Computer läuft langsam und bunt unterstrichene Wörter führen zu Werbung...

Cindy 22 · 01.11.2013, 13:27

Hallo Leute...Hab mich eben neu Angemeldet und hoffe ich bin bei euch richtig ^^
Habe seit ein paar Tagen mehrere probleme mit meinem Computer (Betriebssystem Windows Vista, 32 Bit, 2,2 GHz). Zum einen läuft er SEHR langsam und dann sind da noch diese bunt unterstrichenen/eigefärbten einzelnen Wörter in Texten, wenn ich über diese meist blau unterstrichenen Wörter drüber fahre, erscheint eine Werbung von "Holen Media Player" ...sehen Sie sich Viedeos in High Definition. Jetzt herunterladen! Ads by SuperLyrics in der linken Ecke gibt es auch ein SCHLIEßEN Sybol dieses zu drücken hilft mir natürlich wenig... Habe leider nur sehr wenig Ahnung von dem ganzen Thema rund um Computer und Software.

Als ich mein Problem grob bei Google eingegeben habe, bin ich darauf gestoßen das es sich wohl um eine "Browser-Hijacker" handelt und habe einen empfohlenen "Adw Cleaner" durchlaufen lassen...neu start und alles war leider immernoch wie Vorher.

Danach habe ich mich hier im Trojaner-Board mit den Beiträgen der Leute beschäftigt, die ein ähnliches Problem wie ich haben und habe diesen teil schonmal erledigt:
Bitte Bitte helft mir

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Cindy (administrator) on STERNI on 01-11-2013 12:48:21
Running from C:\Users\Cindy\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Norman ASA) C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
(Norman ASA) C:\Program Files\Norman\Ngs\Bin\Nnf.exe
(Norman ASA) C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Norman ASA) C:\Program Files\Norman\Npm\Bin\Zanda.exe
(Norman ASA) C:\Program Files\Norman\npm\bin\nvoy.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Norman ASA) C:\Program Files\Norman\Npm\Bin\zlh.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Pando Networks\Media Booster\PMB.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\StCenter.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\FritzDsl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\system32\IoctlSvc.exe
(Fujitsu Siemens Computers) C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Norman ASA) C:\Program Files\Norman\Npm\Bin\scheduler.exe
(Norman ASA) C:\Program Files\Norman\npc\bin\npcsvc32.exe
() C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
(Norman ASA) C:\Program Files\Norman\npc\bin\nuaa.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Farbar) C:\Users\Cindy\Downloads\FRST(1).exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6144000 2008-05-28] (Realtek Semiconductor)
HKLM\...\Run: [FSCRecovery] - C:\Program Files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe [268096 2008-06-18] (Fujitsu Siemens Computers GmbH)
HKLM\...\Run: [Norman ZANDA] - C:\Program Files\Norman\Npm\Bin\zlh.exe [348560 2012-02-14] (Norman ASA)
HKLM\...\Run: [NPCTray] - C:\Program Files\Norman\Npc\Bin\npc_tray.exe [126008 2007-09-17] (Norman ASA)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [652624 2007-10-25] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [1603152 2007-09-13] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\...\Run: [SwitchBoard] - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM\...\Run: [OpwareSE2] - C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM\...\Run: [OPSE reminder] - C:\Program Files\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe [729088 2003-07-07] ()
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Skytel] - C:\Windows\SkyTel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe [3077528 2011-06-14] ()
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [Google Update] - C:\Users\Cindy\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-12-19] (Google Inc.)
HKCU\...\Run: [GoogleChromeAutoLaunch_2BFA3B4E2AC391BCB4542950289EF4F3] - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\chrome.exe [844752 2013-10-09] (Google Inc.)
MountPoints2: {6cf6629c-0da8-11e3-a20a-002185fbb3ef} - K:\LGAutoRun.exe
MountPoints2: {8073858b-bc43-11e0-bbfb-002185fbb3ef} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\Start.hta
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Herr Fitzner\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Herr Fitzner\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin
AppInit_DLLs:   [ ] ()
Startup: C:\Users\Cindy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ShortcutTarget: ctfmon.lnk -> C:\ProgramData\lsass.exe (Microsoft Corporation)
Startup: C:\Users\Cindy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files\FRITZ!DSL\FritzDsl.exe (AVM Berlin)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
SearchScopes: HKLM - DefaultScope value is missing.
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: iminent Helper Object - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - C:\Program Files\IminentToolbar\1.8.26.8\bh\iminent.dll No File
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: optitoolbar Helper Object - {F498380A-7935-4DC7-88B1-C158321DF79E} - C:\Program Files\Opti Toolbar\optitoolbar\1.8.26.9\bh\optitoolbar.dll (Opti Toolbar)
Toolbar: HKLM - optitoolbar Toolbar - {FE560166-CBE3-4A0D-80B5-A3B216F93EEA} - C:\Program Files\Opti Toolbar\optitoolbar\1.8.26.9\optitoolbarTlbr.dll (Opti Toolbar)
Toolbar: HKLM - Iminent Toolbar - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - C:\Program Files\IminentToolbar\1.8.26.8\iminentTlbr.dll No File
Winsock: Catalog9 01 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 02 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 03 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 04 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 05 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 06 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 07 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 08 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 09 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 10 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 12 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 13 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 14 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 15 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 16 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 17 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 18 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 37 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 38 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default
FF NewTab: hxxp://start.iminent.com/?ref=NewTab&appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
FF DefaultSearchEngine: StartWeb
FF SelectedSearchEngine: StartWeb
FF Homepage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
FF Keyword.URL: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_ff_de_display?ie=UTF8&tag=bds-p18-serp-de-ff-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_ff_ab_OC1&query=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Cindy\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Cindy\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\amazon-distro.xml
FF SearchPlugin: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\optitoolbar.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\StartWeb.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: SuperLyrics-16 - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\58ad0086-1cfb-48bb-8ad2-33a8905572bc@5715d2be-69b9-4930-8f7e-64bdeb961cfd.com
FF Extension: optitoolbar.com - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\ffxtlbr@optitoolbar.com
FF Extension: No Name - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\trash
FF Extension: DownloadHelper - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: abb - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\abb@amazon.com.xpi
FF Extension: No Name - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Adblock Plus - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

Chrome: 
=======
CHR HomePage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
CHR RestoreOnStartup: "hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF", "hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_sp_OC1"
CHR DefaultSearchURL: (Amazon) - hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tag=bds-p18-serp-de-cr-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_ds_OC1&query={searchTerms}
CHR DefaultSuggestURL: (Amazon) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}&output=chrome
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (ProxTube) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.3_0
CHR Extension: (YouTube) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (SuperLyrics-16) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\incpbbmbclbkhjphicahojidkcabaajc\1.25.7_0
CHR Extension: (Black Rock Shooter Theme2) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\mblhdcamkdmbdepgfenikeaalbnniffk\3_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (Gmail) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [ncoodlkjimgohlngmapmpnbfaoifkhnd] - C:\Users\Cindy\AppData\Roaming\BabSolution\CR\Opti.crx
CHR StartMenuInternet: Google Chrome - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 eLoggerSvc6; C:\Program Files\Norman\Npm\Bin\Elogsvc.exe [76232 2011-10-24] (Norman ASA)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [87344 2007-09-04] (AVM Berlin)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
R2 NNFSVC; C:\Program Files\Norman\Ngs\Bin\Nnf.exe [231216 2011-11-14] (Norman ASA)
R3 Norman NJeeves; C:\Program Files\Norman\Npm\bin\NJEEVES.EXE [116056 2012-02-03] ()
R2 Norman ZANDA; C:\Program Files\Norman\Npm\Bin\Zanda.exe [431320 2012-02-13] (Norman ASA)
R3 NPC; C:\Program Files\Norman\npc\bin\npcsvc32.exe [416880 2008-04-17] (Norman ASA)
R2 NPROSECSVC; C:\Program Files\Norman\Ngs\Bin\Nprosec.exe [90144 2011-09-30] (Norman ASA)
S3 nsesvc; C:\Program Files\Norman\Nse\bin\NSESVC.EXE [310328 2009-05-19] (Norman ASA)
R3 NUAA; C:\Program Files\Norman\npc\bin\nuaa.exe [121912 2009-03-24] (Norman ASA)
S3 nvcoas; C:\Program Files\Norman\Nvc\bin\nvcoas.exe [195640 2009-04-28] (Norman ASA)
R2 NVOY; C:\Program Files\Norman\npm\bin\nvoy.exe [100936 2011-10-19] (Norman ASA)
R3 Scheduler; C:\Program Files\Norman\Npm\Bin\scheduler.exe [99312 2011-04-11] (Norman ASA)
R2 TestHandler; C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [303104 2008-04-25] (Fujitsu Siemens Computers)
S3 NVCScheduler; "C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE" [x]

==================== Drivers (Whitelisted) ====================

S4 ahcix86s; C:\Windows\system32\drivers\ahcix86s.sys [173576 2008-05-27] (AMD Technologies Inc.)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag.sys [23040 2012-03-06] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem.sys [27776 2012-03-06] (LG Electronics Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-09] (Avira Operations GmbH & Co. KG)
S4 JRAID; C:\Windows\system32\drivers\jraid.sys [76688 2008-04-03] (JMicron Technology Corp.)
R2 Ndiskio; C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [20448 2007-01-02] (Norman ASA)
R1 NGS; c:\program files\norman\ngs\bin\ngs.sys [26744 2011-07-12] (Norman ASA)
R1 NPROSEC; C:\Program Files\Norman\Ngs\Bin\nprosec.sys [91136 2011-11-11] (Norman ASA)
R2 nregsec; C:\Program Files\Norman\Ngs\Bin\nregsec.sys [61496 2011-11-11] (Norman ASA)
S3 NvcMFlt; C:\Windows\System32\DRIVERS\nvcv32mf.sys [19512 2009-01-22] (Norman ASA)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-09] (Avira GmbH)
S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-01 12:48 - 2013-11-01 12:48 - 00000000 ____D C:\FRST
2013-11-01 12:47 - 2013-11-01 12:47 - 01089445 _____ (Farbar) C:\Users\Cindy\Downloads\FRST(1).exe
2013-11-01 12:21 - 2013-11-01 12:24 - 00000000 ____D C:\AdwCleaner
2013-11-01 12:21 - 2013-11-01 12:21 - 01060070 _____ C:\Users\Cindy\Downloads\adwcleaner-3.010.exe
2013-11-01 12:02 - 2013-11-01 12:03 - 01957098 _____ (Farbar) C:\Users\Cindy\Downloads\FRST64.exe
2013-11-01 11:59 - 2013-11-01 12:34 - 00001925 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-01 11:59 - 2013-11-01 12:34 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-01 11:59 - 2013-11-01 11:59 - 00001898 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee
2013-11-01 11:58 - 2013-11-01 11:59 - 01089445 _____ (Farbar) C:\Users\Cindy\Downloads\FRST.exe
2013-11-01 11:43 - 2013-11-01 11:44 - 01071328 _____ (Solid State Networks) C:\Users\Cindy\Downloads\install_reader10_de_mssa_aaa_aih.exe
2013-10-28 17:18 - 2013-10-28 17:18 - 00000611 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-10-19 15:01 - 2013-11-01 12:23 - 00000000 ____D C:\Program Files\Uniblue
2013-10-19 14:59 - 2013-10-19 14:59 - 00000000 ____D C:\Users\Cindy\AppData\Local\avgchrome
2013-10-19 14:57 - 2013-11-01 12:26 - 00001246 _____ C:\Windows\Tasks\SuperLyrics-16-codedownloader.job
2013-10-19 14:56 - 2013-11-01 12:26 - 00001946 _____ C:\Windows\Tasks\SuperLyrics-16-chromeinstaller.job
2013-10-19 14:56 - 2013-11-01 12:26 - 00001872 _____ C:\Windows\Tasks\SuperLyrics-16-firefoxinstaller.job
2013-10-19 14:56 - 2013-10-19 14:57 - 00000000 ____D C:\Program Files\SuperLyrics-16
2013-10-19 14:56 - 2013-10-19 14:56 - 00319240 _____ C:\Users\Cindy\Downloads\Java(1).exe
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Users\Cindy\AppData\Roaming\Opti Toolbar
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Program Files\Opti Toolbar
2013-10-19 14:54 - 2013-10-19 14:54 - 00319240 _____ C:\Users\Cindy\Downloads\Java.exe
2013-10-13 10:49 - 2013-09-22 11:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-13 10:49 - 2013-09-22 11:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-13 10:49 - 2013-09-22 11:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-13 10:49 - 2013-09-22 11:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-13 10:49 - 2013-09-22 11:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-13 10:49 - 2013-09-22 11:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-13 10:49 - 2013-09-22 11:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-13 10:49 - 2013-09-22 11:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-13 10:49 - 2013-09-22 11:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-13 10:49 - 2013-09-22 11:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-13 10:49 - 2013-09-22 11:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-13 10:49 - 2013-09-22 11:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-13 10:49 - 2013-09-22 11:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-13 10:49 - 2013-09-22 11:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-13 10:49 - 2013-09-22 11:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-13 10:49 - 2013-09-22 10:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-12 15:41 - 2013-08-29 08:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-12 15:41 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-12 15:41 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-12 15:41 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-12 15:41 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-12 15:41 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-12 15:41 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-12 15:41 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-12 15:41 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-12 15:41 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-12 15:41 - 2013-08-01 04:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-12 15:41 - 2013-08-01 03:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-12 15:41 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 15:41 - 2013-07-12 10:04 - 00073344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-12 15:41 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-12 15:41 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-12 15:41 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-12 15:41 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-12 15:41 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-12 15:41 - 2013-06-29 03:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-12 15:41 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-12 15:41 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-12 15:41 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-12 15:41 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-12 15:41 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-12 15:41 - 2011-05-05 14:54 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-05 15:32 - 2013-10-19 14:56 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-05 15:04 - 2013-10-05 15:04 - 01253744 _____ (Bandoo Media Inc) C:\Users\Cindy\Downloads\jZipSetup-r230-n-bf.exe
2013-10-05 15:04 - 2013-10-05 15:04 - 01253744 _____ (Bandoo Media Inc) C:\Users\Cindy\Downloads\jZipSetup-r230-n-bf(1).exe
2013-10-05 15:03 - 2013-10-05 15:05 - 26944328 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Cindy\Downloads\FreeYouTubeToMP3Converter(2).exe
2013-10-04 14:58 - 2013-10-04 14:58 - 00000000 ____D C:\Users\Cindy\dwhelper

==================== One Month Modified Files and Folders =======

2013-11-01 12:49 - 2011-06-14 08:23 - 00000000 ____D C:\Users\Cindy\AppData\Local\PMB Files
2013-11-01 12:48 - 2013-11-01 12:48 - 00000000 ____D C:\FRST
2013-11-01 12:47 - 2013-11-01 12:47 - 01089445 _____ (Farbar) C:\Users\Cindy\Downloads\FRST(1).exe
2013-11-01 12:34 - 2013-11-01 11:59 - 00001925 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-01 12:34 - 2013-11-01 11:59 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-01 12:34 - 2008-04-09 11:19 - 01568228 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-01 12:31 - 2009-04-03 07:45 - 01986049 _____ C:\Windows\WindowsUpdate.log
2013-11-01 12:26 - 2013-10-19 14:57 - 00001246 _____ C:\Windows\Tasks\SuperLyrics-16-codedownloader.job
2013-11-01 12:26 - 2013-10-19 14:56 - 00001946 _____ C:\Windows\Tasks\SuperLyrics-16-chromeinstaller.job
2013-11-01 12:26 - 2013-10-19 14:56 - 00001872 _____ C:\Windows\Tasks\SuperLyrics-16-firefoxinstaller.job
2013-11-01 12:26 - 2008-01-21 03:47 - 00217176 _____ C:\Windows\PFRO.log
2013-11-01 12:26 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-01 12:26 - 2006-11-02 13:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-01 12:26 - 2006-11-02 13:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-01 12:25 - 2006-11-02 14:01 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-01 12:24 - 2013-11-01 12:21 - 00000000 ____D C:\AdwCleaner
2013-11-01 12:23 - 2013-10-19 15:01 - 00000000 ____D C:\Program Files\Uniblue
2013-11-01 12:23 - 2009-04-06 12:31 - 00000000 ____D C:\ProgramData\ICQ
2013-11-01 12:21 - 2013-11-01 12:21 - 01060070 _____ C:\Users\Cindy\Downloads\adwcleaner-3.010.exe
2013-11-01 12:03 - 2013-11-01 12:02 - 01957098 _____ (Farbar) C:\Users\Cindy\Downloads\FRST64.exe
2013-11-01 11:59 - 2013-11-01 11:59 - 00001898 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee
2013-11-01 11:59 - 2013-11-01 11:58 - 01089445 _____ (Farbar) C:\Users\Cindy\Downloads\FRST.exe
2013-11-01 11:59 - 2009-04-03 08:11 - 00000000 ____D C:\Users\Cindy\AppData\Local\Adobe
2013-11-01 11:58 - 2009-04-03 07:51 - 00000000 ____D C:\ProgramData\Adobe
2013-11-01 11:58 - 2009-04-03 07:51 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-11-01 11:58 - 2009-04-03 07:51 - 00000000 ____D C:\Program Files\Adobe
2013-11-01 11:44 - 2013-11-01 11:43 - 01071328 _____ (Solid State Networks) C:\Users\Cindy\Downloads\install_reader10_de_mssa_aaa_aih.exe
2013-11-01 11:12 - 2012-12-19 14:39 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000UA.job
2013-11-01 11:10 - 2012-10-04 14:31 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-01 10:38 - 2011-03-03 10:09 - 00028160 _____ C:\Users\Cindy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-01 10:38 - 2006-11-02 13:52 - 00198123 _____ C:\Windows\setupact.log
2013-11-01 10:37 - 2011-06-30 13:38 - 00000000 ____D C:\Users\Cindy\Desktop\Shadzüü^^
2013-10-28 17:18 - 2013-10-28 17:18 - 00000611 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-10-27 14:12 - 2012-12-19 14:39 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000Core.job
2013-10-27 08:55 - 2010-11-01 10:11 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-10-27 08:55 - 2008-08-06 23:08 - 00000000 ____D C:\ProgramData\NVIDIA
2013-10-19 16:04 - 2009-04-03 08:12 - 00070296 _____ C:\Users\Cindy\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-19 16:03 - 2006-11-02 13:47 - 03651120 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-19 16:02 - 2011-07-06 06:55 - 00000000 ____D C:\Program Files\Common Files\Blizzard Entertainment
2013-10-19 15:33 - 2009-04-03 07:59 - 00000000 ____D C:\Program Files\Microsoft Works
2013-10-19 15:33 - 2006-11-02 12:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-10-19 15:28 - 2011-11-01 17:13 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-10-19 15:23 - 2009-04-03 07:59 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-10-19 15:23 - 2009-04-03 07:58 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-19 15:20 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\ShellNew
2013-10-19 14:59 - 2013-10-19 14:59 - 00000000 ____D C:\Users\Cindy\AppData\Local\avgchrome
2013-10-19 14:57 - 2013-10-19 14:56 - 00000000 ____D C:\Program Files\SuperLyrics-16
2013-10-19 14:56 - 2013-10-19 14:56 - 00319240 _____ C:\Users\Cindy\Downloads\Java(1).exe
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Users\Cindy\AppData\Roaming\Opti Toolbar
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Program Files\Opti Toolbar
2013-10-19 14:56 - 2013-10-05 15:32 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-19 14:54 - 2013-10-19 14:54 - 00319240 _____ C:\Users\Cindy\Downloads\Java.exe
2013-10-19 13:23 - 2012-02-06 11:23 - 00002048 _____ C:\Users\Cindy\Desktop\Google Chrome.lnk
2013-10-15 10:06 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-13 10:54 - 2013-08-16 08:34 - 00000000 ____D C:\Windows\system32\MRT
2013-10-13 10:52 - 2006-11-02 11:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-12 17:12 - 2012-10-04 14:31 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-12 17:12 - 2011-06-01 11:28 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-08 15:41 - 2012-07-15 12:15 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-05 15:17 - 2013-01-27 12:44 - 00000000 ____D C:\Users\Cindy\Desktop\MUSIC & FILME CID
2013-10-05 15:05 - 2013-10-05 15:03 - 26944328 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Cindy\Downloads\FreeYouTubeToMP3Converter(2).exe
2013-10-05 15:04 - 2013-10-05 15:04 - 01253744 _____ (Bandoo Media Inc) C:\Users\Cindy\Downloads\jZipSetup-r230-n-bf.exe
2013-10-05 15:04 - 2013-10-05 15:04 - 01253744 _____ (Bandoo Media Inc) C:\Users\Cindy\Downloads\jZipSetup-r230-n-bf(1).exe
2013-10-04 15:24 - 2013-02-08 22:24 - 00000000 ____D C:\Users\Cindy\AppData\Roaming\vlc
2013-10-04 14:58 - 2013-10-04 14:58 - 00000000 ____D C:\Users\Cindy\dwhelper
2013-10-04 14:58 - 2009-04-03 08:11 - 00000000 ____D C:\Users\Cindy

Files to move or delete:
====================
C:\ProgramData\0tbpw.pad
C:\ProgramData\lsass.exe
C:\Users\Public\AlexaNSISPlugin.3860.dll


Some content of TEMP:
====================
C:\Users\Cindy\AppData\Local\Temp\AskSLib.dll
C:\Users\Cindy\AppData\Local\Temp\Java(1).exe
C:\Users\Cindy\AppData\Local\Temp\Java.exe
C:\Users\Cindy\AppData\Local\Temp\Quarantine.exe
C:\Users\Herr Fitzner\AppData\Local\Temp\AskSLib.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-01 12:34

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Cindy at 2013-11-01 12:49:42
Running from C:\Users\Cindy\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norman Security Suite (Disabled - Up to date) {D038CA80-26F3-90BF-94AA-03C4D945E661}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Norman Security Suite (Disabled - Up to date) {6B592B64-00C9-9F31-AE1A-38B6A2C2ACDC}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe AIR (Version: 3.1.0.4880)
Adobe Community Help (Version: 3.4.980)
Adobe Download Assistant (Version: 1.0.6)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Photoshop CS5.1 (Version: 12.1)
Adobe Reader X (10.1.4) - Deutsch (Version: 10.1.4)
Amazon Browser Settings (Version: 3.0.2012.0507)
ArcSoft PhotoStudio 5.5
Avira Free Antivirus (Version: 13.0.0.4052)
AVM FRITZ!Box Dokumentation
AVM FRITZ!DSL (Version: 2.04.02)
Canon MP Navigator 2.0
Canon MP Navigator EX 1.2
Canon MP170
Canon MP190 series Benutzerregistrierung
Canon MP190 series MP Drivers
Canon My Printer
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
EAX Unified
Free YouTube to MP3 Converter version 3.12.0.128 (Version: 3.12.0.128)
Fujitsu Siemens Computers Recovery (Version: 1.3.9)
Google Chrome (HKCU Version: 30.0.1599.101)
Iminent (Version: 6.42.32.0)
LG United Mobile Drivers (Version: 3.7.2.0)
McAfee Security Scan Plus (Version: 3.8.130.8)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nero 8 Essentials (Version: 8.3.228)
neroxml (Version: 1.0.0)
Norman Security Suite (Version: 7.00.0200)
NVIDIA Drivers
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
OmniPage SE (Version: 2.00.0004)
Opti Chrome Toolbar
Opti toolbar   (Version: 1.8.26.9)
Pando Media Booster (Version: 2.3.5.9)
PC Inspector File Recovery (Version: 4.0)
PDF Settings CS5 (Version: 10.0)
Realtek High Definition Audio Driver
SuperLyrics-16 (Version: 1.29.153.0)
SystemDiagnostics (Version: 2.01.0004)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
VCRedistSetup (Version: 1.0.0)
VLC media player 2.0.5 (Version: 2.0.5)
WinZipper (Version: 1.4.8)

==================== Restore Points  =========================

20-10-2013 11:08:55 Geplanter Prüfpunkt
27-10-2013 07:53:40 Removed NVIDIA PhysX

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {110A0E34-3471-4BBE-B284-632612A328DC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-12] (Adobe Systems Incorporated)
Task: {19C3ED6A-42CF-499C-89EF-3BBD9B51DE16} - System32\Tasks\OpenCandyHelperRunOnce => C:\Users\Cindy\AppData\Roaming\OpenCandy\53347EB33ECD462FA7FF251373301CDD\OCBrowserHelper_1.0.3.85.dll"C:\Users\Cindy\AppData\Roaming\OpenCandy\53347EB33ECD462FA7FF251373301CDD\OCBrowserHelper_1.0.3.85.dll",_OCRestartDll@16
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {25D7E9C1-5128-4A75-97FA-3338EBD54A77} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000UA => C:\Users\Cindy\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.)
Task: {284E0966-9FBA-49A1-BEF7-0A2A34B53892} - System32\Tasks\SuperLyrics-16-chromeinstaller => C:\Program Files\SuperLyrics-16\SuperLyrics-16-chromeinstaller.exe [2013-10-19] (PassWizard)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {4573AF0C-0EA9-4977-AD17-798F6EFCB0A3} - System32\Tasks\SuperLyrics-16-codedownloader => C:\Program Files\SuperLyrics-16\SuperLyrics-16-codedownloader.exe [2013-10-19] (PassWizard)
Task: {48277F0E-C174-4DB0-A4F7-1DB7CA480083} - System32\Tasks\Automatische Wartung => C:\Program Files\TuneUp Utilities 2009\OneClickStarter.exe
Task: {7AA0EBDA-E687-4B22-ADB3-7D091080C0A7} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2008-01-21] (Microsoft Corporation)
Task: {7F7C07CA-59E5-4055-BAFA-E18FCDD5F421} - System32\Tasks\SuperLyrics-16-firefoxinstaller => C:\Program Files\SuperLyrics-16\SuperLyrics-16-firefoxinstaller.exe [2013-10-19] (PassWizard)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\System32\pla.dll [2008-01-21] (Microsoft Corporation)
Task: {B2C0FB18-F6C6-402C-B440-DA7AAF3A352F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-12] (Microsoft Corporation)
Task: {DF83F56F-7CBB-4166-B7B4-B43F5D91DE89} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000Core => C:\Users\Cindy\AppData\Local\Google\Update\GoogleUpdate.exe [2012-12-19] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000Core.job => C:\Users\Cindy\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000UA.job => C:\Users\Cindy\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SuperLyrics-16-chromeinstaller.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-chromeinstaller.exe
Task: C:\Windows\Tasks\SuperLyrics-16-codedownloader.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-codedownloader.exe
Task: C:\Windows\Tasks\SuperLyrics-16-firefoxinstaller.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-firefoxinstaller.exe

==================== Loaded Modules (whitelisted) =============

2012-03-22 07:36 - 2010-10-18 11:05 - 10896384 _____ () C:\Program Files\Norman\Npm\Bin\NQtCore4.dll
2012-03-22 07:36 - 2011-02-14 09:35 - 01069048 _____ () C:\Program Files\Norman\Npm\Bin\libxml2.dll
2013-10-05 15:32 - 2013-10-05 15:32 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-10-12 17:12 - 2013-10-12 17:12 - 16233864 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/01/2013 00:28:22 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/01/2013 09:43:03 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/30/2013 06:56:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/28/2013 05:28:54 PM) (Source: Application Hang) (User: )
Description: Programm avcenter.exe, Version 13.6.20.2100 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: d30
Anfangszeit: 01ced3f799f02a4f
Zeitpunkt der Beendigung: 0

Error: (10/28/2013 04:46:17 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/27/2013 08:49:25 AM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16514, Zeitstempel 0x523ec269, fehlerhaftes Modul AmazonBrowserBar.3.0.dll, Version 3.0.2012.507, Zeitstempel 0x4fa80daf, Ausnahmecode 0xc0000005, Fehleroffset 0x0007871b,
Prozess-ID 0xfc8, Anwendungsstartzeit iexplore.exe0.

Error: (10/27/2013 08:48:40 AM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16514 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: f04
Anfangszeit: 01ced2e8ae9297c9
Zeitpunkt der Beendigung: 0

Error: (10/27/2013 08:47:42 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/21/2013 03:42:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/21/2013 08:31:11 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/01/2013 00:29:34 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (11/01/2013 09:45:00 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (10/30/2013 06:56:58 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (10/28/2013 05:17:18 PM) (Source: Service Control Manager) (User: )
Description: SProtection

Error: (10/28/2013 04:48:08 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (10/27/2013 08:50:59 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (10/27/2013 08:49:37 AM) (Source: Service Control Manager) (User: )
Description: Avira Browser-Schutz101Neustart des Diensts

Error: (10/21/2013 03:43:26 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (10/21/2013 08:32:50 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (10/20/2013 08:23:15 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032


Microsoft Office Sessions:
=========================
Error: (11/01/2013 00:28:22 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/01/2013 09:43:03 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/30/2013 06:56:10 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/28/2013 05:28:54 PM) (Source: Application Hang)(User: )
Description: avcenter.exe13.6.20.2100d3001ced3f799f02a4f0

Error: (10/28/2013 04:46:17 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/27/2013 08:49:25 AM) (Source: Application Error)(User: )
Description: iexplore.exe9.0.8112.16514523ec269AmazonBrowserBar.3.0.dll3.0.2012.5074fa80dafc00000050007871bfc801ced2e8acd05880

Error: (10/27/2013 08:48:40 AM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16514f0401ced2e8ae9297c90

Error: (10/27/2013 08:47:42 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/21/2013 03:42:11 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/21/2013 08:31:11 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-09-08 16:46:38.605
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-08 16:46:38.417
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-08 16:46:38.230
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-08 16:46:38.027
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-08 16:46:37.825
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-01 15:08:31.055
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-01 15:08:30.852
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-01 15:08:30.649
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-01 15:08:30.446
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-01 15:08:30.228
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 60%
Total physical RAM: 2046.51 MB
Available physical RAM: 802.64 MB
Total Pagefile: 4338.43 MB
Available Pagefile: 2733.64 MB
Total Virtual: 2047.88 MB
Available Virtual: 1886.3 MB

==================== Drives ================================

Drive c: (SYSTEM) (Fixed) (Total:94.16 GB) (Free:27.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:195.14 GB) (Free:149.2 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 6736A262)
Partition 1: (Not Active) - (Size=9 GB) - (Type=27)
Partition 2: (Active) - (Size=94 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195 GB) - (Type=07 NTFS)

==================== End Of Log ============================

aharonov · 01.11.2013, 15:56

Hallo,

mach bitte das:

Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

AppInit_DLLs:   [ ] ()
Startup: C:\Users\Cindy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ShortcutTarget: ctfmon.lnk -> C:\ProgramData\lsass.exe (Microsoft Corporation)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
BHO: iminent Helper Object - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - C:\Program Files\IminentToolbar\1.8.26.8\bh\iminent.dll No File
BHO: optitoolbar Helper Object - {F498380A-7935-4DC7-88B1-C158321DF79E} - C:\Program Files\Opti Toolbar\optitoolbar\1.8.26.9\bh\optitoolbar.dll (Opti Toolbar)
Toolbar: HKLM - optitoolbar Toolbar - {FE560166-CBE3-4A0D-80B5-A3B216F93EEA} - C:\Program Files\Opti Toolbar\optitoolbar\1.8.26.9\optitoolbarTlbr.dll (Opti Toolbar)
Toolbar: HKLM - Iminent Toolbar - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - C:\Program Files\IminentToolbar\1.8.26.8\iminentTlbr.dll No File
FF NewTab: hxxp://start.iminent.com/?ref=NewTab&appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
FF DefaultSearchEngine: StartWeb
FF SelectedSearchEngine: StartWeb
FF Homepage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
FF Keyword.URL: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_ff_de_display?ie=UTF8&tag=bds-p18-serp-de-ff-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_ff_ab_OC1&query=
FF SearchPlugin: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\amazon-distro.xml
FF SearchPlugin: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\optitoolbar.xml
FF Extension: SuperLyrics-16 - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\58ad0086-1cfb-48bb-8ad2-33a8905572bc@5715d2be-69b9-4930-8f7e-64bdeb961cfd.com
FF Extension: optitoolbar.com - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\ffxtlbr@optitoolbar.com
CHR HomePage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
CHR RestoreOnStartup: "hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF", "hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_sp_OC1"
CHR DefaultSearchURL: (Amazon) - hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tag=bds-p18-serp-de-cr-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_ds_OC1&query={searchTerms}
CHR DefaultSuggestURL: (Amazon) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}&output=chrome
CHR Extension: (SuperLyrics-16) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\incpbbmbclbkhjphicahojidkcabaajc\1.25.7_0
CHR HKLM\...\Chrome\Extension: [ncoodlkjimgohlngmapmpnbfaoifkhnd] - C:\Users\Cindy\AppData\Roaming\BabSolution\CR\Opti.crx
2013-10-19 14:59 - 2013-10-19 14:59 - 00000000 ____D C:\Users\Cindy\AppData\Local\avgchrome
2013-10-19 14:56 - 2013-10-19 14:57 - 00000000 ____D C:\Program Files\SuperLyrics-16
2013-10-19 14:56 - 2013-10-19 14:56 - 00319240 _____ C:\Users\Cindy\Downloads\Java(1).exe
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Users\Cindy\AppData\Roaming\Opti Toolbar
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Program Files\Opti Toolbar
2013-10-19 14:54 - 2013-10-19 14:54 - 00319240 _____ C:\Users\Cindy\Downloads\Java.exe
Task: {284E0966-9FBA-49A1-BEF7-0A2A34B53892} - System32\Tasks\SuperLyrics-16-chromeinstaller => C:\Program Files\SuperLyrics-16\SuperLyrics-16-chromeinstaller.exe [2013-10-19] (PassWizard)
Task: {4573AF0C-0EA9-4977-AD17-798F6EFCB0A3} - System32\Tasks\SuperLyrics-16-codedownloader => C:\Program Files\SuperLyrics-16\SuperLyrics-16-codedownloader.exe [2013-10-19] (PassWizard)
Task: {7F7C07CA-59E5-4055-BAFA-E18FCDD5F421} - System32\Tasks\SuperLyrics-16-firefoxinstaller => C:\Program Files\SuperLyrics-16\SuperLyrics-16-firefoxinstaller.exe [2013-10-19] (PassWizard)
Task: C:\Windows\Tasks\SuperLyrics-16-chromeinstaller.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-chromeinstaller.exe
Task: C:\Windows\Tasks\SuperLyrics-16-codedownloader.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-codedownloader.exe
Task: C:\Windows\Tasks\SuperLyrics-16-firefoxinstaller.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-firefoxinstaller.exe
C:\ProgramData\0tbpw.pad

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4

Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Cindy 22 · 02.11.2013, 15:38

Hoffe ich hab es richtig gemacht. Ich mache jetzt weiter mit Schritt 2

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 31-10-2013
Ran by Cindy at 2013-11-01 16:50:39 Run:1
Running from C:\Users\Cindy\Pictures
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
AppInit_DLLs:   [ ] ()
Startup: C:\Users\Cindy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ShortcutTarget: ctfmon.lnk -> C:\ProgramData\lsass.exe (Microsoft Corporation)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
BHO: iminent Helper Object - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - C:\Program Files\IminentToolbar\1.8.26.8\bh\iminent.dll No File
BHO: optitoolbar Helper Object - {F498380A-7935-4DC7-88B1-C158321DF79E} - C:\Program Files\Opti Toolbar\optitoolbar\1.8.26.9\bh\optitoolbar.dll (Opti Toolbar)
Toolbar: HKLM - optitoolbar Toolbar - {FE560166-CBE3-4A0D-80B5-A3B216F93EEA} - C:\Program Files\Opti Toolbar\optitoolbar\1.8.26.9\optitoolbarTlbr.dll (Opti Toolbar)
Toolbar: HKLM - Iminent Toolbar - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - C:\Program Files\IminentToolbar\1.8.26.8\iminentTlbr.dll No File
FF NewTab: hxxp://start.iminent.com/?ref=NewTab&appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
FF DefaultSearchEngine: StartWeb
FF SelectedSearchEngine: StartWeb
FF Homepage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
FF Keyword.URL: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_ff_de_display?ie=UTF8&tag=bds-p18-serp-de-ff-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_ff_ab_OC1&query=
FF SearchPlugin: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\amazon-distro.xml
FF SearchPlugin: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\optitoolbar.xml
FF Extension: SuperLyrics-16 - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\58ad0086-1cfb-48bb-8ad2-33a8905572bc@5715d2be-69b9-4930-8f7e-64bdeb961cfd.com
FF Extension: optitoolbar.com - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\ffxtlbr@optitoolbar.com
CHR HomePage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
CHR RestoreOnStartup: "hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF", "hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_sp_OC1"
CHR DefaultSearchURL: (Amazon) - hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tag=bds-p18-serp-de-cr-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_ds_OC1&query={searchTerms}
CHR DefaultSuggestURL: (Amazon) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}&output=chrome
CHR Extension: (SuperLyrics-16) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\incpbbmbclbkhjphicahojidkcabaajc\1.25.7_0
CHR HKLM\...\Chrome\Extension: [ncoodlkjimgohlngmapmpnbfaoifkhnd] - C:\Users\Cindy\AppData\Roaming\BabSolution\CR\Opti.crx
2013-10-19 14:59 - 2013-10-19 14:59 - 00000000 ____D C:\Users\Cindy\AppData\Local\avgchrome
2013-10-19 14:56 - 2013-10-19 14:57 - 00000000 ____D C:\Program Files\SuperLyrics-16
2013-10-19 14:56 - 2013-10-19 14:56 - 00319240 _____ C:\Users\Cindy\Downloads\Java(1).exe
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Users\Cindy\AppData\Roaming\Opti Toolbar
2013-10-19 14:56 - 2013-10-19 14:56 - 00000000 ____D C:\Program Files\Opti Toolbar
2013-10-19 14:54 - 2013-10-19 14:54 - 00319240 _____ C:\Users\Cindy\Downloads\Java.exe
Task: {284E0966-9FBA-49A1-BEF7-0A2A34B53892} - System32\Tasks\SuperLyrics-16-chromeinstaller => C:\Program Files\SuperLyrics-16\SuperLyrics-16-chromeinstaller.exe [2013-10-19] (PassWizard)
Task: {4573AF0C-0EA9-4977-AD17-798F6EFCB0A3} - System32\Tasks\SuperLyrics-16-codedownloader => C:\Program Files\SuperLyrics-16\SuperLyrics-16-codedownloader.exe [2013-10-19] (PassWizard)
Task: {7F7C07CA-59E5-4055-BAFA-E18FCDD5F421} - System32\Tasks\SuperLyrics-16-firefoxinstaller => C:\Program Files\SuperLyrics-16\SuperLyrics-16-firefoxinstaller.exe [2013-10-19] (PassWizard)
Task: C:\Windows\Tasks\SuperLyrics-16-chromeinstaller.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-chromeinstaller.exe
Task: C:\Windows\Tasks\SuperLyrics-16-codedownloader.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-codedownloader.exe
Task: C:\Windows\Tasks\SuperLyrics-16-firefoxinstaller.job => C:\Program Files\SuperLyrics-16\SuperLyrics-16-firefoxinstaller.exe
C:\ProgramData\0tbpw.pad
         
*****************

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
C:\Users\Cindy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk => Moved successfully.
C:\ProgramData\lsass.exe => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{112BA211-334C-4A90-90EC-2AD1CDAB287C} => Key deleted successfully.
HKCR\CLSID\{112BA211-334C-4A90-90EC-2AD1CDAB287C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F498380A-7935-4DC7-88B1-C158321DF79E} => Key deleted successfully.
HKCR\CLSID\{F498380A-7935-4DC7-88B1-C158321DF79E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{FE560166-CBE3-4A0D-80B5-A3B216F93EEA} => Value deleted successfully.
HKCR\CLSID\{FE560166-CBE3-4A0D-80B5-A3B216F93EEA} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{1FAFD711-ABF9-4F6A-8130-5166C7371427} => Value deleted successfully.
HKCR\CLSID\{1FAFD711-ABF9-4F6A-8130-5166C7371427} => Key deleted successfully.
Firefox newtab deleted successfully.
Firefox DefaultSearchEngine deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
Firefox Keyword.URL deleted successfully.
C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\amazon-distro.xml => Moved successfully.
C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\searchplugins\optitoolbar.xml => Moved successfully.
C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\58ad0086-1cfb-48bb-8ad2-33a8905572bc@5715d2be-69b9-4930-8f7e-64bdeb961cfd.com => Moved successfully.
C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\ffxtlbr@optitoolbar.com => Moved successfully.
CHR HomePage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF ==> The Chrome "Settings" can be used to fix the entry.
CHR RestoreOnStartup: "hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF", "hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_sp_OC1" ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchURL: (Amazon) - hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tag=bds-p18-serp-de-cr-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_ds_OC1&query={searchTerms} ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSuggestURL: (Amazon) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}&output=chrome ==> The Chrome "Settings" can be used to fix the entry.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\incpbbmbclbkhjphicahojidkcabaajc => Moved successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\ncoodlkjimgohlngmapmpnbfaoifkhnd => Key deleted successfully.
"C:\Users\Cindy\AppData\Roaming\BabSolution\CR\Opti.crx" => File/Directory not found.
C:\Users\Cindy\AppData\Local\avgchrome => Moved successfully.
C:\Program Files\SuperLyrics-16 => Moved successfully.
C:\Users\Cindy\Downloads\Java(1).exe => Moved successfully.
C:\Users\Cindy\AppData\Roaming\Opti Toolbar => Moved successfully.
C:\Program Files\Opti Toolbar => Moved successfully.
C:\Users\Cindy\Downloads\Java.exe => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{284E0966-9FBA-49A1-BEF7-0A2A34B53892} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{284E0966-9FBA-49A1-BEF7-0A2A34B53892} => Key deleted successfully.
C:\Windows\System32\Tasks\SuperLyrics-16-chromeinstaller => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SuperLyrics-16-chromeinstaller => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4573AF0C-0EA9-4977-AD17-798F6EFCB0A3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4573AF0C-0EA9-4977-AD17-798F6EFCB0A3} => Key deleted successfully.
C:\Windows\System32\Tasks\SuperLyrics-16-codedownloader => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SuperLyrics-16-codedownloader => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7F7C07CA-59E5-4055-BAFA-E18FCDD5F421} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7F7C07CA-59E5-4055-BAFA-E18FCDD5F421} => Key deleted successfully.
C:\Windows\System32\Tasks\SuperLyrics-16-firefoxinstaller => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SuperLyrics-16-firefoxinstaller => Key deleted successfully.
C:\Windows\Tasks\SuperLyrics-16-chromeinstaller.job => Moved successfully.
C:\Windows\Tasks\SuperLyrics-16-codedownloader.job => Moved successfully.
C:\Windows\Tasks\SuperLyrics-16-firefoxinstaller.job => Moved successfully.
C:\ProgramData\0tbpw.pad => Moved successfully.

==== End of Fixlog ====

hier ist das Ergebnis von Schritt 2
und ein riesen Lob an dich, bis jetzt bekomme sogar ich alles hin ^^ ganz toll beschrieben

HTML-Code:

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.01.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Cindy :: STERNI [Administrator]

Schutz: Aktiviert

01.11.2013 17:18:06
mbam-log-2013-11-01 (17-18-06).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 217941
Laufzeit: 7 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\Software\SuperLyrics-16 (PUP.Optional.SuperLyrics.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 5
C:\Users\Cindy\AppData\Local\Temp\CT3196716 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\CT3284351 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.3.0_0 (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.3.0_0\images (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 33
C:\Users\Cindy\AppData\Local\Temp\D826.tmp (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\7B327C77-BAB0-7891-A3C5-368B1587D1BF\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\7B327C77-BAB0-7891-A3C5-368B1587D1BF\ccp.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\7B327C77-BAB0-7891-A3C5-368B1587D1BF\CrxInstaller.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\7B327C77-BAB0-7891-A3C5-368B1587D1BF\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\A339DA10-BAB0-7891-9DA5-CE9036479ADC\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\A339DA10-BAB0-7891-9DA5-CE9036479ADC\ccp.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\A339DA10-BAB0-7891-9DA5-CE9036479ADC\CrxInstaller.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\A339DA10-BAB0-7891-9DA5-CE9036479ADC\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\ins3544\IminentSetup_2905-512c3791.exe (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\ins3544\LyricsSay_1060-8002_v122.exe (PUP.Optional.AdLyrics) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java(1).exe\e59980c964a443f1b0795d63539154ba\Java(1).exe (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java(1).exe\e59980c964a443f1b0795d63539154ba\parent.txt (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java(1).exe\e59980c964a443f1b0795d63539154ba\software\Dealply.exe (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java(1).exe\e59980c964a443f1b0795d63539154ba\software\deskdl.exe (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java(1).exe\e59980c964a443f1b0795d63539154ba\software\feven-1-5.exe (PUP.Optional.CrossRider) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java.exe\e59980c964a443f1b0795d63539154ba\Java.exe (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java.exe\e59980c964a443f1b0795d63539154ba\parent.txt (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java.exe\e59980c964a443f1b0795d63539154ba\software\deskdl.exe (PUP.Optional.Desk365.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\Java.exe\e59980c964a443f1b0795d63539154ba\software\Superlyrics.exe (PUP.Optional.SuperLyrics) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\Downloads\jZipSetup-r230-n-bf(1).exe (PUP.Optional.Bandoo.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\Downloads\jZipSetup-r230-n-bf.exe (PUP.Optional.Bandoo.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\Downloads\FileConverter.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\Downloads\FreeYouTubeToMP3Converter(2).exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\CT3196716\CT3196716.txt (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\CT3196716\initData.json (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\CT3196716\manifest.json (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Temp\CT3284351\ddt.csf (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.3.0_0\background.js (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.3.0_0\manifest.json (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.3.0_0\images\icon128.png (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.3.0_0\images\icon16.png (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn\3.5.3.0_0\images\icon48.png (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Hab Eset jetzt durchlaufen lassen, hat bei mir fast 5 Stunden gedauert ^^ komme nur ab hier nicht weiter:

Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

...ich finde keine log.txt Datei habe auch alle Dateien vom heutigen Datum raussuchen lassen aber diese war nicht dabei. Kann es daran liegen, das ich kein USB Stick/externe Festplatte zur Hand hatte? Versuche es Morgen nochmal aufs neue...
Übrigens das Problem an sich ist schon gelöst ^^ aslo keine bunten Wörter mehr und so aber hab ja gelesen, dass es damit noch nicht verschwunden sein soll.

Cindy 22 · 04.11.2013, 18:54

Hier folgt nun entlich Schritt 3 ^^ hab es doch noch gefunden

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4fa2093ba163674e815771167dad300b
# engine=15739
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-04 12:56:24
# local_time=2013-11-04 01:56:24 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 95 21969 154241089 14684 0
# compatibility_mode=5892 16776574 100 100 4916727 221102512 0 0
# scanned=184870
# found=1
# cleaned=0
# scan_time=17970
sh=89E8AB79A760BE209DD46BCF5CC484E9909475B4 ft=0 fh=0000000000000000 vn="Win32/Reveton.J trojan" ac=I fn="C:\FRST\Quarantine\ctfmon.lnk"

aharonov · 04.11.2013, 19:23

Prima, dann fehlt nur noch Schritt 4 (frisches FRST-Log).

Cindy 22 · 04.11.2013, 19:38

und hier folgt Schritt 4

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Cindy (administrator) on STERNI on 04-11-2013 18:58:46
Running from C:\Users\Cindy\Pictures
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Norman ASA) C:\Program Files\Norman\Npm\Bin\Elogsvc.exe
(Norman ASA) C:\Program Files\Norman\Ngs\Bin\Nnf.exe
(Norman ASA) C:\Program Files\Norman\Ngs\Bin\Nprosec.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Norman ASA) C:\Program Files\Norman\Npm\Bin\Zanda.exe
(Norman ASA) C:\Program Files\Norman\npm\bin\nvoy.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Norman ASA) C:\Program Files\Norman\Npm\Bin\zlh.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\StCenter.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\FritzDsl.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\system32\IoctlSvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Fujitsu Siemens Computers) C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
(Norman ASA) C:\Program Files\Norman\Npm\Bin\scheduler.exe
(Norman ASA) C:\Program Files\Norman\npc\bin\npcsvc32.exe
(Norman ASA) C:\Program Files\Norman\npc\bin\nuaa.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6144000 2008-05-28] (Realtek Semiconductor)
HKLM\...\Run: [FSCRecovery] - C:\Program Files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe [268096 2008-06-18] (Fujitsu Siemens Computers GmbH)
HKLM\...\Run: [Norman ZANDA] - C:\Program Files\Norman\Npm\Bin\zlh.exe [348560 2012-02-14] (Norman ASA)
HKLM\...\Run: [NPCTray] - C:\Program Files\Norman\Npc\Bin\npc_tray.exe [126008 2007-09-17] (Norman ASA)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE [652624 2007-10-25] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [1603152 2007-09-13] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\...\Run: [SwitchBoard] - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM\...\Run: [OpwareSE2] - C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM\...\Run: [OPSE reminder] - C:\Program Files\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe [729088 2003-07-07] ()
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Skytel] - C:\Windows\SkyTel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe [3077528 2011-06-14] ()
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [Google Update] - C:\Users\Cindy\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-12-19] (Google Inc.)
HKCU\...\Run: [GoogleChromeAutoLaunch_2BFA3B4E2AC391BCB4542950289EF4F3] - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\chrome.exe [844752 2013-10-09] (Google Inc.)
MountPoints2: {6cf6629c-0da8-11e3-a20a-002185fbb3ef} - K:\LGAutoRun.exe
MountPoints2: {8073858b-bc43-11e0-bbfb-002185fbb3ef} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\Start.hta
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Herr Fitzner\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Herr Fitzner\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin
Startup: C:\Users\Cindy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files\FRITZ!DSL\FritzDsl.exe (AVM Berlin)

==================== Internet (Whitelisted) ====================

SearchScopes: HKLM - DefaultScope value is missing.
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Winsock: Catalog9 01 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 02 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 03 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 04 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 05 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 06 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 07 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 08 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 09 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 10 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Winsock: Catalog9 12 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 13 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 14 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 15 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 16 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 17 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 18 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 37 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 38 C:\Program Files\Norman\npc\bin\nlf.dll [306280] (Norman ASA)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Cindy\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Cindy\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\StartWeb.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\trash
FF Extension: DownloadHelper - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: abb - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\abb@amazon.com.xpi
FF Extension: No Name - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Adblock Plus - C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\h1q0v72a.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

Chrome: 
=======
CHR HomePage: hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF
CHR RestoreOnStartup: "hxxp://start.iminent.com/?appId=1D314ED5-C34D-451C-868E-2736A48D2AAF", "hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_sp_OC1"
CHR DefaultSearchURL: (Amazon) - hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p18_serp_cr_de_display?ie=UTF8&tag=bds-p18-serp-de-cr-21&tagbase=bds-p18&tbrId=v1_abb-channel-18_97db0766b9f34132a9e8ef6981bd6c3f_18_38_20130217_DE_cr_ds_OC1&query={searchTerms}
CHR DefaultSuggestURL: (Amazon) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}&output=chrome
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (ProxTube) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.4_0
CHR Extension: (LyricsSay-16) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhhdakpodeopjboaakapkhakhlbmlfd\1.25.17_0
CHR Extension: (Feven 1.5) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg\1.25.48_0
CHR Extension: (YouTube) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Black Rock Shooter Theme2) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\mblhdcamkdmbdepgfenikeaalbnniffk\3_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (Google Wallet) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Cindy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR StartMenuInternet: Google Chrome - C:\Users\Cindy\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 eLoggerSvc6; C:\Program Files\Norman\Npm\Bin\Elogsvc.exe [76232 2011-10-24] (Norman ASA)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [87344 2007-09-04] (AVM Berlin)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)
R2 NNFSVC; C:\Program Files\Norman\Ngs\Bin\Nnf.exe [231216 2011-11-14] (Norman ASA)
R3 Norman NJeeves; C:\Program Files\Norman\Npm\bin\NJEEVES.EXE [116056 2012-02-03] ()
R2 Norman ZANDA; C:\Program Files\Norman\Npm\Bin\Zanda.exe [431320 2012-02-13] (Norman ASA)
R3 NPC; C:\Program Files\Norman\npc\bin\npcsvc32.exe [416880 2008-04-17] (Norman ASA)
R2 NPROSECSVC; C:\Program Files\Norman\Ngs\Bin\Nprosec.exe [90144 2011-09-30] (Norman ASA)
S3 nsesvc; C:\Program Files\Norman\Nse\bin\NSESVC.EXE [310328 2009-05-19] (Norman ASA)
R3 NUAA; C:\Program Files\Norman\npc\bin\nuaa.exe [121912 2009-03-24] (Norman ASA)
S3 nvcoas; C:\Program Files\Norman\Nvc\bin\nvcoas.exe [195640 2009-04-28] (Norman ASA)
R2 NVOY; C:\Program Files\Norman\npm\bin\nvoy.exe [100936 2011-10-19] (Norman ASA)
R3 Scheduler; C:\Program Files\Norman\Npm\Bin\scheduler.exe [99312 2011-04-11] (Norman ASA)
R2 TestHandler; C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [303104 2008-04-25] (Fujitsu Siemens Computers)
S3 NVCScheduler; "C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE" [x]

==================== Drivers (Whitelisted) ====================

S4 ahcix86s; C:\Windows\system32\drivers\ahcix86s.sys [173576 2008-05-27] (AMD Technologies Inc.)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag.sys [23040 2012-03-06] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem.sys [27776 2012-03-06] (LG Electronics Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-09] (Avira Operations GmbH & Co. KG)
S4 JRAID; C:\Windows\system32\drivers\jraid.sys [76688 2008-04-03] (JMicron Technology Corp.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R2 Ndiskio; C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [20448 2007-01-02] (Norman ASA)
R1 NGS; c:\program files\norman\ngs\bin\ngs.sys [26744 2011-07-12] (Norman ASA)
R1 NPROSEC; C:\Program Files\Norman\Ngs\Bin\nprosec.sys [91136 2011-11-11] (Norman ASA)
R2 nregsec; C:\Program Files\Norman\Ngs\Bin\nregsec.sys [61496 2011-11-11] (Norman ASA)
S3 NvcMFlt; C:\Windows\System32\DRIVERS\nvcv32mf.sys [19512 2009-01-22] (Norman ASA)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-09] (Avira GmbH)
S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-04 08:51 - 2013-11-04 14:50 - 104867914 _____ C:\Windows\system32\汕省ᨼ”
2013-11-04 08:50 - 2013-11-04 08:51 - 02347384 _____ (ESET) C:\Users\Cindy\Downloads\esetsmartinstaller_enu(2).exe
2013-11-02 09:30 - 2013-11-02 09:30 - 02347384 _____ (ESET) C:\Users\Cindy\Downloads\esetsmartinstaller_enu(1).exe
2013-11-01 17:54 - 2013-11-01 17:56 - 02347384 _____ (ESET) C:\Users\Cindy\Downloads\esetsmartinstaller_enu.exe
2013-11-01 17:11 - 2013-11-01 17:11 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-01 17:11 - 2013-11-01 17:11 - 00000000 ____D C:\Users\Cindy\AppData\Roaming\Malwarebytes
2013-11-01 17:11 - 2013-11-01 17:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-01 17:11 - 2013-11-01 17:11 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-01 17:11 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-01 16:57 - 2013-11-01 17:03 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Cindy\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-01 12:50 - 2013-11-01 12:50 - 00035036 _____ C:\Users\Cindy\Downloads\FRST.txt
2013-11-01 12:49 - 2013-11-01 12:50 - 00019619 _____ C:\Users\Cindy\Downloads\Addition.txt
2013-11-01 12:48 - 2013-11-01 12:48 - 00000000 ____D C:\FRST
2013-11-01 12:47 - 2013-11-01 12:47 - 01089445 _____ (Farbar) C:\Users\Cindy\Downloads\FRST(1).exe
2013-11-01 12:21 - 2013-11-01 12:24 - 00000000 ____D C:\AdwCleaner
2013-11-01 12:21 - 2013-11-01 12:21 - 01060070 _____ C:\Users\Cindy\Downloads\adwcleaner-3.010.exe
2013-11-01 11:59 - 2013-11-01 12:34 - 00001925 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-01 11:59 - 2013-11-01 12:34 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-01 11:59 - 2013-11-01 11:59 - 00001898 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee
2013-11-01 11:43 - 2013-11-01 11:44 - 01071328 _____ (Solid State Networks) C:\Users\Cindy\Downloads\install_reader10_de_mssa_aaa_aih.exe
2013-10-28 17:18 - 2013-10-28 17:18 - 00000611 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-10-19 15:01 - 2013-11-01 12:23 - 00000000 ____D C:\Program Files\Uniblue
2013-10-13 10:49 - 2013-09-22 11:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-13 10:49 - 2013-09-22 11:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-13 10:49 - 2013-09-22 11:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-13 10:49 - 2013-09-22 11:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-13 10:49 - 2013-09-22 11:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-13 10:49 - 2013-09-22 11:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-13 10:49 - 2013-09-22 11:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-13 10:49 - 2013-09-22 11:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-13 10:49 - 2013-09-22 11:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-13 10:49 - 2013-09-22 11:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-13 10:49 - 2013-09-22 11:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-13 10:49 - 2013-09-22 11:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-13 10:49 - 2013-09-22 11:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-13 10:49 - 2013-09-22 11:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-13 10:49 - 2013-09-22 11:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-13 10:49 - 2013-09-22 10:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-12 15:41 - 2013-08-29 08:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-12 15:41 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-12 15:41 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-12 15:41 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-12 15:41 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-12 15:41 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-12 15:41 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-12 15:41 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-12 15:41 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-12 15:41 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-12 15:41 - 2013-08-01 04:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-12 15:41 - 2013-08-01 03:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-12 15:41 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-12 15:41 - 2013-07-12 10:04 - 00073344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-12 15:41 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-12 15:41 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-12 15:41 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-12 15:41 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-12 15:41 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-12 15:41 - 2013-06-29 03:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-12 15:41 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-12 15:41 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-12 15:41 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-12 15:41 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-12 15:41 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-12 15:41 - 2011-05-05 14:54 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-05 15:32 - 2013-10-19 14:56 - 00000000 ____D C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2013-11-04 18:48 - 2006-11-02 13:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-04 18:48 - 2006-11-02 13:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-04 18:12 - 2012-12-19 14:39 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000UA.job
2013-11-04 18:10 - 2012-10-04 14:31 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-04 14:50 - 2013-11-04 08:51 - 104867914 _____ C:\Windows\system32\汕省ᨼ”
2013-11-04 14:12 - 2012-12-19 14:39 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1541734449-3310273880-3003684764-1000Core.job
2013-11-04 14:11 - 2009-04-03 07:45 - 02074490 _____ C:\Windows\WindowsUpdate.log
2013-11-04 09:19 - 2011-06-14 08:23 - 00000000 ____D C:\Users\Cindy\AppData\Local\PMB Files
2013-11-04 08:55 - 2008-04-09 11:19 - 01568228 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-04 08:51 - 2013-11-04 08:50 - 02347384 _____ (ESET) C:\Users\Cindy\Downloads\esetsmartinstaller_enu(2).exe
2013-11-04 08:48 - 2008-01-21 03:47 - 00229864 _____ C:\Windows\PFRO.log
2013-11-04 08:48 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-02 15:46 - 2006-11-02 14:01 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-02 15:41 - 2006-11-02 12:18 - 00000000 ____D C:\Users\Public
2013-11-02 09:30 - 2013-11-02 09:30 - 02347384 _____ (ESET) C:\Users\Cindy\Downloads\esetsmartinstaller_enu(1).exe
2013-11-01 17:56 - 2013-11-01 17:54 - 02347384 _____ (ESET) C:\Users\Cindy\Downloads\esetsmartinstaller_enu.exe
2013-11-01 17:43 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Branding
2013-11-01 17:11 - 2013-11-01 17:11 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-01 17:11 - 2013-11-01 17:11 - 00000000 ____D C:\Users\Cindy\AppData\Roaming\Malwarebytes
2013-11-01 17:11 - 2013-11-01 17:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-01 17:11 - 2013-11-01 17:11 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-01 17:03 - 2013-11-01 16:57 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Cindy\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-01 12:50 - 2013-11-01 12:50 - 00035036 _____ C:\Users\Cindy\Downloads\FRST.txt
2013-11-01 12:50 - 2013-11-01 12:49 - 00019619 _____ C:\Users\Cindy\Downloads\Addition.txt
2013-11-01 12:48 - 2013-11-01 12:48 - 00000000 ____D C:\FRST
2013-11-01 12:47 - 2013-11-01 12:47 - 01089445 _____ (Farbar) C:\Users\Cindy\Downloads\FRST(1).exe
2013-11-01 12:34 - 2013-11-01 11:59 - 00001925 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-01 12:34 - 2013-11-01 11:59 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-01 12:24 - 2013-11-01 12:21 - 00000000 ____D C:\AdwCleaner
2013-11-01 12:23 - 2013-10-19 15:01 - 00000000 ____D C:\Program Files\Uniblue
2013-11-01 12:23 - 2009-04-06 12:31 - 00000000 ____D C:\ProgramData\ICQ
2013-11-01 12:21 - 2013-11-01 12:21 - 01060070 _____ C:\Users\Cindy\Downloads\adwcleaner-3.010.exe
2013-11-01 11:59 - 2013-11-01 11:59 - 00001898 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-01 11:59 - 2013-11-01 11:59 - 00000000 ____D C:\ProgramData\McAfee
2013-11-01 11:59 - 2009-04-03 08:11 - 00000000 ____D C:\Users\Cindy\AppData\Local\Adobe
2013-11-01 11:58 - 2009-04-03 07:51 - 00000000 ____D C:\ProgramData\Adobe
2013-11-01 11:58 - 2009-04-03 07:51 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-11-01 11:58 - 2009-04-03 07:51 - 00000000 ____D C:\Program Files\Adobe
2013-11-01 11:44 - 2013-11-01 11:43 - 01071328 _____ (Solid State Networks) C:\Users\Cindy\Downloads\install_reader10_de_mssa_aaa_aih.exe
2013-11-01 10:38 - 2011-03-03 10:09 - 00028160 _____ C:\Users\Cindy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-01 10:38 - 2006-11-02 13:52 - 00198123 _____ C:\Windows\setupact.log
2013-11-01 10:37 - 2011-06-30 13:38 - 00000000 ____D C:\Users\Cindy\Desktop\Shadzüü^^
2013-10-28 17:18 - 2013-10-28 17:18 - 00000611 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-10-27 08:55 - 2010-11-01 10:11 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-10-27 08:55 - 2008-08-06 23:08 - 00000000 ____D C:\ProgramData\NVIDIA
2013-10-19 16:04 - 2009-04-03 08:12 - 00070296 _____ C:\Users\Cindy\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-19 16:03 - 2006-11-02 13:47 - 03651120 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-19 16:02 - 2011-07-06 06:55 - 00000000 ____D C:\Program Files\Common Files\Blizzard Entertainment
2013-10-19 15:33 - 2009-04-03 07:59 - 00000000 ____D C:\Program Files\Microsoft Works
2013-10-19 15:33 - 2006-11-02 12:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-10-19 15:28 - 2011-11-01 17:13 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-10-19 15:23 - 2009-04-03 07:59 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-10-19 15:23 - 2009-04-03 07:58 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-19 15:20 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\ShellNew
2013-10-19 14:56 - 2013-10-05 15:32 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-19 13:23 - 2012-02-06 11:23 - 00002048 _____ C:\Users\Cindy\Desktop\Google Chrome.lnk
2013-10-15 10:06 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-13 10:54 - 2013-08-16 08:34 - 00000000 ____D C:\Windows\system32\MRT
2013-10-13 10:52 - 2006-11-02 11:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-12 17:12 - 2012-10-04 14:31 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-12 17:12 - 2011-06-01 11:28 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-08 15:41 - 2012-07-15 12:15 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-05 15:17 - 2013-01-27 12:44 - 00000000 ____D C:\Users\Cindy\Desktop\MUSIC & FILME CID

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.3860.dll


Some content of TEMP:
====================
C:\Users\Cindy\AppData\Local\Temp\AskSLib.dll
C:\Users\Cindy\AppData\Local\Temp\Java(1).exe
C:\Users\Cindy\AppData\Local\Temp\Java.exe
C:\Users\Cindy\AppData\Local\Temp\Quarantine.exe
C:\Users\Herr Fitzner\AppData\Local\Temp\AskSLib.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-04 08:54

==================== End Of Log ============================

--- --- ---

--- --- ---

Ist denn jetzt wieder alles okay soweit?
Noch eine Frage, wenn du erlaubst. Ich habe sicherlich viel unnützen Kram auf dem Rechner der meinen Computer zumüllt und somit verlangsamt...kannst du mir vielleicht sagen welche Programme nutzlos für mich sind und wobei es sich um wichtig oder unwichtiges Zeig handelt?
Ach und ich habe als Schutz Avira ^^ ist das ausreichend oder sollte ich mir noch einen zusätzlichen Schutz zulegen?
(möglichst günstig oder noch besser Umsonst ^^)

aharonov · 04.11.2013, 20:54

Zitat:

kannst du mir vielleicht sagen welche Programme nutzlos für mich sind

Diese Einschätzung kann ich dir nicht abnehmen.

Ich schlage etwas anderes vor: Du listest mir hier alle Programme auf, die du deinstallieren würdest und ich sage dir dann, ob da welche dabei sind, die du nicht löschen darfst. Ok?

Lösche übrigens im Chrome noch die beiden Erweiterung "LyricsSay-16" und "Feven 1.5", so wie hier beschrieben: https://support.google.com/chrome/answer/113907?hl=de

Cindy 22 · 06.11.2013, 16:52

Ja dein Vorschlag ist super ^^
Also, hab jetzt mal wirklich fast alles markiert (rotes Viereck) was ich nicht benutze oder einfach garnicht weiß wobei es sich hier überhaupt handelt. Ich brauche meinen Com auch hauptsächlch zum Filme/Serien schauen und zur Bildbearbeitung, falls das wichtig sein sollte ^^

hxxp://laylameyer.deviantart.com/art/Pp-1-411923344
hxxp://laylameyer.deviantart.com/art/Pp-411923510

Hier sind zwei Screens aber sobald ich die poste wird aus dem hxxp:// ein hxxp??? jedenfalls wenn du das xx in tt umschreibst funktioniert es und du kommst zu den Bildern
Weiß nicht wie man Grfiken hier posten kann...

und ich habe Lyrics Say-16 und Feven 1.5 erfolgreich gelöscht. Danke der super Beschreibung ^^

04.11.2013, 19:23	#5
aharonov /// TB-Ausbilder	Computer läuft langsam und bunt unterstrichene Wörter führen zu Werbung... Prima, dann fehlt nur noch Schritt 4 (frisches FRST-Log). __________________ cheers, Leo

Computer läuft langsam und bunt unterstrichene Wörter führen zu Werbung...

Plagegeister aller Art und deren Bekämpfung: Computer läuft langsam und bunt unterstrichene Wörter führen zu Werbung...