Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 09.11.2013, 22:34   #1
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Ausrufezeichen

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Hallo!
Ich werde nuns chon seit mehreren Wochen durch extrem nervende Werbung in meinem Browser (Firefox aber auch IE und google chrome) geplagt. Es werden automatisch irgendwelche Links in den Webseitentext generiert die vortäuschen sollen sie seien "richtige Links". Überall poppt WErbung auf, wenn ich eine Webseite eingebe, wird oft zusätzlich eine weitere/andere Webseite geöffnet. Alles sehr nervig, ein Arbeiten im browser ist nicht mehr möglich.
Habe gestern versucht mit "Spybot Search and Destroy 2" der Lage Herr zuw erden. Das tool aht auch ne Menge gefunden. Hab zwar auf "Probleme lösen" geklickt und das Tool hat wohl auch, oder zumidnest angezeigt, dass die Probleme behoben wurden.
Hier erstmal das log-file von "Spybot search and destroy" von gestern:

Zitat:
Search results from Spybot - Search & Destroy

11/7/2013 10:43:14 PM
Scan took 00:27:11.
76 items found.

Win32.PrivCnt.a: [SBI $BBD01622] Uninstall settings (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PrivitizeVPN

Win32.PrivCnt.a: [SBI $5C9BCF37] Settings (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\PrivitizeVPN

Win32.PrivCnt.a: [SBI $A213F0F3] Autorun settings (PrivitizeVPN) (Registry Value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PrivitizeVPN

Win32.PrivCnt.a: [SBI $A213F0F3] Program file (File, nothing done)
C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe
Properties.size=196784
Properties.md5=430739F114507DD2EA78D180A34FF9F3
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $35C0A7F1] Library (File, nothing done)
C:\Program Files (x86)\PrivitizeVPN\VPN.dll
Properties.size=175280
Properties.md5=496EE5CF7A13B610D1AC063D556111C4
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $262CA230] Executable (File, nothing done)
C:\Program Files (x86)\PrivitizeVPN\uninstall.exe
Properties.size=50478
Properties.md5=2FBCB1B1D83B379C89E7A23921633173
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $232F1370] Program directory (Directory, nothing done)
C:\Program Files (x86)\PrivitizeVPN\
Directory.subfile=C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe
Directory.subfile.size=196784
Directory.subfile.md5=430739F114507DD2EA78D180A34FF9F3
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03
Directory.subfile=C:\Program Files (x86)\PrivitizeVPN\uninstall.exe
Directory.subfile.size=50478
Directory.subfile.md5=2FBCB1B1D83B379C89E7A23921633173
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03
Directory.subfile=C:\Program Files (x86)\PrivitizeVPN\VPN.dll
Directory.subfile.size=175280
Directory.subfile.md5=496EE5CF7A13B610D1AC063D556111C4
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $2989A40E] Link (File, nothing done)
C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\PrivitizeVPN.lnk
Properties.size=1193
Properties.md5=837597DB292FEFFD594F14D61DE21F7D
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $E91A94E5] Link (File, nothing done)
C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\Uninstall PrivitizeVPN.lnk
Properties.size=1178
Properties.md5=5914DF9E322B707954A78763F1C9F9E3
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $B675C276] Program directory (Directory, nothing done)
C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\
Directory.subfile=C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\PrivitizeVPN.lnk
Directory.subfile.size=1193
Directory.subfile.md5=837597DB292FEFFD594F14D61DE21F7D
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03
Directory.subfile=C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\Uninstall PrivitizeVPN.lnk
Directory.subfile.size=1178
Directory.subfile.md5=5914DF9E322B707954A78763F1C9F9E3
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03

Barowwsoe2Save: [SBI $EBFF04E2] Executable (File, nothing done)
C:\ProgramData\InstallMate\{1A0D908A-C61D-42F5-A01E-8E3FC1EEB27C}\Setup.exe
Properties.size=15968
Properties.md5=98B03BEF5A2808C5EFA2A0D2430144DE
Properties.filedate=1360019977
Properties.filedatetext=2013-02-05 00:19:36

Barowwsoe2Save: [SBI $F0D49796] Program directory (Directory, nothing done)
C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\20130406234450.log
Directory.subfile.size=281101
Directory.subfile.md5=CF1EA15AC9C8D8DB5F9E6D1C6FDC4460
Directory.subfile.filedate=1365284762
Directory.subfile.filedatetext=2013-04-06 22:46:01
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Readme.txt
Directory.subfile.size=1854
Directory.subfile.md5=B846D99A841254958E9A7A6EF6761F63
Directory.subfile.filedate=1358351340
Directory.subfile.filedatetext=2013-01-16 16:48:59
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Setup.dat
Directory.subfile.size=504315
Directory.subfile.md5=450257BD1C72BB06A267342C2C4B2DE3
Directory.subfile.filedate=1365284762
Directory.subfile.filedatetext=2013-04-06 22:46:01
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Setup.exe
Directory.subfile.size=15528
Directory.subfile.md5=DF81BE0582A7F860EEFFDB0A86DEDF73
Directory.subfile.filedate=1354237755
Directory.subfile.filedatetext=2012-11-30 02:09:14
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Setup.ico
Directory.subfile.size=4846
Directory.subfile.md5=C3926CEF276C0940DADBC8142153CEC9
Directory.subfile.filedate=1344477418
Directory.subfile.filedatetext=2012-08-09 02:56:57
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\TsuDll.dll
Directory.subfile.size=273576
Directory.subfile.md5=D1DDD2BED23DD1E6A70855F5F7BA3E7B
Directory.subfile.filedate=1354237782
Directory.subfile.filedatetext=2012-11-30 02:09:42
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\_Setup.dll
Directory.subfile.size=227840
Directory.subfile.md5=27331DF658C661FEDF7F98404A45CAAF
Directory.subfile.filedate=1358351340
Directory.subfile.filedatetext=2013-01-16 16:48:59
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\_Setupx.dll
Directory.subfile.size=54272
Directory.subfile.md5=CE3B67E5923E1BC427E541B2A0A53CB4
Directory.subfile.filedate=1357740718
Directory.subfile.filedatetext=2013-01-09 15:11:57

Barowwsoe2Save: [SBI $ACCD80B7] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Barowwsoe2Save: [SBI $ACCD80B7] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Barowwsoe2Save: [SBI $092123B5] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}

Barowwsoe2Save: [SBI $092123B5] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}

Barowwsoe2Save: [SBI $284E9FC1] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Barowwsoe2Save: [SBI $284E9FC1] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Montera.Toolbar: [SBI $C595B0E4] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Montera.Toolbar: [SBI $C595B0E4] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Montera.Toolbar: [SBI $2212EF94] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\escort.DLL

Montera.Toolbar: [SBI $2212EF94] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\escort.DLL

Montera.Toolbar: [SBI $95EF920F] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{1ACB5ABE-4890-4747-952C-F13BDB93FB75}

Montera.Toolbar: [SBI $B0CF2619] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{B25AEDC4-8086-41E3-8349-328223FA9FCB}

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane.1

Montera.Toolbar: [SBI $07586C96] Class ID (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B25AEDC4-8086-41E3-8349-328223FA9FCB}

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane.1

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr.1

Montera.Toolbar: [SBI $4826EB6C] Class ID (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ACB5ABE-4890-4747-952C-F13BDB93FB75}

Montera.Toolbar: [SBI $4826EB6C] Browser helper object (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ACB5ABE-4890-4747-952C-F13BDB93FB75}

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr.1

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr

SafeSaver.BHO: [SBI $75D1178A] Settings (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\SProtector

Searchdwebs: [SBI $AE5F9040] User settings (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\AppDataLow\SProtector

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Viktoria\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\UA7ZBZ2M\www.puls4.com\analytics.sol
Properties.size=419
Properties.md5=E5BD0C6024561F7D4D6005488DE8D037
Properties.filedate=1383857942
Properties.filedatetext=2013-11-07 21:59:02

DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows.OpenWith: [SBI $CDE7D0A6] Open with list - .ASX extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ASX\OpenWithList

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $691C1B44] Open with list - .BIN extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BIN\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $9E8D5C8A] Open with list - .CDA extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList

Windows.OpenWith: [SBI $ECC28BDF] Open with list - .CSV extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CSV\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cache: [SBI $49804B54] Browser: Cache (8) (Browser: Cache, nothing done)


Verlauf: [SBI $49804B54] Browser: History (6) (Browser: History, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (417) (Browser: Cookie, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (2) (Browser: Cookie, nothing done)



--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---

2013-09-20 blindman.exe (2.2.18.151)
2013-09-20 explorer.exe (2.2.18.177)
2013-09-20 SDBootCD.exe (2.2.18.109)
2013-09-20 SDCleaner.exe (2.2.18.110)
2013-09-20 SDDelFile.exe (2.2.18.94)
2013-06-18 SDDisableProxy.exe
2013-09-20 SDFiles.exe (2.2.18.135)
2013-09-20 SDFileScanHelper.exe (2.2.16.1)
2013-10-15 SDFSSvc.exe (2.2.25.211)
2013-10-10 SDHookHelper.exe (2.3.30.2)
2013-10-10 SDHookInst32.exe (2.3.30.2)
2013-10-10 SDHookInst64.exe (2.3.30.2)
2013-09-20 SDImmunize.exe (2.2.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-10-14 SDOnAccess.exe (2.2.25.4)
2013-09-20 SDPESetup.exe (2.2.18.3)
2013-09-20 SDPEStart.exe (2.2.18.86)
2013-09-20 SDPhoneScan.exe (2.2.18.28)
2013-09-20 SDPRE.exe (2.2.18.22)
2013-09-20 SDPrepPos.exe (2.2.18.10)
2013-09-20 SDQuarantine.exe (2.2.18.103)
2013-09-20 SDRootAlyzer.exe (2.2.18.116)
2013-09-20 SDSBIEdit.exe (2.2.18.39)
2013-09-20 SDScan.exe (2.2.18.177)
2013-09-20 SDScript.exe (2.2.18.53)
2013-10-15 SDSettings.exe (2.2.25.138)
2013-09-20 SDShell.exe (2.2.18.2)
2013-09-20 SDShred.exe (2.2.18.107)
2013-09-20 SDSysRepair.exe (2.2.18.101)
2013-09-20 SDTools.exe (2.2.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-09-20 SDUpdate.exe (2.2.18.91)
2013-09-20 SDUpdSvc.exe (2.2.18.76)
2013-09-20 SDWelcome.exe (2.2.21.129)
2013-09-13 SDWSCSvc.exe (2.2.22.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-11-07 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-10-14 SDFileScanLibrary.dll (2.2.25.14)
2013-10-10 SDHook32.dll (2.3.30.2)
2013-10-10 SDHook64.dll (2.3.30.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2013-11-06 Includes\Adware.sbi (*)
2013-11-06 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-10-16 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2013-10-29 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-11-06 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-10-22 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2013-10-29 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-11-06 Includes\TrojansC-03.sbi (*)
2013-10-22 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)
Hier die Logfiles von euren Tools die ihr haben wollt:
Avira Antivirus Premium hat am 9 Sept. 2013 schonmal 10 Viren gefunden und entfernt. Hier der Log
Zitat:
Search results from Spybot - Search & Destroy

11/7/2013 10:43:14 PM
Scan took 00:27:11.
76 items found.

Win32.PrivCnt.a: [SBI $BBD01622] Uninstall settings (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PrivitizeVPN

Win32.PrivCnt.a: [SBI $5C9BCF37] Settings (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\PrivitizeVPN

Win32.PrivCnt.a: [SBI $A213F0F3] Autorun settings (PrivitizeVPN) (Registry Value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PrivitizeVPN

Win32.PrivCnt.a: [SBI $A213F0F3] Program file (File, nothing done)
C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe
Properties.size=196784
Properties.md5=430739F114507DD2EA78D180A34FF9F3
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $35C0A7F1] Library (File, nothing done)
C:\Program Files (x86)\PrivitizeVPN\VPN.dll
Properties.size=175280
Properties.md5=496EE5CF7A13B610D1AC063D556111C4
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $262CA230] Executable (File, nothing done)
C:\Program Files (x86)\PrivitizeVPN\uninstall.exe
Properties.size=50478
Properties.md5=2FBCB1B1D83B379C89E7A23921633173
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $232F1370] Program directory (Directory, nothing done)
C:\Program Files (x86)\PrivitizeVPN\
Directory.subfile=C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe
Directory.subfile.size=196784
Directory.subfile.md5=430739F114507DD2EA78D180A34FF9F3
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03
Directory.subfile=C:\Program Files (x86)\PrivitizeVPN\uninstall.exe
Directory.subfile.size=50478
Directory.subfile.md5=2FBCB1B1D83B379C89E7A23921633173
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03
Directory.subfile=C:\Program Files (x86)\PrivitizeVPN\VPN.dll
Directory.subfile.size=175280
Directory.subfile.md5=496EE5CF7A13B610D1AC063D556111C4
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $2989A40E] Link (File, nothing done)
C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\PrivitizeVPN.lnk
Properties.size=1193
Properties.md5=837597DB292FEFFD594F14D61DE21F7D
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $E91A94E5] Link (File, nothing done)
C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\Uninstall PrivitizeVPN.lnk
Properties.size=1178
Properties.md5=5914DF9E322B707954A78763F1C9F9E3
Properties.filedate=1365284763
Properties.filedatetext=2013-04-06 22:46:03

Win32.PrivCnt.a: [SBI $B675C276] Program directory (Directory, nothing done)
C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\
Directory.subfile=C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\PrivitizeVPN.lnk
Directory.subfile.size=1193
Directory.subfile.md5=837597DB292FEFFD594F14D61DE21F7D
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03
Directory.subfile=C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivitizeVPN\Uninstall PrivitizeVPN.lnk
Directory.subfile.size=1178
Directory.subfile.md5=5914DF9E322B707954A78763F1C9F9E3
Directory.subfile.filedate=1365284763
Directory.subfile.filedatetext=2013-04-06 22:46:03

Barowwsoe2Save: [SBI $EBFF04E2] Executable (File, nothing done)
C:\ProgramData\InstallMate\{1A0D908A-C61D-42F5-A01E-8E3FC1EEB27C}\Setup.exe
Properties.size=15968
Properties.md5=98B03BEF5A2808C5EFA2A0D2430144DE
Properties.filedate=1360019977
Properties.filedatetext=2013-02-05 00:19:36

Barowwsoe2Save: [SBI $F0D49796] Program directory (Directory, nothing done)
C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\20130406234450.log
Directory.subfile.size=281101
Directory.subfile.md5=CF1EA15AC9C8D8DB5F9E6D1C6FDC4460
Directory.subfile.filedate=1365284762
Directory.subfile.filedatetext=2013-04-06 22:46:01
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Readme.txt
Directory.subfile.size=1854
Directory.subfile.md5=B846D99A841254958E9A7A6EF6761F63
Directory.subfile.filedate=1358351340
Directory.subfile.filedatetext=2013-01-16 16:48:59
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Setup.dat
Directory.subfile.size=504315
Directory.subfile.md5=450257BD1C72BB06A267342C2C4B2DE3
Directory.subfile.filedate=1365284762
Directory.subfile.filedatetext=2013-04-06 22:46:01
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Setup.exe
Directory.subfile.size=15528
Directory.subfile.md5=DF81BE0582A7F860EEFFDB0A86DEDF73
Directory.subfile.filedate=1354237755
Directory.subfile.filedatetext=2012-11-30 02:09:14
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\Setup.ico
Directory.subfile.size=4846
Directory.subfile.md5=C3926CEF276C0940DADBC8142153CEC9
Directory.subfile.filedate=1344477418
Directory.subfile.filedatetext=2012-08-09 02:56:57
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\TsuDll.dll
Directory.subfile.size=273576
Directory.subfile.md5=D1DDD2BED23DD1E6A70855F5F7BA3E7B
Directory.subfile.filedate=1354237782
Directory.subfile.filedatetext=2012-11-30 02:09:42
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\_Setup.dll
Directory.subfile.size=227840
Directory.subfile.md5=27331DF658C661FEDF7F98404A45CAAF
Directory.subfile.filedate=1358351340
Directory.subfile.filedatetext=2013-01-16 16:48:59
Directory.subfile=C:\ProgramData\InstallMate\{E9EB6F50-268A-49B8-AB53-6EA832084DA6}\_Setupx.dll
Directory.subfile.size=54272
Directory.subfile.md5=CE3B67E5923E1BC427E541B2A0A53CB4
Directory.subfile.filedate=1357740718
Directory.subfile.filedatetext=2013-01-09 15:11:57

Barowwsoe2Save: [SBI $ACCD80B7] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Barowwsoe2Save: [SBI $ACCD80B7] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}

Barowwsoe2Save: [SBI $092123B5] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}

Barowwsoe2Save: [SBI $092123B5] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}

Barowwsoe2Save: [SBI $284E9FC1] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Barowwsoe2Save: [SBI $284E9FC1] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Montera.Toolbar: [SBI $C595B0E4] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Montera.Toolbar: [SBI $C595B0E4] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Montera.Toolbar: [SBI $2212EF94] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\escort.DLL

Montera.Toolbar: [SBI $2212EF94] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\AppID\escort.DLL

Montera.Toolbar: [SBI $95EF920F] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{1ACB5ABE-4890-4747-952C-F13BDB93FB75}

Montera.Toolbar: [SBI $B0CF2619] Settings (Registry Key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{B25AEDC4-8086-41E3-8349-328223FA9FCB}

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane.1

Montera.Toolbar: [SBI $07586C96] Class ID (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B25AEDC4-8086-41E3-8349-328223FA9FCB}

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane.1

Montera.Toolbar: [SBI $07586C96] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\escort.escortIEPane

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr.1

Montera.Toolbar: [SBI $4826EB6C] Class ID (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ACB5ABE-4890-4747-952C-F13BDB93FB75}

Montera.Toolbar: [SBI $4826EB6C] Browser helper object (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ACB5ABE-4890-4747-952C-F13BDB93FB75}

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr.1

Montera.Toolbar: [SBI $4826EB6C] Root class (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\privitize.privitizeHlpr

SafeSaver.BHO: [SBI $75D1178A] Settings (Registry Key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\SProtector

Searchdwebs: [SBI $AE5F9040] User settings (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\AppDataLow\SProtector

Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Viktoria\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\UA7ZBZ2M\www.puls4.com\analytics.sol
Properties.size=419
Properties.md5=E5BD0C6024561F7D4D6005488DE8D037
Properties.filedate=1383857942
Properties.filedatetext=2013-11-07 21:59:02

DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Viktoria (default)) (Browser: Cookie, nothing done)


Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\MediaPlayer\Player\Settings\Client ID

MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows.OpenWith: [SBI $CDE7D0A6] Open with list - .ASX extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ASX\OpenWithList

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows.OpenWith: [SBI $691C1B44] Open with list - .BIN extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BIN\OpenWithList

Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList

Windows.OpenWith: [SBI $9E8D5C8A] Open with list - .CDA extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList

Windows.OpenWith: [SBI $ECC28BDF] Open with list - .CSV extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CSV\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Cache: [SBI $49804B54] Browser: Cache (8) (Browser: Cache, nothing done)


Verlauf: [SBI $49804B54] Browser: History (6) (Browser: History, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (417) (Browser: Cookie, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (2) (Browser: Cookie, nothing done)



--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---

2013-09-20 blindman.exe (2.2.18.151)
2013-09-20 explorer.exe (2.2.18.177)
2013-09-20 SDBootCD.exe (2.2.18.109)
2013-09-20 SDCleaner.exe (2.2.18.110)
2013-09-20 SDDelFile.exe (2.2.18.94)
2013-06-18 SDDisableProxy.exe
2013-09-20 SDFiles.exe (2.2.18.135)
2013-09-20 SDFileScanHelper.exe (2.2.16.1)
2013-10-15 SDFSSvc.exe (2.2.25.211)
2013-10-10 SDHookHelper.exe (2.3.30.2)
2013-10-10 SDHookInst32.exe (2.3.30.2)
2013-10-10 SDHookInst64.exe (2.3.30.2)
2013-09-20 SDImmunize.exe (2.2.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-10-14 SDOnAccess.exe (2.2.25.4)
2013-09-20 SDPESetup.exe (2.2.18.3)
2013-09-20 SDPEStart.exe (2.2.18.86)
2013-09-20 SDPhoneScan.exe (2.2.18.28)
2013-09-20 SDPRE.exe (2.2.18.22)
2013-09-20 SDPrepPos.exe (2.2.18.10)
2013-09-20 SDQuarantine.exe (2.2.18.103)
2013-09-20 SDRootAlyzer.exe (2.2.18.116)
2013-09-20 SDSBIEdit.exe (2.2.18.39)
2013-09-20 SDScan.exe (2.2.18.177)
2013-09-20 SDScript.exe (2.2.18.53)
2013-10-15 SDSettings.exe (2.2.25.138)
2013-09-20 SDShell.exe (2.2.18.2)
2013-09-20 SDShred.exe (2.2.18.107)
2013-09-20 SDSysRepair.exe (2.2.18.101)
2013-09-20 SDTools.exe (2.2.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-09-20 SDUpdate.exe (2.2.18.91)
2013-09-20 SDUpdSvc.exe (2.2.18.76)
2013-09-20 SDWelcome.exe (2.2.21.129)
2013-09-13 SDWSCSvc.exe (2.2.22.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-11-07 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-10-14 SDFileScanLibrary.dll (2.2.25.14)
2013-10-10 SDHook32.dll (2.3.30.2)
2013-10-10 SDHook64.dll (2.3.30.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2013-11-06 Includes\Adware.sbi (*)
2013-11-06 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-10-16 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2013-10-29 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-11-06 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-10-22 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2013-10-29 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-11-06 Includes\TrojansC-03.sbi (*)
2013-10-22 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)
so, hier nun eure logs von den tools die ihr im tutorial empfehlt von heute:


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Viktoria (administrator) on SOKRATES on 09-11-2013 22:00:33
Running from C:\Users\Viktoria\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(IDT, Inc.) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe
(Hewlett-Packard) C:\windows\system32\Hpservice.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Development Company, L.P) c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Hewlett-Packard Company) c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\windows\system32\lxdxcoms.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Hewlett-Packard, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender_gui.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\Hp.SkyRoom.Windows.RgsPlugin.Authentication.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\Hp.SkyRoom.Windows.RgsPlugin.Lens.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\Hp.SkyRoom.Windows.RgsPlugin.Licensing.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
() C:\Users\Viktoria\Desktop\Defogger.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2010-04-05] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1861416 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [nwiz] - nwiz.exe /installquiet
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\ScCertProp: C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-29] (Samsung Electronics Co., Ltd.)
HKCU\...\CurrentVersion\Windows: [Load] C:\Users\Viktoria\AppData\Local\Temp\{57926~1.EXE <===== ATTENTION
MountPoints2: {1bfe2d8c-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {1bfe2dd1-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {315e6ab0-3acb-11e1-af40-70f395957183} - D:\Startme.exe
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2009-11-04] ()
HKLM-x32\...\Run: [NPSStartup] - [x]
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160 2011-04-14] (Apple Inc.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-09-14] (RealNetworks, Inc.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
AppInit_DLLs-x32: c:\progra~2\magnipic\sprote~1.dll [1046528 2013-01-24] ()
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4
SearchScopes: HKLM - DefaultScope {C6842AF5-081F-4A21-AD5F-53CCFB0B7100} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {C6842AF5-081F-4A21-AD5F-53CCFB0B7100} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {BA052AC4-62C7-4E47-BC68-5A7ADDCEF266} URL = hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75&r=4
SearchScopes: HKCU - {BA052AC4-62C7-4E47-BC68-5A7ADDCEF266} URL = hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75&r=4
BHO: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: MaggnnIIPic - {97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE} - C:\ProgramData\MaggnnIIPic\51609fcddcc55.dll ()
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default
FF user.js: detected! => C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\user.js
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF Homepage: www.orf.at
FF Keyword.URL: user_pref("keyword.URL", "");
FF NetworkProxy: "type", 0
FF DefaultSearchEngine: LEO Eng-Deu
FF SelectedSearchEngine: LEO Eng-Deu
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\searchplugins\privitize.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MaggnnIIPic - C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\Extensions\k_enl@rsbpt.com
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

Chrome: 
=======
CHR RestoreOnStartup: ""
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (RealDownloader) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.3_0
CHR Extension: (Skype Click to Call) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [948296 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2010-01-22] (DigitalPersona, Inc.)
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-01-12] (Hewlett-Packard Development Company, L.P)
R2 Hp.Skyroom.Windows.Service; C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [124984 2009-11-20] (Hewlett-Packard)
R2 lxdx_device; C:\windows\system32\lxdxcoms.exe [1044648 2008-02-28] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 rgsender; c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [379904 2009-11-19] (Hewlett-Packard, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.)
S2 AviraUpgradeService; "C:\windows\TEMP\AVSETUP_5072a145\avupgsvc.exe" /TEMPSTART:""C:\windows\TEMP\AVSETUP_5072a145\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE"

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1805104 2009-09-18] ()
U3 ugddypob; \??\C:\Users\Viktoria\AppData\Local\Temp\ugddypob.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-09 21:52 - 2013-11-09 21:57 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-08 10:46 - 2013-11-08 10:46 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-08 10:31 - 2013-11-08 11:14 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-07 22:13 - 2013-11-07 22:44 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:13 - 2013-11-07 22:14 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:13 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-09 09:55 - 00001035 _____ C:\windows\setupact.log
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-10-30 19:47 - 2013-10-31 08:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 19:12 - 2013-11-07 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-30 18:45 - 2013-10-30 18:47 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 11:50 - 2013-10-25 12:59 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 11:31 - 2013-10-25 12:44 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 11:11 - 2013-10-25 12:26 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:34 - 2013-10-23 13:37 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-10 11:09 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2013-10-10 09:38 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-10-10 09:38 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-10-10 09:38 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-10-10 09:38 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-10-10 09:38 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-10-10 09:38 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-10-10 09:38 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-10-10 09:38 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-10-10 09:38 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-10-10 09:38 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-10 09:21 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-10-10 09:21 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-10-10 09:21 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
2013-10-10 09:21 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mswsock.dll
2013-10-10 09:21 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-10-10 09:21 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-10-10 09:21 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2013-10-10 09:21 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-10-10 09:21 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2013-10-10 09:21 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-10-10 09:21 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-10-10 09:21 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-10-10 09:21 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll
2013-10-10 09:21 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-10-10 09:21 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2013-10-10 09:21 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-10-10 09:21 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-10-10 09:21 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-10-10 09:21 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-10-10 09:21 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-10-10 09:21 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\windows\system32\scavengeui.dll
2013-10-10 09:21 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2013-10-10 09:21 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 09:21 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 09:21 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbvideo.sys
2013-10-10 09:21 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbcir.sys
2013-10-10 09:21 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBAUDIO.sys
2013-10-10 09:21 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2013-10-10 09:21 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\comctl32.dll
2013-10-10 09:21 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll
2013-10-10 09:21 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll
2013-10-10 09:21 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll
2013-10-10 09:21 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\windows\SysWOW64\comctl32.dll
2013-10-10 09:21 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2013-10-10 09:21 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidclass.sys
2013-10-10 09:21 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidparse.sys
2013-10-10 09:21 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Wdf01000.sys
2013-10-10 09:21 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2013-10-10 09:21 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2013-10-10 09:21 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2013-10-10 09:21 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2013-10-10 09:21 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2013-10-10 09:21 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2013-10-10 09:21 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2013-10-10 09:21 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2013-10-10 09:21 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2013-10-10 09:21 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll

==================== One Month Modified Files and Folders =======

2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:59 - 2010-10-25 18:07 - 00000000 ____D C:\Users\Viktoria
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:57 - 2013-11-09 21:52 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-09 21:52 - 2012-12-06 15:11 - 00000000 ____D C:\Users\Viktoria\Desktop\VL Räume, Texte, Subjekte
2013-11-09 21:48 - 2010-10-13 19:39 - 01674671 _____ C:\windows\WindowsUpdate.log
2013-11-09 21:28 - 2013-01-03 10:07 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-09 21:14 - 2010-12-28 20:53 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-09 10:04 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-09 10:04 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-09 09:57 - 2012-01-11 23:58 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Dropbox
2013-11-09 09:57 - 2010-10-13 18:01 - 00000000 ____D C:\ProgramData\HPQLOG
2013-11-09 09:56 - 2012-01-12 00:04 - 00000000 ___RD C:\Users\Viktoria\Dropbox
2013-11-09 09:55 - 2013-11-07 21:00 - 00001035 _____ C:\windows\setupact.log
2013-11-09 09:55 - 2010-12-28 20:53 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-09 09:55 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-08 21:32 - 2013-09-14 14:26 - 00003346 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 21:32 - 2013-09-14 14:26 - 00003218 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 21:25 - 2010-10-25 18:57 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Skype
2013-11-08 17:03 - 2010-10-13 18:01 - 00659842 _____ C:\windows\system32\perfh007.dat
2013-11-08 17:03 - 2010-10-13 18:01 - 00131942 _____ C:\windows\system32\perfc007.dat
2013-11-08 17:03 - 2009-07-14 06:13 - 01507502 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-08 11:34 - 2010-10-25 18:57 - 00000000 ____D C:\ProgramData\Skype
2013-11-08 11:14 - 2013-11-08 10:31 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-08 10:46 - 2013-11-08 10:46 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-08 10:46 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2013-11-07 22:44 - 2013-11-07 22:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:44 - 2013-04-06 22:44 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-07 22:14 - 2013-11-07 22:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:30 - 2012-05-16 22:00 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\BitTorrent
2013-11-07 16:30 - 2011-04-09 10:09 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Winamp
2013-11-07 16:29 - 2010-12-18 17:25 - 00000000 ____D C:\windows\Minidump
2013-11-07 16:29 - 2009-07-27 16:04 - 00000000 ____D C:\windows\Panther
2013-11-07 16:28 - 2013-10-30 19:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 16:25 - 2010-12-28 20:53 - 00002259 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-11-06 13:25 - 2010-11-01 08:20 - 00000000 ____D C:\Users\Viktoria\Desktop\IE
2013-11-04 10:28 - 2010-11-22 21:43 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-11-02 12:54 - 2012-05-06 16:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-31 08:10 - 2013-10-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 18:47 - 2013-10-30 18:45 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 12:59 - 2013-10-25 11:50 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 12:44 - 2013-10-25 11:31 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 12:26 - 2013-10-25 11:11 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:37 - 2013-10-23 13:34 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-22 10:00 - 2010-10-28 09:32 - 00001931 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-20 16:38 - 2010-10-25 18:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-19 18:02 - 2013-03-28 14:39 - 00000000 ____D C:\Users\Viktoria\Desktop\Filme
2013-10-17 12:23 - 2009-07-14 06:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-10-16 18:55 - 2010-10-26 02:56 - 00000000 ____D C:\windows\rescache
2013-10-14 22:09 - 2010-12-28 20:53 - 00004110 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-14 22:09 - 2010-12-28 20:53 - 00003858 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-11 13:54 - 2010-10-25 19:04 - 00000000 ____D C:\Users\Viktoria\AppData\Local\Thunderbird
2013-10-10 10:27 - 2009-07-14 05:45 - 00441264 _____ C:\windows\system32\FNTCACHE.DAT
2013-10-10 10:23 - 2012-05-13 07:26 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-10 10:23 - 2012-05-13 07:26 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-10 09:42 - 2011-10-22 22:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 09:32 - 2013-07-15 16:35 - 00000000 ____D C:\windows\system32\MRT
2013-10-10 09:29 - 2012-12-04 11:37 - 80541720 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-10-10 09:28 - 2013-10-09 20:28 - 17813896 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2013-10-10 09:28 - 2013-01-03 10:07 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-10-10 09:28 - 2013-01-03 10:07 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-10-10 09:28 - 2011-11-30 00:10 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Viktoria\AppData\Local\Temp\avgnt.exe
C:\Users\Viktoria\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-31 08:51

==================== End Of Log ============================
         
--- --- ---


to be continued....

Geändert von viktoria28 (09.11.2013 um 22:40 Uhr)

Alt 09.11.2013, 22:40   #2
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



so, und weiter gehts....


Zitat:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013
Ran by Viktoria at 2013-11-09 22:02:14
Running from C:\Users\Viktoria\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

toolbar on IE and Chrome (x32 Version: 1.8.16.22)
ABBYY FineReader 6.0 Sprint (x32 Version: 6.00.2201.41622)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AIMP2 (x32)
Apple Application Support (x32 Version: 2.3)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (x32 Version: 2.1.3.127)
Audacity 1.2.6 (x32)
Audacity Recovery Utility (x32)
Avira Antivirus Premium (x32 Version: 14.0.0.383)
BitTorrent (x32 Version: 7.8.0.29463)
Bonjour (Version: 2.0.5.0)
CCleaner (Version: 4.07)
Cisco AnyConnect VPN Client (x32 Version: 2.5.0217)
Citavi (x32 Version: 3.3.0.0)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dropbox (HKCU Version: 2.0.22)
EasyBits GO (HKCU)
FreeMind (x32 Version: 0.9.0)
GIMP 2.6.11 (x32 Version: 2.6.11)
Google Chrome (x32 Version: 30.0.1599.101)
Google Drive (x32 Version: 1.12.5329.1887)
Google Update Helper (x32 Version: 1.3.21.165)
HP 3D DriveGuard (Version: 4.0.4.1)
HP Business Card Reader (x32 Version: 0.6.3.0)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3)
HP Documentation (x32 Version: 1.1.0.0)
HP ESU for Microsoft Windows 7 (x32 Version: 1.0.5.1)
HP Integrated Module with Bluetooth wireless technology (Version: 6.2.1.500)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Officejet Pro 8500 A910 Hilfe (x32 Version: 140.0.2.2)
HP Power Assistant (Version: 1.0.2.4)
HP Power Data (Version: 1.0.5.74)
HP ProtectTools Security Manager (Version: 5.04.669)
HP Quick Launch Buttons (x32 Version: 6.50.12.1)
HP QuickLook (Version: 3.3.1.4)
HP QuickWeb (x32 Version: 1.0.1.48)
HP Setup (x32 Version: 1.2.3557.3169)
HP SkyRoom (x32 Version: 1.1.4.4794.)
HP SoftPaq Download Manager (x32 Version: 3.0.5.0)
HP Software Framework (x32 Version: 4.0.112.1)
HP Software Setup (x32 Version: 7.0.1.5)
HP Support Assistant (x32 Version: 4.4.6.3)
HP Update (x32 Version: 5.002.006.003)
HP Wallpaper (x32 Version: 1.0.1.3)
HP Web Camera (Version: 1.0.0)
HP Webcam (x32 Version: 1.0)
HP Webcam Driver (x32 Version: 5.8.50009.1)
HP Wireless Assistant (Version: 4.0.2.4)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2)
I.R.I.S. OCR (x32 Version: 12.3.4.0)
IDT Audio (x32 Version: 1.0.6257.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Network Connections Drivers (Version: 14.8)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.02.00.1002)
Intel® Matrix Storage Manager
iTunes (Version: 10.2.2.12)
Java 7 Update 25 (x32 Version: 7.0.250)
Java 7 Update 45 (64-bit) (Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 6 Update 23 (x32 Version: 6.0.230)
LSI HDA Modem (Version: 2.2.97)
MagniPic (Version: 1.0)
McAfee Security Scan Plus (Version: 3.8.130.8)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 24.1.0)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
NVIDIA Drivers (Version: 1.10)
NVIDIA nView Desktop Manager (Version: 6.14.10.12133)
Pre-Boot Security for HP ProtectTools (Version: 5.0.7.1)
QLBCASL (x32 Version: 6.40.17.2)
QuickTime (x32 Version: 7.73.80.64)
RealDownloader (x32 Version: 1.3.3)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.3)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Remote Graphics Receiver (x32 Version: 5.3.2)
Remote Graphics Sender (x32 Version: 5.3.2)
RICOH Media Driver (x32 Version: 2.13.00.05)
Samsung Mobile phone USB driver Drive Software
Samsung New PC Studio (x32 Version: 1.00.0000)
Samsung New PC Studio USB Driver Installer (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Skype Click to Call (x32 Version: 5.6.8442)
Skype™ 6.10 (x32 Version: 6.10.104)
Sony Ericsson Update Engine (x32 Version: 2.12.15.18)
Sony PC Companion 2.10.165 (x32 Version: 2.10.165)
Spybot - Search & Destroy (x32 Version: 2.2.25)
Synaptics Pointing Device Driver (Version: 14.0.10.0)
Theft Recovery (x32 Version: 5.1.0.18)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
UploadTool is a program which uploads pictures to the well known me-on.net service. (x32 Version: 3.0.7)
Validity Fingerprint Driver (Version: 4.0.8.0)
VLC media player 1.1.10 (x32 Version: 1.1.10)
Winamp (x32 Version: 5.61 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
Windows 7 Default Setting (x32 Version: 1.0.1.4)
Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (Version: 06/15/2009 6.2.0.9000)
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (Version: 07/30/2009 6.2.0.9405)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR 4.20 (32-bit) (x32 Version: 4.20.0)

==================== Restore Points =========================

28-10-2013 10:42:35 Geplanter Prüfpunkt
02-11-2013 12:34:55 HPSF Restore Point
07-11-2013 21:02:38 Installed Java 7 Update 45 (64-bit)

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {08546823-5010-4705-BD12-7CD55EE37284} - System32\Tasks\{CFF73398-BD5D-4118-8FDC-D9799FD0D35D} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-10-21] (Skype Technologies S.A.)
Task: {0B4B6899-1E3B-461B-8676-B67E7D157F4D} - System32\Tasks\Installation App Launcher => C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe
Task: {34DDB2A7-D033-4A92-9537-A739363B3479} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {453839BE-4941-40FA-8471-82C8CE0B43D0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {5DD7F667-C549-4811-B912-FAC95F4F312F} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {6368D4F2-6790-4FE2-B443-F95CC476E895} - System32\Tasks\{4D7C8BA2-77A4-425D-A715-2F5BAD15A3E5} => Firefox.exe hxxp://ui.skype.com/ui/0/5.1.0.104/de/privacy
Task: {6AAF69DC-AD4E-4BC6-82A2-BFC0689768C6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {7053C7C8-415F-4D38-8C03-FEFBBC6F7633} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {81CE45E9-AF49-485F-8B63-C28127621D50} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-03-24] (Hewlett-Packard)
Task: {88DD4252-376D-4A86-93B7-379E675753E5} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-03-24] (Hewlett-Packard)
Task: {958777C0-01A2-40CC-B232-43B5A3886EE4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9D3BE14E-9682-4787-A889-91211B83B9BC} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {9DFAF9E5-73D7-43DD-810D-A4807E21DFD4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-10-22] (Microsoft)
Task: {ABC91409-D6E1-4263-9EF4-1BF29A745499} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {B7734EB8-FCA7-4104-B066-F42150056A0D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BE4F24DB-2A15-4786-AC8E-ABFA4015AC34} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-28] (Google Inc.)
Task: {D72CEFB5-B842-4C79-8DD5-A33895676144} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {E093552B-C2B8-4F2B-BEE2-4B3395324995} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {EE400641-0326-4954-A1FA-D3CBDAD76537} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {F5950434-834D-4237-B6DA-FCABB1BBAB84} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-28] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-03-16 23:07 - 2011-03-16 23:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2009-09-04 21:35 - 2009-09-04 21:35 - 00173344 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2009-11-19 23:14 - 2009-11-19 23:14 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2009-11-19 23:14 - 2009-11-19 23:14 - 00055352 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2009-11-19 23:11 - 2009-11-19 23:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2009-11-19 23:11 - 2009-11-19 23:11 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2012-12-04 15:31 - 2012-12-04 15:28 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-03-13 21:48 - 2013-03-13 21:48 - 24978944 _____ () C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\libcef.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 01249280 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\ice32.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00159744 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\iceutil32.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00065536 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\bzip2.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00167936 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\IceSSL32.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-11-07 22:13 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-11-07 22:13 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2010-10-13 19:55 - 2009-07-24 20:10 - 02199552 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtCore4.dll
2010-10-13 19:55 - 2009-07-24 20:10 - 08024064 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtGui4.dll
2010-10-13 19:55 - 2008-01-09 19:08 - 01245184 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\ice32.dll
2010-10-13 19:55 - 2008-01-09 19:10 - 00159744 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\iceutil32.dll
2010-10-13 19:55 - 2008-01-09 19:06 - 00065536 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\bzip2.dll
2010-10-13 19:55 - 2008-01-09 19:10 - 00167936 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\IceSSL32.dll
2013-11-07 22:13 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\IceSSL32.dll
2013-11-07 22:13 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-11-07 22:13 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-01-24 12:58 - 2013-01-24 12:58 - 01046528 _____ () C:\Program Files (x86)\MagniPic\sprotector.dll
2013-10-30 19:12 - 2013-10-30 19:12 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-03-16 23:11 - 2011-03-16 23:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-10-10 09:28 - 2013-10-10 09:28 - 16233864 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Viktoria\Desktop\Bix_das_Gaensebluemchen.wmv:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/09/2013 06:12:06 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (11/09/2013 04:27:51 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (11/09/2013 09:55:31 AM) (Source: Validity USDK) (User: )
Description: Sensor device initialization failed: State:0x00000005 Status:0x00000004.

Error: (11/08/2013 07:55:47 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: DpHostW.exe, Version: 5.0.4.527, Zeitstempel: 0x4b5a0cca
Name des fehlerhaften Moduls: vcsAPIShared.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4adfaa61
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000003865ce2
ID des fehlerhaften Prozesses: 0x6c0
Startzeit der fehlerhaften Anwendung: 0xDpHostW.exe0
Pfad der fehlerhaften Anwendung: DpHostW.exe1
Pfad des fehlerhaften Moduls: DpHostW.exe2
Berichtskennung: DpHostW.exe3

Error: (11/08/2013 04:59:25 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (11/07/2013 10:57:31 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 25.0.0.5046, Zeitstempel: 0x526b1e27
Name des fehlerhaften Moduls: xul.dll, Version: 25.0.0.5046, Zeitstempel: 0x526b1d27
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001157e7
ID des fehlerhaften Prozesses: 0x1b20
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)


System errors:
=============
Error: (11/09/2013 09:57:10 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/09/2013 09:57:10 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Email Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%0

Error: (11/09/2013 09:57:10 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%0

Error: (11/09/2013 09:56:53 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5

Error: (11/09/2013 09:56:50 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5

Error: (11/09/2013 09:56:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/09/2013 09:56:38 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (11/09/2013 09:56:37 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/09/2013 09:56:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "rixdpcie" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1058

Error: (11/09/2013 09:56:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Ricoh xD-Picture Card Driver" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1058


Microsoft Office Sessions:
=========================
Error: (11/09/2013 06:12:06 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2

Error: (11/09/2013 04:27:51 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2

Error: (11/09/2013 09:55:31 AM) (Source: Validity USDK)(User: )
Description: State:0x00000005 Status:0x00000004

Error: (11/08/2013 07:55:47 PM) (Source: Application Error)(User: )
Description: DpHostW.exe5.0.4.5274b5a0ccavcsAPIShared.dll_unloaded0.0.0.04adfaa61c00000050000000003865ce26c001cedc697c0bd24ac:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exevcsAPIShared.dll6041a449-48a7-11e3-96d7-70f395957183

Error: (11/08/2013 04:59:25 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2

Error: (11/07/2013 10:57:31 PM) (Source: Application Error)(User: )
Description: firefox.exe25.0.0.5046526b1e27xul.dll25.0.0.5046526b1d27c0000005001157e71b2001cedc031e92aa6fC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll9907108c-47f7-11e3-b461-70f395957183

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung


Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (11/07/2013 09:01:21 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer


==================== Memory info ===========================

Percentage of memory in use: 61%
Total physical RAM: 3953.8 MB
Available physical RAM: 1502.46 MB
Total Pagefile: 7905.79 MB
Available Pagefile: 4647 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:448.46 GB) (Free:82.75 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F34E6CC3)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=448 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End Of Log ============================
und hier noch das logfile von Gmer:

Zitat:
GMER Logfile:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-09 22:13:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950042 rev.0006 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Viktoria\AppData\Local\Temp\ugddypob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                             fffff800037fe000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                             fffff800037fe02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe[2756] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 69                        0000000074d41465 2 bytes [D4, 74]
.text     C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe[2756] C:\windows\syswow64\Psapi.dll!GetModuleInformation + 155                       0000000074d414bb 2 bytes [D4, 74]
.text     ...                                                                                                                                            * 2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3472] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                   0000000074d41465 2 bytes [D4, 74]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3472] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  0000000074d414bb 2 bytes [D4, 74]
.text     ...                                                                                                                                            * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000074d41465 2 bytes [D4, 74]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000074d414bb 2 bytes [D4, 74]
.text     ...                                                                                                                                            * 2
.text     C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[4296] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000074d41465 2 bytes [D4, 74]
.text     C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[4296] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 0000000074d414bb 2 bytes [D4, 74]
.text     ...                                                                                                                                            * 2
.text     C:\Users\Viktoria\Desktop\Defogger.exe[2688] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                           0000000074d41465 2 bytes [D4, 74]
.text     C:\Users\Viktoria\Desktop\Defogger.exe[2688] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                          0000000074d414bb 2 bytes [D4, 74]
.text     ...                                                                                                                                            * 2
.text     C:\program files (x86)\avira\antivir desktop\avcenter.exe[10288] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000074d41465 2 bytes [D4, 74]
.text     C:\program files (x86)\avira\antivir desktop\avcenter.exe[10288] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      0000000074d414bb 2 bytes [D4, 74]
.text     ...                                                                                                                                            * 2

---- Threads - GMER 2.1 ----

Thread    C:\windows\System32\spoolsv.exe [1616:2580]                                                                                                    0000000051073290
Thread    C:\windows\System32\spoolsv.exe [1616:2716]                                                                                                    000007fef77910c8
Thread    C:\windows\System32\spoolsv.exe [1616:2720]                                                                                                    000007fef7766144
Thread    C:\windows\System32\spoolsv.exe [1616:2724]                                                                                                    000007fef8775fd0
Thread    C:\windows\System32\spoolsv.exe [1616:2728]                                                                                                    000007fef7743438
Thread    C:\windows\System32\spoolsv.exe [1616:2732]                                                                                                    000007fef87763ec
Thread    C:\windows\System32\spoolsv.exe [1616:2736]                                                                                                    000007fef7743438
Thread    C:\windows\System32\spoolsv.exe [1616:2740]                                                                                                    000007fef87763ec
Thread    C:\windows\System32\spoolsv.exe [1616:2748]                                                                                                    000007fef84e5e5c
Thread    C:\windows\system32\svchost.exe [5204:5452]                                                                                                    000007feeae02f9c
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5980:6484]                                                                                 000007fefb062a7c
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5980:6516]                                                                                 000007fee813d618

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\70f395957183                                                                    
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\70f395957183@3039261376e4                                                       0x91 0x32 0x07 0xF4 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\70f395957183 (not active ControlSet)                                                
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\70f395957183@3039261376e4                                                           0x91 0x32 0x07 0xF4 ...

---- EOF - GMER 2.1 ----
         
--- --- ---
So, ich hoffe ich hab nix vergessen und alles richtig gemacht. Hoffentlich könnt ihr mir helfen. Ich wäre euch endlos dankbar!

lg
Viki
__________________


Alt 10.11.2013, 02:38   #3
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Hallo und

Windows Professional und MS-Office Profesional, ist das ein gewerblich genutzter Rechner?
__________________
__________________

Alt 10.11.2013, 10:55   #4
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Hallo.
der computer wird privat genützt. ich bin studentin und habe windows office (studentenangebot), den pc (mit windows 7 prof, elitebook hp ) bei einem angebot der Uni Wien gekauft.

Ich hoffe das reicht euch als antwort?

lg
viki

Alt 10.11.2013, 16:39   #5
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Ok, danke für die Erklärung

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 11.11.2013, 10:24   #6
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



hallo,
ich habe alles so gemacht wie beschrieben. 1 Malware wurde gefunden. mir ist noch aufgefallen, dass Avira nach dem cleanup prozess einen registry-zugriff verhindert hat (war wohl von mbar).
hab den suchlauf dann nochmal wiederholt, ohne internetverbindung und ohne aktiven virenschutz.
mbar hat dann jedoch nichts mehr gefunden. die links im browser und die werbung sind derzeit immer noch da.

hier der log:

Zitat:
Malwarebytes Anti-Rootkit BETA 1.07.0.1007
www.malwarebytes.org

Database version: v2013.11.11.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
Viktoria :: SOKRATES [administrator]

11.11.2013 09:26:46
mbar-log-2013-11-11 (09-26-46).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 249383
Time elapsed: 21 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|Load (PUM.UserWLoad) -> Data: C:\Users\Viktoria\AppData\Local\Temp\{57926~1.EXE -> Delete on reboot.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
lg
viktoria

der anschließende neustart hat etwas länger gedauert, da war ein dos-fenster mit system32 irgendwas. - wurde aber nicht von mbar angefordert. hab selbständig neu gestartet.

links und werbung sind immer noch im browser.
ich weiß, wir sind noch nciht fertig, wollte euch nur alles dokumentieren. ;-)

lg
viktoria

Alt 11.11.2013, 12:15   #7
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Avira bitte deaktivieren, MBAR erneut starten und scannen lassen
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 11.11.2013, 17:35   #8
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



habe Avira deaktiviert und MBAR erneut scannen lassen. das ergebnis ist dasselbe:

Malwarebytes Anti-Rootkit BETA 1.07.0.1007
Malwarebytes : Free Anti-Malware download

Database version: v2013.10.02.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
Viktoria :: SOKRATES [administrator]

11.11.2013 16:32:53
mbar-log-2013-11-11 (16-32-53).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 244707
Time elapsed: 17 minute(s), 38 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Alt 11.11.2013, 22:05   #9
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Logs bitte in CODE-Tags posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.



Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 15.11.2013, 11:12   #10
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



danke.
hier mal die log-datei von adwcelaner:

AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.012 - Bericht erstellt am 15/11/2013 um 10:27:11
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Viktoria - SOKRATES
# Gestartet von : C:\Users\Viktoria\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\clsoft ltd
Ordner Gelöscht : C:\ProgramData\MaggnnIIPic
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaggnnIIPic
Ordner Gelöscht : C:\Program Files (x86)\Industriya
Ordner Gelöscht : C:\Program Files (x86)\MagniPic
Ordner Gelöscht : C:\Users\Viktoria\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Viktoria\AppData\Roaming\Industriya
Ordner Gelöscht : C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\Extensions\k_enl@rsbpt.com
Datei Gelöscht : C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_008a99b9
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freemind_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freemind_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\PrivitizeVPNInstallDates
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKLM\Software\SP Global
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EB03EF39-C655-D560-FA95-79182B837D64}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16736


-\\ Mozilla Firefox v25.0 (de)

[ Datei : C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\prefs.js ]

Zeile gelöscht : user_pref("aol_toolbar.default.homepage.check", false);
Zeile gelöscht : user_pref("aol_toolbar.default.search.check", false);
Zeile gelöscht : user_pref("extensions.51609fcddcb57.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};(function(){if(window.self==window.top&&!document.getElementById('shk85shs[...]
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Zeile gelöscht : user_pref("extensions.privitize.srchPrvdr", "Search The Web (privitize)");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v31.0.1650.48

[ Datei : C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [5823 octets] - [15/11/2013 10:25:29]
AdwCleaner[S0].txt - [5474 octets] - [15/11/2013 10:27:11]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5534 octets] ##########
         
--- --- ---

so, nun hier das log von junkware removal tool:

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Professional x64
Ran by Viktoria on 15.11.2013 at 10:34:09,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BA052AC4-62C7-4E47-BC68-5A7ADDCEF266}



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\Users\Viktoria\AppData\Roaming\mozilla\firefox\profiles\whqhf9c7.default\searchplugins\privitize.xml
Successfully deleted the following from C:\Users\Viktoria\AppData\Roaming\mozilla\firefox\profiles\whqhf9c7.default\prefs.js

user_pref("extensions.privitize.admin", false);
user_pref("extensions.privitize.aflt", "orgnl");
user_pref("extensions.privitize.appId", "{301966DF-A84B-4255-AAB9-574B5CE237E4}");
user_pref("extensions.privitize.autoRvrt", "false");
user_pref("extensions.privitize.dfltLng", "");
user_pref("extensions.privitize.dfltSrch", true);
user_pref("extensions.privitize.dnsErr", true);
user_pref("extensions.privitize.excTlbr", true);
user_pref("extensions.privitize.ffxUnstlRst", false);
user_pref("extensions.privitize.hmpg", true);
user_pref("extensions.privitize.hmpgUrl", "hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.hpOld0", "www.orf.at");
user_pref("extensions.privitize.id", "0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.instlDay", "15801");
user_pref("extensions.privitize.instlRef", "");
user_pref("extensions.privitize.kw_url", "hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.newTab", true);
user_pref("extensions.privitize.newTabUrl", "hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.prdct", "privitize");
user_pref("extensions.privitize.prtnrId", "privitize");
user_pref("extensions.privitize.rvrt", "false");
user_pref("extensions.privitize.smplGrp", "none");
user_pref("extensions.privitize.tlbrId", "base");
user_pref("extensions.privitize.tlbrSrchUrl", "hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75&q=");
user_pref("extensions.privitize.vrsn", "1.8.16.22");
user_pref("extensions.privitize.vrsnTs", "1.8.16.2223:44:40");
user_pref("extensions.privitize.vrsni", "1.8.16.22");
Emptied folder: C:\Users\Viktoria\AppData\Roaming\mozilla\firefox\profiles\whqhf9c7.default\minidumps [197 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.11.2013 at 10:39:52,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
so, hier der FRST-log


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Viktoria (administrator) on SOKRATES on 15-11-2013 10:56:39
Running from C:\Users\Viktoria\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(IDT, Inc.) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe
(Hewlett-Packard) C:\windows\system32\Hpservice.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Development Company, L.P) c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe
(Hewlett-Packard Company) c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\windows\system32\lxdxcoms.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Hewlett-Packard, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\Hp.SkyRoom.Windows.RgsPlugin.Authentication.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\Hp.SkyRoom.Windows.RgsPlugin.Lens.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\Hp.SkyRoom.Windows.RgsPlugin.Licensing.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender_gui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2010-04-05] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1861416 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [nwiz] - nwiz.exe /installquiet
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\ScCertProp: C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-29] (Samsung Electronics Co., Ltd.)
MountPoints2: {1bfe2d8c-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {1bfe2dd1-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {315e6ab0-3acb-11e1-af40-70f395957183} - D:\Startme.exe
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2009-11-04] ()
HKLM-x32\...\Run: [NPSStartup] - [x]
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160 2011-04-14] (Apple Inc.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-09-14] (RealNetworks, Inc.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN AT: Hotmail, Outlook, Messenger, Skype, Unterhaltung, Nachrichten & Lifestyle
SearchScopes: HKLM - DefaultScope {C6842AF5-081F-4A21-AD5F-53CCFB0B7100} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF ProfilePath: C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF Homepage: news.ORF.at
FF Keyword.URL: user_pref("keyword.URL", "");
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

Chrome: 
=======
CHR RestoreOnStartup: ""
CHR DefaultSearchURL: (Search The Web (privitize)) - hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75
CHR DefaultSuggestURL: (Search The Web (privitize)) -       "suggest_url": "",
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (RealDownloader) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.3_0
CHR Extension: (Skype Click to Call) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [948296 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2010-01-22] (DigitalPersona, Inc.)
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-01-12] (Hewlett-Packard Development Company, L.P)
R2 Hp.Skyroom.Windows.Service; C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [124984 2009-11-20] (Hewlett-Packard)
R2 lxdx_device; C:\windows\system32\lxdxcoms.exe [1044648 2008-02-28] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 rgsender; c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [379904 2009-11-19] (Hewlett-Packard, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.)
S2 AviraUpgradeService; "C:\windows\TEMP\AVSETUP_5072a145\avupgsvc.exe" /TEMPSTART:""C:\windows\TEMP\AVSETUP_5072a145\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE"

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1805104 2009-09-18] ()

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-15 10:39 - 2013-11-15 10:39 - 00003713 _____ C:\Users\Viktoria\Desktop\JRT.txt
2013-11-15 10:34 - 2013-11-15 10:34 - 00000000 ____D C:\windows\ERUNT
2013-11-15 10:32 - 2013-11-15 10:32 - 01034531 _____ (Thisisu) C:\Users\Viktoria\Desktop\JRT.exe
2013-11-15 10:25 - 2013-11-15 10:27 - 00000000 ____D C:\AdwCleaner
2013-11-15 10:24 - 2013-11-15 10:24 - 01085542 _____ C:\Users\Viktoria\Desktop\adwcleaner.exe
2013-11-14 16:40 - 2013-11-14 16:40 - 00816288 _____ C:\windows\Minidump\111413-30108-01.dmp
2013-11-14 13:30 - 2013-11-14 13:30 - 00000000 ____D C:\Users\Viktoria\Desktop\Blumfeld Media
2013-11-14 00:32 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-14 00:32 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-14 00:32 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-14 00:32 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-11-14 00:32 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-14 00:32 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-11-14 00:32 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-11-14 00:32 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-11-14 00:32 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-11-14 00:32 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-13 18:16 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll
2013-11-13 18:16 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2013-11-13 18:16 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL
2013-11-13 18:16 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll
2013-11-13 18:16 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 18:16 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-11-13 18:16 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-11-13 18:16 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll
2013-11-13 18:16 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll
2013-11-13 18:16 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-11-13 18:16 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 18:16 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-11-13 18:16 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll
2013-11-13 18:16 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2013-11-13 18:16 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2013-11-13 18:16 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-11-13 18:16 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2013-11-13 18:16 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2013-11-13 18:16 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2013-11-13 18:16 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2013-11-13 18:16 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2013-11-13 18:16 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2013-11-13 18:16 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2013-11-13 18:16 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2013-11-13 18:16 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2013-11-13 18:16 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2013-11-13 18:16 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2013-11-13 18:16 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2013-11-13 18:16 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2013-11-13 18:16 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2013-11-11 17:31 - 2013-11-11 17:31 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-11 16:23 - 2013-11-14 16:40 - 526569088 _____ C:\windows\MEMORY.DMP
2013-11-11 16:23 - 2013-11-11 16:23 - 00294232 _____ C:\windows\Minidump\111113-25428-01.dmp
2013-11-11 09:26 - 2013-11-11 17:29 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-11 09:26 - 2013-11-11 17:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-11 09:26 - 2013-11-11 09:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 09:25 - 2013-11-11 17:29 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-11-11 09:24 - 2013-11-11 17:30 - 00000000 ____D C:\Users\Viktoria\Desktop\mbar
2013-11-11 09:22 - 2013-11-11 09:22 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Viktoria\Desktop\mbar-1.07.0.1007.exe
2013-11-09 22:16 - 2013-11-07 22:43 - 00020185 _____ C:\Users\Viktoria\Desktop\Checks.131107-2243.txt
2013-11-09 22:13 - 2013-11-09 22:13 - 00006821 _____ C:\Users\Viktoria\Desktop\Gmer.log
2013-11-09 22:02 - 2013-11-09 22:03 - 00031225 _____ C:\Users\Viktoria\Desktop\Addition.txt
2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-09 21:52 - 2013-11-11 09:23 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-08 10:31 - 2013-11-08 11:14 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-07 22:13 - 2013-11-07 22:44 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:13 - 2013-11-07 22:14 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:13 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-15 10:28 - 00001819 _____ C:\windows\setupact.log
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-10-30 19:47 - 2013-10-31 08:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 19:12 - 2013-11-07 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-30 18:45 - 2013-10-30 18:47 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 11:50 - 2013-10-25 12:59 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 11:31 - 2013-10-25 12:44 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 11:11 - 2013-10-25 12:26 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:34 - 2013-10-23 13:37 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan

==================== One Month Modified Files and Folders =======

2013-11-15 10:39 - 2013-11-15 10:39 - 00003713 _____ C:\Users\Viktoria\Desktop\JRT.txt
2013-11-15 10:36 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-15 10:36 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-15 10:34 - 2013-11-15 10:34 - 00000000 ____D C:\windows\ERUNT
2013-11-15 10:33 - 2010-10-13 19:39 - 01966749 _____ C:\windows\WindowsUpdate.log
2013-11-15 10:32 - 2013-11-15 10:32 - 01034531 _____ (Thisisu) C:\Users\Viktoria\Desktop\JRT.exe
2013-11-15 10:30 - 2012-01-12 00:04 - 00000000 ___RD C:\Users\Viktoria\Dropbox
2013-11-15 10:30 - 2012-01-11 23:58 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Dropbox
2013-11-15 10:29 - 2010-12-28 20:53 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-15 10:29 - 2010-10-13 18:01 - 00000000 ____D C:\ProgramData\HPQLOG
2013-11-15 10:28 - 2013-11-07 21:00 - 00001819 _____ C:\windows\setupact.log
2013-11-15 10:28 - 2013-01-03 10:07 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-15 10:28 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-15 10:27 - 2013-11-15 10:25 - 00000000 ____D C:\AdwCleaner
2013-11-15 10:24 - 2013-11-15 10:24 - 01085542 _____ C:\Users\Viktoria\Desktop\adwcleaner.exe
2013-11-14 19:14 - 2010-12-28 20:53 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-14 16:40 - 2013-11-14 16:40 - 00816288 _____ C:\windows\Minidump\111413-30108-01.dmp
2013-11-14 16:40 - 2013-11-11 16:23 - 526569088 _____ C:\windows\MEMORY.DMP
2013-11-14 16:40 - 2010-12-18 17:25 - 00000000 ____D C:\windows\Minidump
2013-11-14 13:30 - 2013-11-14 13:30 - 00000000 ____D C:\Users\Viktoria\Desktop\Blumfeld Media
2013-11-14 09:42 - 2010-10-13 18:01 - 00659842 _____ C:\windows\system32\perfh007.dat
2013-11-14 09:42 - 2010-10-13 18:01 - 00131942 _____ C:\windows\system32\perfc007.dat
2013-11-14 09:42 - 2009-07-14 06:13 - 01507502 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-14 09:36 - 2009-07-27 16:04 - 00000000 ____D C:\windows\Panther
2013-11-14 00:33 - 2011-10-22 22:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 00:31 - 2013-07-15 16:35 - 00000000 ____D C:\windows\system32\MRT
2013-11-14 00:29 - 2012-12-04 11:37 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-11-14 00:20 - 2010-10-25 18:57 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Skype
2013-11-12 23:40 - 2012-12-06 15:11 - 00000000 ____D C:\Users\Viktoria\Desktop\VL Räume, Texte, Subjekte
2013-11-12 20:28 - 2010-12-28 20:53 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-12 11:54 - 2013-03-25 13:51 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-11-12 11:54 - 2013-03-25 13:51 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-11-11 17:31 - 2013-11-11 17:31 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-11 17:30 - 2013-11-11 09:24 - 00000000 ____D C:\Users\Viktoria\Desktop\mbar
2013-11-11 17:29 - 2013-11-11 09:26 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-11 17:29 - 2013-11-11 09:26 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-11 17:29 - 2013-11-11 09:25 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-11-11 16:23 - 2013-11-11 16:23 - 00294232 _____ C:\windows\Minidump\111113-25428-01.dmp
2013-11-11 10:08 - 2010-11-22 21:43 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-11-11 09:26 - 2013-11-11 09:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 09:23 - 2013-11-09 21:52 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-11 09:22 - 2013-11-11 09:22 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Viktoria\Desktop\mbar-1.07.0.1007.exe
2013-11-09 22:13 - 2013-11-09 22:13 - 00006821 _____ C:\Users\Viktoria\Desktop\Gmer.log
2013-11-09 22:03 - 2013-11-09 22:02 - 00031225 _____ C:\Users\Viktoria\Desktop\Addition.txt
2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:59 - 2010-10-25 18:07 - 00000000 ____D C:\Users\Viktoria
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-08 21:32 - 2013-09-14 14:26 - 00003346 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 21:32 - 2013-09-14 14:26 - 00003218 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 11:34 - 2010-10-25 18:57 - 00000000 ____D C:\ProgramData\Skype
2013-11-08 11:14 - 2013-11-08 10:31 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-08 10:46 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2013-11-07 22:44 - 2013-11-07 22:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:44 - 2013-04-06 22:44 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-07 22:43 - 2013-11-09 22:16 - 00020185 _____ C:\Users\Viktoria\Desktop\Checks.131107-2243.txt
2013-11-07 22:14 - 2013-11-07 22:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:30 - 2012-05-16 22:00 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\BitTorrent
2013-11-07 16:30 - 2011-04-09 10:09 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Winamp
2013-11-07 16:28 - 2013-10-30 19:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-11-06 13:25 - 2010-11-01 08:20 - 00000000 ____D C:\Users\Viktoria\Desktop\IE
2013-11-02 12:54 - 2012-05-06 16:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-31 08:10 - 2013-10-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 18:47 - 2013-10-30 18:45 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 12:59 - 2013-10-25 11:50 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 12:44 - 2013-10-25 11:31 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 12:26 - 2013-10-25 11:11 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:37 - 2013-10-23 13:34 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-22 10:00 - 2010-10-28 09:32 - 00001931 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-20 16:38 - 2010-10-25 18:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-19 18:02 - 2013-03-28 14:39 - 00000000 ____D C:\Users\Viktoria\Desktop\Filme
2013-10-17 12:23 - 2009-07-14 06:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-10-16 18:55 - 2010-10-26 02:56 - 00000000 ____D C:\windows\rescache

Some content of TEMP:
====================
C:\Users\Viktoria\AppData\Local\Temp\avgnt.exe
C:\Users\Viktoria\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Viktoria\AppData\Local\Temp\Quarantine.exe
C:\Users\Viktoria\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-10 15:45

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

und hier noch zu guter letzt die addition.txt:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013
Ran by Viktoria at 2013-11-15 11:10:16
Running from C:\Users\Viktoria\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

 toolbar  on IE and Chrome (x32 Version: 1.8.16.22)
ABBYY FineReader 6.0 Sprint (x32 Version: 6.00.2201.41622)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AIMP2 (x32)
Apple Application Support (x32 Version: 2.3)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (x32 Version: 2.1.3.127)
Audacity 1.2.6 (x32)
Audacity Recovery Utility (x32)
Avira Antivirus Premium (x32 Version: 14.0.1.719)
BitTorrent (x32 Version: 7.8.0.29463)
Bonjour (Version: 2.0.5.0)
CCleaner (Version: 4.07)
Cisco AnyConnect VPN Client (x32 Version: 2.5.0217)
Citavi (x32 Version: 3.3.0.0)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dropbox (HKCU Version: 2.0.22)
EasyBits GO (HKCU)
FreeMind (x32 Version: 0.9.0)
GIMP 2.6.11 (x32 Version: 2.6.11)
Google Chrome (x32 Version: 31.0.1650.48)
Google Drive (x32 Version: 1.12.5329.1887)
Google Update Helper (x32 Version: 1.3.21.165)
HP 3D DriveGuard (Version: 4.0.4.1)
HP Business Card Reader (x32 Version: 0.6.3.0)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3)
HP Documentation (x32 Version: 1.1.0.0)
HP ESU for Microsoft Windows 7 (x32 Version: 1.0.5.1)
HP Integrated Module with Bluetooth wireless technology (Version: 6.2.1.500)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Officejet Pro 8500 A910 Hilfe (x32 Version: 140.0.2.2)
HP Power Assistant (Version: 1.0.2.4)
HP Power Data (Version: 1.0.5.74)
HP ProtectTools Security Manager (Version: 5.04.669)
HP Quick Launch Buttons (x32 Version: 6.50.12.1)
HP QuickLook (Version: 3.3.1.4)
HP QuickWeb (x32 Version: 1.0.1.48)
HP Setup (x32 Version: 1.2.3557.3169)
HP SkyRoom (x32 Version: 1.1.4.4794.)
HP SoftPaq Download Manager (x32 Version: 3.0.5.0)
HP Software Framework (x32 Version: 4.0.112.1)
HP Software Setup (x32 Version: 7.0.1.5)
HP Support Assistant (x32 Version: 4.4.6.3)
HP Update (x32 Version: 5.002.006.003)
HP Wallpaper (x32 Version: 1.0.1.3)
HP Web Camera (Version: 1.0.0)
HP Webcam (x32 Version: 1.0)
HP Webcam Driver (x32 Version: 5.8.50009.1)
HP Wireless Assistant (Version: 4.0.2.4)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2)
I.R.I.S. OCR (x32 Version: 12.3.4.0)
IDT Audio (x32 Version: 1.0.6257.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Network Connections Drivers (Version: 14.8)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.02.00.1002)
Intel® Matrix Storage Manager
iTunes (Version: 10.2.2.12)
Java 7 Update 25 (x32 Version: 7.0.250)
Java 7 Update 45 (64-bit) (Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 6 Update 23 (x32 Version: 6.0.230)
LSI HDA Modem (Version: 2.2.97)
MagniPic (Version: 1.0)
McAfee Security Scan Plus (Version: 3.8.130.8)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 24.1.0)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
NVIDIA Drivers (Version: 1.10)
NVIDIA nView Desktop Manager (Version: 6.14.10.12133)
Pre-Boot Security for HP ProtectTools (Version: 5.0.7.1)
QLBCASL (x32 Version: 6.40.17.2)
QuickTime (x32 Version: 7.73.80.64)
RealDownloader (x32 Version: 1.3.3)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.3)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Remote Graphics Receiver (x32 Version: 5.3.2)
Remote Graphics Sender (x32 Version: 5.3.2)
RICOH Media Driver (x32 Version: 2.13.00.05)
Samsung Mobile phone USB driver Drive Software
Samsung New PC Studio (x32 Version: 1.00.0000)
Samsung New PC Studio USB Driver Installer (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Skype Click to Call (x32 Version: 5.6.8442)
Skype™ 6.10 (x32 Version: 6.10.104)
Sony Ericsson Update Engine (x32 Version: 2.12.15.18)
Sony PC Companion 2.10.165 (x32 Version: 2.10.165)
Spybot - Search & Destroy (x32 Version: 2.2.25)
Synaptics Pointing Device Driver (Version: 14.0.10.0)
Theft Recovery (x32 Version: 5.1.0.18)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
UploadTool is a program which uploads pictures to the well known me-on.net service. (x32 Version: 3.0.7)
Validity Fingerprint Driver (Version: 4.0.8.0)
VLC media player 1.1.10 (x32 Version: 1.1.10)
Winamp (x32 Version: 5.61 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
Windows 7 Default Setting (x32 Version: 1.0.1.4)
Windows Driver Package - Broadcom Bluetooth  (06/15/2009 6.2.0.9000) (Version: 06/15/2009 6.2.0.9000)
Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405) (Version: 07/30/2009 6.2.0.9405)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR 4.20 (32-bit) (x32 Version: 4.20.0)

==================== Restore Points  =========================

07-11-2013 21:02:38 Installed Java 7 Update 45 (64-bit)
11-11-2013 08:48:33 Malwarebytes Anti-Rootkit Restore Point
13-11-2013 23:27:33 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {08546823-5010-4705-BD12-7CD55EE37284} - System32\Tasks\{CFF73398-BD5D-4118-8FDC-D9799FD0D35D} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-10-21] (Skype Technologies S.A.)
Task: {0B4B6899-1E3B-461B-8676-B67E7D157F4D} - System32\Tasks\Installation App Launcher => C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe
Task: {34DDB2A7-D033-4A92-9537-A739363B3479} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {453839BE-4941-40FA-8471-82C8CE0B43D0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {5DD7F667-C549-4811-B912-FAC95F4F312F} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {6368D4F2-6790-4FE2-B443-F95CC476E895} - System32\Tasks\{4D7C8BA2-77A4-425D-A715-2F5BAD15A3E5} => Firefox.exe Skype Privacy Policy
Task: {6AAF69DC-AD4E-4BC6-82A2-BFC0689768C6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {7053C7C8-415F-4D38-8C03-FEFBBC6F7633} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {81CE45E9-AF49-485F-8B63-C28127621D50} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-03-24] (Hewlett-Packard)
Task: {88DD4252-376D-4A86-93B7-379E675753E5} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-03-24] (Hewlett-Packard)
Task: {958777C0-01A2-40CC-B232-43B5A3886EE4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9D3BE14E-9682-4787-A889-91211B83B9BC} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {9DFAF9E5-73D7-43DD-810D-A4807E21DFD4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-10-22] (Microsoft)
Task: {ABC91409-D6E1-4263-9EF4-1BF29A745499} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {B7734EB8-FCA7-4104-B066-F42150056A0D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BE4F24DB-2A15-4786-AC8E-ABFA4015AC34} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-28] (Google Inc.)
Task: {D72CEFB5-B842-4C79-8DD5-A33895676144} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {E093552B-C2B8-4F2B-BEE2-4B3395324995} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {EE400641-0326-4954-A1FA-D3CBDAD76537} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {F5950434-834D-4237-B6DA-FCABB1BBAB84} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-28] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-12-05 12:12 - 2008-02-28 02:15 - 00139776 _____ () C:\windows\system32\spool\PRTPROCS\x64\lxdxdrpp.dll
2009-10-29 01:57 - 2009-10-29 01:57 - 00100864 _____ () c:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2009-11-19 23:14 - 2009-11-19 23:14 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2009-11-19 23:14 - 2009-11-19 23:14 - 00055352 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2009-11-19 23:11 - 2009-11-19 23:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2009-11-19 23:11 - 2009-11-19 23:11 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2009-09-04 21:35 - 2009-09-04 21:35 - 00173344 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-12-04 15:31 - 2012-12-04 15:28 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 01249280 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\ice32.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00159744 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\iceutil32.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00065536 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\bzip2.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00167936 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\IceSSL32.dll
2013-11-07 22:13 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-11-07 22:13 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-11-07 22:13 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-11-07 22:13 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-11-07 22:13 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2010-10-13 19:55 - 2009-07-24 20:10 - 02199552 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtCore4.dll
2010-10-13 19:55 - 2009-07-24 20:10 - 08024064 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtGui4.dll
2010-10-13 19:55 - 2008-01-09 19:08 - 01245184 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\ice32.dll
2010-10-13 19:55 - 2008-01-09 19:10 - 00159744 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\iceutil32.dll
2010-10-13 19:55 - 2008-01-09 19:06 - 00065536 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\bzip2.dll
2010-10-13 19:55 - 2008-01-09 19:10 - 00167936 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\IceSSL32.dll
2013-03-13 21:48 - 2013-03-13 21:48 - 24978944 _____ () C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\libcef.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-10-30 19:12 - 2013-10-30 19:12 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Viktoria\Desktop\Bix_das_Gaensebluemchen.wmv:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/15/2013 10:51:45 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.


System errors:
=============

Microsoft Office Sessions:
=========================
Error: (11/15/2013 10:51:45 AM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 3953.8 MB
Available physical RAM: 2035.79 MB
Total Pagefile: 7905.79 MB
Available Pagefile: 5359.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:448.46 GB) (Free:80.08 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F34E6CC3)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=448 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End Of Log ============================
         

Geändert von cosinus (15.11.2013 um 11:40 Uhr) Grund: CODE-Tags korrigiert

Alt 15.11.2013, 11:42   #11
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 16.11.2013, 22:07   #12
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



malwarebytes hat 3 infizierte objekte gefunden. ich hab sie bereinigt mit dem programm. hoffe mal das war richtig.

hier der log gleich nach dem fund:

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.16.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Viktoria :: SOKRATES [Administrator]

Schutz: Aktiviert

16.11.2013 21:57:29
MBAM-log-2013-11-16 (22-05-50).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 222100
Laufzeit: 7 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Viktoria\Downloads\Downton_Abbey_Season_2_downloader_at_205.exe (PUP.Optional.ExpressFiles.A) -> Keine Aktion durchgeführt.
C:\Users\Viktoria\Downloads\SoftonicDownloader_fuer_freemind.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt.
C:\Users\Viktoria\Downloads\winamp561_full_emusic-7plus_de-de.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt.

(Ende)
         

Alt 17.11.2013, 00:44   #13
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Nur Müll im Ordner downloads
Was ist mit ESET?
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 17.11.2013, 14:44   #14
viktoria28
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



eset hat 3 bedrohungen gefunden unter:

Zitat:

C:\AdwCleaner\Quarantine\C\ProgramData\MaggnnIIPic\51609fcddcc55.dll.vir a variant of Win32/Adware.MultiPlug.I application
C:\AdwCleaner\Quarantine\C\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\Extensions\k_enl@rsbpt.com\content\bg.js.vir Win32/Adware.MultiPlug.H application
C:\Users\Viktoria\USB Sicherheitskopie 07.2011\Sonstiges\IE\IE\autorun.inf Win32/Bflient.K worm
hier der log, sorry

Zitat:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1ebc7d03e434154bb05ddf1a19c1b0cb
# engine=15913
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-17 01:34:18
# local_time=2013-11-17 02:34:18 (+0100, Mitteleuropäische Zeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 5958133 136325108 0 0
# scanned=385213
# found=3
# cleaned=0
# scan_time=14840
sh=3E48C8D25B196D67722ED20CD36BF3448A4C9136 ft=1 fh=8ca2da5db5514665 vn="a variant of Win32/Adware.MultiPlug.I application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\MaggnnIIPic\51609fcddcc55.dll.vir"
sh=1A7DD9B4E268F4FD3B241F13D169D9200C1DFF65 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\Extensions\k_enl@rsbpt.com\content\bg.js.vir"
sh=3091BA7AFE3722E4DA37D54885C5D1F232818DAE ft=0 fh=0000000000000000 vn="Win32/Bflient.K worm" ac=I fn="C:\Users\Viktoria\USB Sicherheitskopie 07.2011\Sonstiges\IE\IE\autorun.inf"

Geändert von viktoria28 (17.11.2013 um 14:56 Uhr)

Alt 17.11.2013, 21:27   #15
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Standard

Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!



Nur Funde in Quarantäne-Ordnern.

Zitat:
C:\Users\Viktoria\USB Sicherheitskopie 07.2011\Sonstiges\IE\IE\autorun.inf
Alte Sicherung mal löschen.

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Antwort

Themen zu Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!
.com, agent, antivirus, appdatalow, autorun, browser, computer, explorer, explorer.exe, farbar, farbar recovery scan tool, firefox, flash player, google, helper, installation, launch, links, log-file, logfiles, microsoft, object, probleme, registry, registry key, safer networking, software, start, user agent, viren, werbung, wickel, windows



Ähnliche Themen: Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!


  1. Windows Vista -64 Bit - Werbung, überall Werbung!
    Log-Analyse und Auswertung - 29.03.2015 (15)
  2. Laptop langsam und überall Werbelinks
    Plagegeister aller Art und deren Bekämpfung - 25.02.2015 (9)
  3. Überall Werbung im Browser und selbstständiges Öffnen von Tabs und Fenster
    Plagegeister aller Art und deren Bekämpfung - 20.02.2015 (28)
  4. Überall Werbung... Fenster öffnen sich automatisch mit werbung HILFE!!!
    Plagegeister aller Art und deren Bekämpfung - 07.02.2015 (5)
  5. Windows 7: Browser voller Werbung/ Links werden zu Werbung weitergeleitet
    Log-Analyse und Auswertung - 17.12.2014 (31)
  6. Pc langsam, überall Werbung, neue Fenster mit Werbung, Adblocker verschlimmerte alles
    Plagegeister aller Art und deren Bekämpfung - 14.11.2014 (3)
  7. Windows 8 / "Feun2Save": Nur noch Werbelinks usw. im Browser; Browser öffnet sich von alleine
    Log-Analyse und Auswertung - 06.10.2014 (18)
  8. Windows 8 unterstreicht Wörter doppelt und überall blinkt Werbung auf
    Plagegeister aller Art und deren Bekämpfung - 08.09.2014 (3)
  9. Windows 7: Werbung überall und Tabs öffnen sich von selbst
    Log-Analyse und Auswertung - 25.07.2014 (9)
  10. Windows explorer funktioniert erst nicht, dann taucht überall Werbung auf.
    Log-Analyse und Auswertung - 19.05.2014 (3)
  11. Windows 8: Werbung überall, Scrollen klappt nicht
    Plagegeister aller Art und deren Bekämpfung - 07.05.2014 (29)
  12. Windows Vista - Werbung überall im Internet - Nervig
    Plagegeister aller Art und deren Bekämpfung - 16.04.2014 (6)
  13. Seit Update auf Windows 8.1 überall Werbung auf dem Desktop, Reste von Imminent?
    Plagegeister aller Art und deren Bekämpfung - 08.02.2014 (9)
  14. Überall werbung im Browser
    Plagegeister aller Art und deren Bekämpfung - 20.09.2013 (13)
  15. Im Browser ist überall Werbung
    Plagegeister aller Art und deren Bekämpfung - 13.08.2013 (17)
  16. Windows Updates funktionieren nicht mehr, zusätzlich überall Werbung beim surfen
    Plagegeister aller Art und deren Bekämpfung - 08.08.2013 (25)
  17. Werbelinks in Browser - Pop-ups
    Plagegeister aller Art und deren Bekämpfung - 31.01.2013 (21)

Zum Thema Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! - Hallo! Ich werde nuns chon seit mehreren Wochen durch extrem nervende Werbung in meinem Browser (Firefox aber auch IE und google chrome) geplagt. Es werden automatisch irgendwelche Links in den - Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!...
Archiv
Du betrachtest: Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.