2014 01:54:57 PM) (Source: amdsata) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\RaidPort0 gefunden.

Error: (10/29/2014 02:35:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/29/2014 02:35:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/29/2014 02:35:44 PM) (Source: amdsata) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\RaidPort0 gefunden.

Error: (10/29/2014 02:27:21 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}


Microsoft Office Sessions:
=========================
Error: (10/29/2014 03:09:12 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (10/29/2014 02:05:06 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (10/28/2014 03:07:15 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (10/27/2014 07:19:39 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (10/27/2014 01:32:07 PM) (Source: TabletServicePen) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (10/26/2014 07:00:03 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (10/26/2014 04:44:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: iexplore.exe8.0.7601.17514149001cff133aa40471531C:\Program Files (x86)\Internet Explorer\iexplore.exefb4ef70a-5d26-11e4-8240-00262d55e02a

Error: (10/26/2014 04:03:23 PM) (Source: TabletServicePen) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (10/25/2014 02:01:01 PM) (Source: TabletServicePen) (EventID: 1) (User: )
Description: Prefs: Failed to get user path

Error: (10/23/2014 07:49:31 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II Dual-Core M300
Percentage of memory in use: 44%
Total physical RAM: 4094.36 MB
Available physical RAM: 2277.28 MB
Total Pagefile: 8186.91 MB
Available Pagefile: 5781.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:199.64 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: CA20FFB1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 29.10.2014, 23:30

Logs vom Virenscanner und Malwarebytes?

SP4RK1NG · 30.10.2014, 00:49

In Avira steht bei Aktion überall "Malware gefunden"

cosinus · 30.10.2014, 09:09

Kannst du jetzt bitte de Logs dazu posten...
Und die von Malwarebytes auch nicht vergessen wenn es Funde gab

SP4RK1NG · 30.10.2014, 23:30

Ich habe alles gemacht wie hier: http://www.trojaner-board.de/125889-...tml#post941520

Ich kann aber die Datei hier nicht posten. Die Datei ist ungültig heißt es.

cosinus · 31.10.2014, 09:12

Zitat:

Ich habe alles gemacht wie hier: Wichtig: Bitte alle Logs mit Funden posten

Das ist mir nicht entgangen.

Ich möchte aber noch zusätzlich Virenscanner-Logs mit den Funden sehen. Wie du an die Logs kommst wurde erklärt. Bei Malwarebytes und Verlauf => Anwendungsprotokolle => Suchlauf-Protokolle, falls dieses Programm denn schon ausgeführt wurde.

SP4RK1NG · 31.10.2014, 12:43

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 31.10.2014
Scan Time: 12:10:45
Logfile: qwfasf.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.09.19.05
Rootkit Database: v2014.10.22.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: acer

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 341617
Time Elapsed: 27 min, 34 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 19
Adware.GamePlayLab, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 
Adware.GamePlayLab, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 
Adware.GamePlayLab, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 
Adware.GamePlayLab, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 
Adware.GamePlayLab, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 
PUP.Optional.Wajam.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, , [afd29f50fd7e36007c5b701f53af32ce], 
PUP.Optional.Wajam.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, , [afd29f50fd7e36007c5b701f53af32ce], 
PUP.Optional.Yontoo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, , [2e5318d797e411259b8e0d7dad558b75], 
PUP.Optional.Yontoo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, , [2e5318d797e411259b8e0d7dad558b75], 
PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Deal Keeper, , [166b32bd4f2cc5719dc07d93ee15a957], 
PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util Deal Keeper, , [9fe25c934c2f74c2d18d9d736f946c94], 
PUP.Optional.IWantThis.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\I Want This, , [740d06e9bbc0d75f939d65c3fb08758b], 
PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\koyotesoftmoviestoolbarha, , [0f721dd2cbb0cd69e480c1789b68748c], 
PUP.Optional.FastStart.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, , [8af7717ef388c571655550b58e7555ab], 
PUP.Optional.DealPly.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdejapggenmdmafpmbipje, , [cbb6ec033f3c75c1a95e2df1fe05f50b], 
PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{e5d4f4fd-a039-4670-8354-633c30a5f54e}, , [8bf64ea17efdc076c5cd90794eb7b050], 
PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 
PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 
PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 

Registry Values: 2
PUP.Optional.FastStart.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, , [8af7717ef388c571655550b58e7555ab]
PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{E5D4F4FD-A039-4670-8354-633C30A5F54E}, Movies Toolbar (Dist. by Koyote-Lab, Inc.), , [8bf64ea17efdc076c5cd90794eb7b050]

Registry Data: 0
(No malicious items detected)

Folders: 6
PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918, , [94ed25ca067566d0a4aaa92d21e17c84], 
PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha, , [730e5e91ea915dd992effbe015edb34d], 
PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc, , [0b76ae41abd0ce68db3827b611f1cd33], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha, , [176a42ad007b03331c614a9c42c040c0], 
PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC, , [176a42ad007b03331c614a9c42c040c0], 

Files: 54
PUP.Optional.Koyote.A, C:\Program Files (x86)\Free Easy CD DVD Burner\Uninstall.exe, , [b8c95b946a1173c3851867e9be43a957], 
PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsaBB1C.exe, , [3a477a75eb905adcab480d2c61a06f91], 
PUP.Optional.Iminent.A, C:\Users\acer\AppData\Local\Temp\IminentSetup.exe, , [2d541ad5403ba393fb3af34b28d918e8], 
PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nskC1C1.exe, , [275ac42bfe7d9b9bec0773c6e918fe02], 
PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsp1A96.exe, , [b9c83eb1eb90b383b83b66d37c859d63], 
PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsp1E3F.exe, , [71108b6448337abc579c56e326db53ad], 
PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsq6C41.exe, , [b8c98c63d4a7d66040b3be7bb9485ba5], 
PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsv16BF.exe, , [176a727d95e637ff757e50e916eb24dc], 
Adware.Korad, C:\Users\acer\AppData\Local\Temp\nspBA9A.tmp\basicstarter.exe, , [621fc52a522948eefe7748f8b34e629e], 
PUP.Optional.OpenCandy, C:\Users\acer\AppData\Local\Temp\is-SLOM1.tmp\OCSetupHlp.dll, , [7f026c83fd7e38fe79aaef3cd43109f7], 
PUP.Optional.Dealply, C:\Users\acer\AppData\Local\Temp\is1590112554\dealply.exe, , [1170cf204239112566915bcf4eb735cb], 
PUP.Optional.IWantThis.A, C:\Users\acer\AppData\Local\Temp\is1590112554\IWantThis_ROW.exe, , [9ee36d82d8a3dd59d60ec3d2ea17926e], 
PUP.Optional.Babylon.A, C:\Users\acer\AppData\Local\Temp\is1590112554\MyBabylonTB.exe, , [1f62a7485e1d3204797e5ec0b44c13ed], 
PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Temp\is1590112554\Wajam.exe, , [364b935c245793a339f0440341bfb947], 
PUP.Optional.MoviesToolbar.A, C:\Windows\Temp\e942428e\SetupDataMngr_Koyote.exe, , [621fc9265922da5c4bf48e9aa55ce917], 
PUP.Optional.SweetPacks.A, C:\Users\acer\AppData\Local\Temp\BundleSweetIMSetup.exe, , [e49d836ca9d2df577a7ce82821e241bf], 
PUP.Optional.Delta.A, C:\Users\acer\AppData\Local\Temp\DeltaTB.exe, , [a2dfe00f562561d5b641f11f2ad904fc], 
PUP.Optional.Babylon.A, C:\Users\acer\AppData\Local\Temp\MybabylonTB.exe, , [4f3208e790eb62d44eaaf51bf50e738d], 
PUP.Optional.FunMoods.A, C:\Windows\System32\Tasks\Funmoods Chat, , [a2df618e4d2edf57b57ca3713ac9e51b], 
PUP.Optional.FunMoods.A, C:\Windows\Tasks\Funmoods Chat.job, , [5031df108eed3afcbc76e52fb74c17e9], 
PUP.Optional.Superfish.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [b2cf08e793e83ef87238ee320af9d22e], 
PUP.Optional.Superfish.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, , [1170a14e5625bc7a3971e7397a8901ff], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0.localstorage-journal, , [f68baf40f883ab8b63c7df495ba8f808], 
PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jpmbfleldcgkldadpdinhjjopdfpjfjp_0.localstorage, , [e79ad11e39422a0ca74481a98281a759], 
PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jpmbfleldcgkldadpdinhjjopdfpjfjp_0.localstorage-journal, , [96ebe30c552662d4d81337f31ce749b7], 
PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Local\funmoods_2.3.1.crx, , [bcc5c72886f57fb7d567dd8e9b69639d], 
PUP.Optional.Funmoods.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage-journal, , [38496c836f0c1422a239b2b908fc8878], 
PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\CT3202918.txt, , [94ed25ca067566d0a4aaa92d21e17c84], 
PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\initData.json, , [94ed25ca067566d0a4aaa92d21e17c84], 
PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\manifest.json, , [94ed25ca067566d0a4aaa92d21e17c84], 
PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\apnuserid.dat, , [730e5e91ea915dd992effbe015edb34d], 
PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\appid.dat, , [730e5e91ea915dd992effbe015edb34d], 
PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\geodata.xml, , [730e5e91ea915dd992effbe015edb34d], 
PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\setupCfg.xml, , [730e5e91ea915dd992effbe015edb34d], 
PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\sysid.dat, , [730e5e91ea915dd992effbe015edb34d], 
PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\trackid.dat, , [730e5e91ea915dd992effbe015edb34d], 
PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\config.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 
PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\info.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 
PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\src.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 
PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\STTL.DAT, , [0b76ae41abd0ce68db3827b611f1cd33], 
PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\TTL.DAT, , [0b76ae41abd0ce68db3827b611f1cd33], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001887.ldb, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001898.ldb, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001903.ldb, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001918.ldb, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001919.log, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\CURRENT, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOCK, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOG, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOG.old, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\MANIFEST-001917, , [532edf10c3b831056f79776756acb848], 
PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC\toolbar.crx, , [176a42ad007b03331c614a9c42c040c0], 
PUP.Optional.SweetPage.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "hxxp://www.sweet-page.com/newtab/?type=nt&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB");), ,[0a7719d61b6085b134c048f160a56997]
PUP.Optional.SweetPage.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "hxxp://www.sweet-page.com/?type=hp&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB");), ,[88f988673a4174c2fafb58e1ab5a6f91]

Physical Sectors: 0
(No malicious items detected)


(end)

Soll ich das bereinigen?

cosinus · 31.10.2014, 14:08

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen aus den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

SP4RK1NG · 02.11.2014, 00:35

Code:

ATTFilter

# AdwCleaner v4.002 - Bericht erstellt am 02/11/2014 um 00:15:29
# DB v2014-10-26.6
# Aktualisiert 27/10/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : acer - ACER-PC
# Gestartet von : C:\Users\acer\Desktop\AdwCleaner_4.002.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Mozilla Firefox v12.0 (de)


-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [68098 octets] - [13/09/2014 11:50:16]
AdwCleaner[R1].txt - [2389 octets] - [15/09/2014 17:08:23]
AdwCleaner[R2].txt - [19360 octets] - [27/10/2014 13:26:42]
AdwCleaner[R3].txt - [1422 octets] - [01/11/2014 14:31:45]
AdwCleaner[R4].txt - [1482 octets] - [01/11/2014 14:38:03]
AdwCleaner[R5].txt - [1602 octets] - [02/11/2014 00:13:20]
AdwCleaner[S0].txt - [63415 octets] - [13/09/2014 11:53:17]
AdwCleaner[S1].txt - [2450 octets] - [15/09/2014 17:43:12]
AdwCleaner[S2].txt - [17292 octets] - [27/10/2014 13:29:07]
AdwCleaner[S3].txt - [1535 octets] - [01/11/2014 14:40:17]
AdwCleaner[S4].txt - [1515 octets] - [02/11/2014 00:15:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1575 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.5 (10.31.2014:1)
OS: Windows 7 Home Premium x64
Ran by acer on 02.11.2014 at  0:20:26,35
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\acer\AppData\Roaming\mozilla\firefox\profiles\mo5qape1.default\prefs.js

user_pref("extensions.AVIRA-V7.com.avira.dnt.rules", "\"{\\\"Version\\\":43,\\\"Companies\\\":[{\\\"company\\\":\\\"Google Inc\\\",\\\"rules\\\":[{\\\"name\\\":\\\"Google Anal
user_pref("extensions.AVIRA-V7.domain", "\"avira.search.ask.com\"");
user_pref("extensions.AVIRA-V7.hpr_cr", "\"hxxp://avira.search.ask.com/?tpid=AVIRA-V7&o=APN11074&pf=&trgb=ALL&p2=%5EB0Q%5EYYYYYY%5EYY%5EDE&gct=hp&apn_ptnrs=%5EB0Q&apn_dtid=%5E



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.11.2014 at  0:27:53,59
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-11-2014
Ran by acer (administrator) on ACER-PC on 02-11-2014 00:29:34
Running from C:\Users\acer\Desktop
Loaded Profile: acer (Available profiles: acer)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchService.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Avira) C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-19] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-02] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [38872 2012-07-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124720 2014-10-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Google Update] => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)
HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Akamai NetSession Interface] => C:\Users\acer\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [AviraSpeedup] => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-10-29] (Avira)
HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\MountPoints2: {8512f947-4be6-11e1-8e2a-806e6f6e6963} - D:\.\AutorunX\AutorunX.exe
HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-10-29] (Avira)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6137481703E0CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - C5B99FE4EBF6436E96255EC4E534CB93 URL = hxxp://yandex.ru/yandsearch?win=47&clid=135294&text={searchTerms}
SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default
FF SearchEngineOrder.3: Bing 
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 -> C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 -> C:\Users\acer\AppData\LocalLow\Sony Online Entertainment\npsoe.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin HKCU: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002435.xml
FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002613.xml
FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\ybqs-yandex.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Яндекс.Бар - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\yasearch@yandex.ru [2013-06-11]
FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]
FF Extension: Adblock Plus - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-01]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-02-20]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]

Chrome: 
=======
CHR HomePage: Default -> 
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-02]
CHR Extension: (YouTube) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-01]
CHR Extension: (Adblock Plus) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-11]
CHR Extension: (Google-Suche) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-01]
CHR Extension: (hxxp://www.facebook.com/?ref=logo) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpipgdjaiclliilaeaehcgkihcbcmooo [2012-05-21]
CHR Extension: (Stylish) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-02-01]
CHR Extension: (hxxp://www.yandex.ru/) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfjacpammignfpjljfmgpdebpnjfpcjl [2012-05-21]
CHR Extension: (WebSite Recommendation) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\jopdpbolklklaiookikgmdinfbooiipj [2013-12-07]
CHR Extension: (F2B Dark Electrique - Neon Blue on Black) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\modaobgliiinjfofblifbikbemfealmf [2012-05-21]
CHR Extension: (Google Wallet) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-02-01]
CHR Extension: (Google Mail) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-01]
CHR HKCU\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx []
CHR HKLM-x32\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx []
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-16] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [162096 2014-10-09] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S2 Update Deal Keeper; "C:\Program Files (x86)\Deal Keeper\updateDealKeeper.exe" [X]
S2 Util Deal Keeper; "C:\Program Files (x86)\Deal Keeper\bin\utilDealKeeper.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-16] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-16] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-02] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [X]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 00:29 - 2014-11-02 00:30 - 00019413 _____ () C:\Users\acer\Desktop\FRST.txt
2014-11-02 00:27 - 2014-11-02 00:27 - 00001193 _____ () C:\Users\acer\Desktop\JRT.txt
2014-11-01 21:20 - 2014-11-01 21:20 - 00000000 ____D () C:\Users\acer\Desktop\Neuer Ordner
2014-11-01 14:45 - 2014-11-01 14:45 - 00000000 ____D () C:\Windows\ERUNT
2014-11-01 14:29 - 2014-11-01 14:29 - 00000000 ____D () C:\Users\acer\Desktop\FRST-OlderVersion
2014-11-01 14:25 - 2014-11-01 14:25 - 01706359 _____ (Thisisu) C:\Users\acer\Desktop\JRT.exe
2014-10-31 12:10 - 2014-11-02 00:19 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-31 12:09 - 2014-10-31 12:09 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-31 12:09 - 2014-10-31 12:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-31 12:09 - 2014-10-31 12:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-31 12:09 - 2014-10-31 12:09 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-31 12:09 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-31 12:09 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-31 12:09 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-30 18:37 - 2014-10-30 18:37 - 00001613 _____ () C:\Users\Public\Desktop\League of Legends.lnk
2014-10-30 18:37 - 2014-10-30 18:37 - 00000000 ____D () C:\Riot Games
2014-10-30 18:37 - 2014-10-30 18:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2014-10-29 23:21 - 2014-10-29 23:21 - 00003320 _____ () C:\Windows\System32\Tasks\AviraSpeedup
2014-10-29 23:16 - 2014-10-29 23:22 - 00000000 ____D () C:\Users\acer\AppData\Local\AviraSpeedup
2014-10-29 16:07 - 2014-11-02 00:29 - 00000000 ____D () C:\FRST
2014-10-29 16:05 - 2014-11-01 14:29 - 02114048 _____ (Farbar) C:\Users\acer\Desktop\FRST64.exe
2014-10-29 14:26 - 2014-10-29 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
2014-10-29 14:12 - 2014-10-29 14:12 - 01998336 _____ () C:\Users\acer\Desktop\AdwCleaner_4.002.exe
2014-10-24 16:25 - 2014-11-01 14:26 - 00000000 ____D () C:\Users\acer\Desktop\Ёлка
2014-10-12 14:02 - 2014-10-12 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 00:25 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-02 00:25 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-02 00:23 - 2014-02-08 20:23 - 00000288 _____ () C:\Windows\Tasks\Funmoods Chat.job
2014-11-02 00:21 - 2012-01-31 09:39 - 01311040 _____ () C:\Windows\WindowsUpdate.log
2014-11-02 00:16 - 2012-01-31 12:18 - 00343912 _____ () C:\Windows\PFRO.log
2014-11-02 00:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-02 00:16 - 2009-07-14 05:51 - 00686641 _____ () C:\Windows\setupact.log
2014-11-02 00:15 - 2014-09-13 11:50 - 00000000 ____D () C:\AdwCleaner
2014-11-02 00:06 - 2012-02-01 18:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job
2014-11-01 23:54 - 2014-02-12 22:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-01 17:55 - 2009-07-14 18:58 - 00696370 _____ () C:\Windows\system32\perfh007.dat
2014-11-01 17:55 - 2009-07-14 18:58 - 00147634 _____ () C:\Windows\system32\perfc007.dat
2014-11-01 17:55 - 2009-07-14 06:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-01 17:44 - 2012-02-01 18:40 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job
2014-11-01 14:26 - 2013-12-01 13:18 - 00000000 ____D () C:\Users\acer\Desktop\Музыка
2014-11-01 14:26 - 2012-07-09 21:08 - 00000000 ____D () C:\Users\acer\Desktop\PC
2014-11-01 14:26 - 2012-04-25 12:48 - 00000000 ____D () C:\Users\acer\Desktop\Mein Ordner
2014-11-01 14:01 - 2012-02-01 19:13 - 00000000 ____D () C:\Users\acer\AppData\Roaming\Skype
2014-10-29 23:31 - 2013-02-24 23:22 - 03190272 ___SH () C:\Users\acer\Desktop\Thumbs.db
2014-10-29 23:24 - 2014-08-05 09:04 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-29 23:23 - 2013-07-30 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-29 23:23 - 2013-07-30 12:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-29 14:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-10-29 14:51 - 2012-02-19 03:32 - 00000000 ____D () C:\Users\acer\AppData\Local\Akamai
2014-10-29 14:50 - 2014-01-12 01:27 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-10-29 14:49 - 2009-07-14 19:18 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-10-29 14:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-10-29 14:19 - 2012-01-31 11:36 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-29 14:19 - 2012-01-31 09:47 - 00001168 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-29 14:19 - 2012-01-31 09:47 - 00000981 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2014-10-29 13:55 - 2012-01-31 09:47 - 00000000 ____D () C:\Users\acer
2014-10-22 16:01 - 2012-02-01 18:40 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA
2014-10-22 16:01 - 2012-02-01 18:40 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core
2014-10-16 14:03 - 2013-07-30 12:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-16 14:03 - 2013-07-30 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-16 14:03 - 2013-07-30 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ____D () C:\ProgramData\Skype
2014-10-04 16:07 - 2014-05-11 18:38 - 00000499 _____ () C:\Users\acer\Desktop\7.txt

Some content of TEMP:
====================
C:\Users\acer\AppData\Local\Temp\AskSLib.dll
C:\Users\acer\AppData\Local\Temp\avgnt.exe
C:\Users\acer\AppData\Local\Temp\AviraSetup268150.exe
C:\Users\acer\AppData\Local\Temp\bdfilters.dll
C:\Users\acer\AppData\Local\Temp\Delta.exe
C:\Users\acer\AppData\Local\Temp\DivXSetup.exe
C:\Users\acer\AppData\Local\Temp\drm_dyndata_7380006.dll
C:\Users\acer\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\acer\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\acer\AppData\Local\Temp\gface_swap.exe
C:\Users\acer\AppData\Local\Temp\hcuninstaller_20131028_134921_3792.exe
C:\Users\acer\AppData\Local\Temp\i4jdel0.exe
C:\Users\acer\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll
C:\Users\acer\AppData\Local\Temp\propsys.dll
C:\Users\acer\AppData\Local\Temp\qdf_n_pe.dll
C:\Users\acer\AppData\Local\Temp\Quarantine.exe
C:\Users\acer\AppData\Local\Temp\SkypeSetup.exe
C:\Users\acer\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\acer\AppData\Local\Temp\sqlite3.dll
C:\Users\acer\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\acer\AppData\Local\Temp\TuneUpUtilities2013_de-DE.exe
C:\Users\acer\AppData\Local\Temp\Uninstaller-4088.exe
C:\Users\acer\AppData\Local\Temp\WSSetup.exe
C:\Users\acer\AppData\Local\Temp\YgoUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-27 19:18

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-11-2014
Ran by acer at 2014-11-02 00:30:44
Running from C:\Users\acer\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader 9.5.2 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.2 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Ashampoo Burning Studio FREE v.1.14.5 (HKLM-x32\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)
ATI AVIVO64 Codecs (Version: 10.7.0.40702 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{BADFD936-E907-C666-A6E1-3C04C06E4260}) (Version: 3.0.732.0 - ATI Technologies, Inc.)
Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)
Avira (HKLM-x32\...\{dc9a688a-12cb-4a22-b449-23d849d01dc7}) (Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C1200}) (Version: 12.18.0.3051 - APN, LLC)
Avira System Speedup (HKLM-x32\...\AviraSpeedup) (Version: 1.3.1.9970 - Avira System Speedup)
Bamboo (HKLM\...\Pen Tablet Driver) (Version: 5.2.5-5 - Wacom Technology Corp.)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - )
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Broadcom Gigabit NetLink Controller (HKLM\...\{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}) (Version: 12.26.02 - Broadcom Corporation)
ccc-core-static (x32 Version: 2009.0702.1239.20840 - Ihr Firmenname) Hidden
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.24 - DivX, LLC)
Google Chrome (HKCU\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Happy Cloud Client (HKCU\...\HappyCloud) (Version: 3.59 - Happy Cloud, Inc.)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movies Toolbar for Chrome (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaCR) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION
Movies Toolbar for Internet Explorer (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION
Mozilla Firefox 12.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 12.0 (x86 de)) (Version: 12.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)
PowerTeacher Version 23.04.026.P34 (HKLM-x32\...\PowerTeacher_is1) (Version: 23.04.026.P34 - admigro media GmbH)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5911 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)
Senus 2012 (HKLM-x32\...\Senus 2012) (Version: 2012 - Senus)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.2.0 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
Update for Funmoods Chat (HKCU\...\Funmoods Chat) (Version:  - Update for Funmoods Chat) <==== ATTENTION
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Vegas Pro 11.0 (HKLM-x32\...\{6BE7495E-8DF1-11E1-BB7D-F04DA23A5C58}) (Version: 11.0.682 - Sony)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
WebTablet FB Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.0.0.1 - Wacom Technology Corp.)
WebTablet IE Plugin (HKLM-x32\...\Wacom WebTabletPlugin for IE) (Version: 1.1.0.12 - Wacom Technology Corp.)
WebTablet Netscape Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Netscape) (Version: 1.1.0.10 - Wacom Technology Corp.)
WinRAR 4.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\acer\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================

29-10-2014 13:25:01 Avira System Speedup(1.3.1.9930)
29-10-2014 22:18:04 Avira System Speedup(1.3.1.9970)
30-10-2014 17:31:35 Removed League of Legends
30-10-2014 17:36:37 Installed League of Legends

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - \Funmoods Chat No Task File <==== ATTENTION
Task: {0E581D78-090E-4B3F-AD54-0D14A0FE299D} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {0E7D64A6-726E-4520-97EE-93D347538AE7} - System32\Tasks\{B838A91B-D1E3-401C-9EA5-16C1B1C9DD79} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)
Task: {36598214-6DC8-4F89-A570-7DC3D33FD8BF} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {39BC67C8-1301-43CD-AC38-AE940BA98B60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: {4C446A1C-E962-4CA1-8D3E-88EB4082CEB4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {54C625ED-6DB0-4300-ACF8-4C6FAD13148B} - System32\Tasks\{6C9FA6D1-EA02-43B7-852D-72304E2BC18A} => C:\Program Files (x86)\JoWooD\NfH_Compilation\NfH1\bin\game.exe
Task: {5DCBF933-A080-410F-AAF5-4D6B010B5817} - System32\Tasks\AviraSpeedup => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [2014-10-29] (Avira)
Task: {6C29B57E-6178-47CC-A301-5FBF818442E7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {74D4980C-87D8-47F2-8ED9-7B030B88CC9F} - System32\Tasks\{2EE2B7AA-5C0C-44A2-9C18-7743C493ABC2} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)
Task: {DE0E5CE5-8C3C-4C97-9202-C28256F3A581} - System32\Tasks\VKSaverUpdate => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-09-22 20:00 - 2011-09-08 16:48 - 01183096 _____ () C:\Program Files\Tablet\Pen\libxml2.dll
2013-02-13 03:37 - 2013-02-13 03:37 - 01263952 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2009-05-13 10:44 - 2009-05-13 10:44 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-01-31 10:19 - 2012-01-31 10:19 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup
MSCONFIG\startupreg: ApnTBMon => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: VKSaver => C:\ProgramData\VKSaver\VKSaver.exe

========================= Accounts: ==========================

acer (S-1-5-21-3090159671-3938598571-1968455546-1000 - Administrator - Enabled) => C:\Users\acer
Administrator (S-1-5-21-3090159671-3938598571-1968455546-500 - Administrator - Disabled)
Gast (S-1-5-21-3090159671-3938598571-1968455546-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3090159671-3938598571-1968455546-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Processor: AMD Athlon(tm) II Dual-Core M300
Percentage of memory in use: 30%
Total physical RAM: 4094.36 MB
Available physical RAM: 2841.64 MB
Total Pagefile: 8186.91 MB
Available Pagefile: 6466.52 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:203.12 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: CA20FFB1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 02.11.2014, 13:32

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c
Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File
FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]
Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - \Funmoods Chat No Task File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
C:\Users\acer\AppData\Roaming\FUNMOO~1
C:\Windows\Tasks\Funmoods Chat.job
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

SP4RK1NG · 02.11.2014, 14:51

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-11-2014
Ran by acer at 2014-11-02 14:36:32 Run:1
Running from C:\Users\acer\Desktop
Loaded Profile: acer (Available profiles: acer)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c
Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File
FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [Not Found]
FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]
Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - \Funmoods Chat No Task File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
C:\Users\acer\AppData\Roaming\FUNMOO~1
C:\Windows\Tasks\Funmoods Chat.job
EmptyTemp:
Hosts:
         
*****************

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\yandex.ru-002434" => Key deleted successfully.
"HKCR\CLSID\yandex.ru-002434" => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{e5d4f4fd-a039-4670-8354-633c30a5f54e} => value deleted successfully.
"HKCR\Wow6432Node\CLSID\{e5d4f4fd-a039-4670-8354-633c30a5f54e}" => Key not found.
C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} => Moved successfully.
C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com not found.
C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} not found.
C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} not found.
C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com not found.
C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi not found.
C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com not found.
C:\Windows\Tasks\Funmoods Chat.job => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{02F621BE-E296-4E88-B858-8C633FF9ABE8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02F621BE-E296-4E88-B858-8C633FF9ABE8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Funmoods Chat" => Key deleted successfully.
C:\ProgramData\TEMP => ":D1B5B4F1" ADS removed successfully.
C:\Users\acer\AppData\Roaming\FUNMOO~1 => Moved successfully.
"C:\Windows\Tasks\Funmoods Chat.job" => File/Directory not found.
"C:\Windows\System32\Drivers\etc\hosts" => Could not move.
Could not reset Hosts.
EmptyTemp: => Removed 30.5 GB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

cosinus · 02.11.2014, 15:10

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

29.10.2014, 17:01	#3
M-K-D-B /// TB-Ausbilder	Zu viele Werbungen im Browser edit __________________

29.10.2014, 23:30	#5
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Zu viele Werbungen im Browser Logs vom Virenscanner und Malwarebytes? __________________ Logfiles bitte immer in CODE-Tags posten

30.10.2014, 09:09	#7
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Zu viele Werbungen im Browser Kannst du jetzt bitte de Logs dazu posten... Und die von Malwarebytes auch nicht vergessen wenn es Funde gab __________________ Logfiles bitte immer in CODE-Tags posten

Zu viele Werbungen im Browser

Überwachung, Datenschutz und Spam: Zu viele Werbungen im Browser