Hallo,
Habe vor einiger Zeit eine Aktualisierungmail bekommen wo verlangt wurde die Handyapp zu installieren da sonst mein Konto gelöscht wird!
Da ich leider im Stress war habe ich natürlich in der Eile draufgeklickt (hat aber nichts funktioniert)
Plötzlich ging der Computer nur mehr sehr langsam! -> auf jeder Internet Seite poppen sofort 4 Werbungen auf!
AVIRA sagt mir zwar das mein Computer sicher ist aber das glaube ich nicht wirklich!!
Habe dann unter eurem HILFETHEMA einmal MBAM drüberlaufen lassen
mit folgendem Ergebnis:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 08.06.2014
Scan Time: 13:19:24
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.03.04.09
Rootkit Database: v2014.02.20.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Barbara

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 244992
Time Elapsed: 17 min, 31 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)
         

danach habe ich defogger mit folgendem Ergebnis abgeschlossen:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:55 on 08/06/2014 (Barbara)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

dann unter dem Punkt Thema erstellen habe ich gesehen das man FRST und GMER noch drüberlaufen lassen soll!
Habe Beides gemacht mit folgenden Ergebnissen:
FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-06-2014
Ran by Barbara (administrator) on BARBARA-HP on 08-06-2014 13:58:08
Running from C:\Users\Barbara\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(PriceMeter) C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\McUICnt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [TrayServer] => C:\Program Files (x86)\MAGIX\Video_deluxe_15_Plus\TrayServer.exe [90112 2008-08-07] (MAGIX AG)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-29] (Easybits)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282632 2013-04-02] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [TrojanScanner] => C:\Program Files (x86)\Trojan Remover\Trjscan.exe [1704720 2014-01-23] (Simply Super Software)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-27] (Hewlett-Packard)
HKLM-x32\...\RunOnce: [ChicaPC-Shield] - C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe /install /silent [788040 2013-06-09] (ChicaLogic)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe"
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe"
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe"
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe"
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Policies\system: [DisableChangePassword] 0
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browsemngr.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browsermngr.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe
IFEO\delta babylon.exe: [Debugger] tasklist.exe
IFEO\delta tb.exe: [Debugger] tasklist.exe
IFEO\delta2.exe: [Debugger] tasklist.exe
IFEO\deltainstaller.exe: [Debugger] tasklist.exe
IFEO\deltasetup.exe: [Debugger] tasklist.exe
IFEO\deltatb.exe: [Debugger] tasklist.exe
IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\iminentsetup.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\rjatydimofu.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\sweetimsetup.exe: [Debugger] tasklist.exe
IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\SafetyNut\safetycrt.dll
HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\SafetyNut\x64\safetycrt.dll

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/1
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_uid=9411110305954883&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=n11551-290&apn_uid=1411082157004724&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM - {E470252B-2B36-4497-8AFE-F39C17A4E358} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_uid=9411110305954883&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=n11551-290&apn_uid=1411082157004724&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {E470252B-2B36-4497-8AFE-F39C17A4E358} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3324760&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=5&UP=SP4D3F4BC0-2AB9-4401-AA2F-CF2C2A05B600&q={searchTerms}&SSPV=
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_uid=9411110305954883&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=n11551-290&apn_uid=1411082157004724&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {BB5BE563-6BE3-473B-96FE-66E09EEE33A9} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=defcf2ea000000000000ac81129fcd74&r=303
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {E470252B-2B36-4497-8AFE-F39C17A4E358} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll (CANON INC.)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Avira Savings Advisor BHO - {A18A516C-AA41-46A9-92DB-60208917E442} - C:\Program Files (x86)\avira\Internet Explorer\avira32.dll ()
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: Softonic Helper Object - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\bh\Softonic.dll (Softonic.com)
BHO-x32: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\SoftonicTlbr.dll (Softonic.com)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-07-24] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{49DA899B-1780-412F-8703-22283B704288}: [NameServer]5.39.219.212
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer]5.39.219.212
Tcpip\..\Interfaces\{9A9D1FBC-87CA-4829-BC09-82D62CCE9B59}: [NameServer]5.39.219.212
Tcpip\..\Interfaces\{CC169F16-7B04-4A88-957B-6A93AE37389A}: [NameServer]5.39.219.212

FireFox:
========
FF ProfilePath: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://www.google.at/
FF Keyword.URL: hxxp://dts.search.ask.com/sr?src=ffb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=9411110305954883&o=APN10640&q=
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=3 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter)
FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=9 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\searchplugins\Ask.xml
FF SearchPlugin: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Savings Advisor - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\ciuvo-extension@avira.de [2014-05-26]
FF Extension: softonic.com - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\ffxtlbra@softonic.com [2012-05-24]
FF Extension: Ask New Tabs - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{8E69E270-96C8-161B-D584-8E724EEC279D} [2014-04-05]
FF Extension: Value Apps - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{94cd2cc3-083f-49ba-a218-4cda4b4829fd} [2014-03-19]
FF Extension: Movies Toolbar (Dist. by Somoto Ltd.) - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{c75a2d66-6d1d-4735-8f63-9d85dcc026a6} [2014-04-05]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-22]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Softonic Chrome Toolbar) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf [2013-11-13]
CHR HKLM-x32\...\Chrome\Extension: [elchiiiejkobdbblfejjkbphbddgmljf] - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\Softonic.crx [2013-06-11]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-09-28] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG)
S2 CPCSScheduler; C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe [418376 2013-06-09] (ChicaLogic)
S2 CPCSService; C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe [701512 2013-06-09] (ChicaLogic)
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S2 pricemeterliveUpdate; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-03-19] (PriceMeter)
S3 pricemeterliveUpdatem; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-03-19] (PriceMeter)
S2 TorchCrashHandler; C:\Users\Barbara\AppData\Local\Torch\Update\TorchCrashHandler.exe [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-05-09] (Avira Operations GmbH & Co. KG)
S3 CPCSProtector; C:\Windows\system32\drivers\cpcs.sys [25928 2013-04-04] (ChicaLogic)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-08 13:58 - 2014-06-08 13:58 - 00030385 _____ () C:\Users\Barbara\Desktop\FRST.txt
2014-06-08 13:57 - 2014-06-08 13:58 - 00000000 ____D () C:\FRST
2014-06-08 13:56 - 2014-06-08 13:56 - 02072576 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe
2014-06-08 13:55 - 2014-06-08 13:55 - 00000476 _____ () C:\Users\Barbara\Desktop\defogger_disable.log
2014-06-08 13:55 - 2014-06-08 13:55 - 00000000 _____ () C:\Users\Barbara\defogger_reenable
2014-06-08 13:53 - 2014-06-08 13:54 - 00050477 _____ () C:\Users\Barbara\Desktop\Defogger.exe
2014-06-08 13:52 - 2014-06-08 13:52 - 00001058 _____ () C:\Users\Barbara\Desktop\mbam.txt
2014-06-08 13:17 - 2014-06-08 13:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-29 20:02 - 2014-05-29 20:02 - 00027386 _____ () C:\Users\Barbara\Documents\trojaner.xml
2014-05-29 19:40 - 2014-06-08 07:40 - 00000454 _____ () C:\Windows\Tasks\ChicaPC-Shield-Notification.job
2014-05-29 19:40 - 2014-05-29 19:40 - 00003526 _____ () C:\Windows\System32\Tasks\ChicaPC-Shield-Notification
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\ProgramData\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Program Files (x86)\ChicaLogic
2014-05-29 19:39 - 2013-04-04 14:51 - 00025928 _____ (ChicaLogic) C:\Windows\system32\Drivers\cpcs.sys
2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Fighters
2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\ProgramData\clp
2014-05-29 19:35 - 2014-05-29 20:01 - 00000000 ____D () C:\ProgramData\Fighters
2014-05-29 19:35 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Common Toolkit Suite
2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\Users\Barbara\Documents\Simply Super Software
2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\ProgramData\Licenses
2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-05-29 18:47 - 2014-05-29 18:47 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-05-29 18:46 - 2014-05-29 18:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Barbara\Desktop\wzmp_8.exe
2014-05-29 18:46 - 2014-05-29 18:46 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-05-29 18:46 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-05-27 14:29 - 2014-05-27 14:28 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-05-26 22:00 - 2014-05-26 22:00 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-26 19:19 - 2014-05-26 19:19 - 00003408 _____ () C:\Windows\System32\Tasks\aviraSWU
2014-05-26 19:19 - 2014-05-26 19:19 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Avira
2014-05-26 19:17 - 2014-05-26 19:19 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-05-26 19:17 - 2014-05-26 19:17 - 00002030 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Avira
2014-05-26 19:17 - 2014-05-09 11:16 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-26 19:17 - 2014-05-09 11:16 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-26 19:17 - 2014-05-09 11:16 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-05-22 16:57 - 2014-05-22 16:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-22 16:57 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-22 16:57 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-22 16:57 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-22 16:29 - 2014-05-22 17:46 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-21 15:44 - 2014-05-21 15:45 - 00000000 ___HD () C:\ProgramData\CanonIJMIG
2014-05-21 15:34 - 2014-05-21 15:34 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-21 15:31 - 2014-05-21 15:32 - 00000000 ___HD () C:\ProgramData\CanonIJScan
2014-05-21 15:26 - 2014-05-21 15:26 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-05-21 15:23 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Canon IJ Network Tool
2014-05-21 15:23 - 2013-02-04 15:10 - 00321536 _____ (CANON INC.) C:\Windows\SysWOW64\CNC_BVL.dll
2014-05-21 15:23 - 2012-11-26 12:32 - 00088576 _____ () C:\Windows\SysWOW64\CNC176ED.TBL
2014-05-21 15:23 - 2008-08-25 18:02 - 00015872 _____ (CANON INC.) C:\Windows\SysWOW64\CNHMCA.dll
2014-05-21 15:22 - 2014-05-21 15:22 - 00001985 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Benutzerregistrierung
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-21 15:22 - 2013-01-24 09:24 - 00359936 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL
2014-05-21 15:22 - 2013-01-24 09:24 - 00039424 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL
2014-05-21 15:22 - 2013-01-24 09:23 - 00366592 _____ (CANON INC.) C:\Windows\SysWOW64\CNMNPPM.DLL
2014-05-21 15:17 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-21 15:17 - 2014-05-21 15:17 - 00002320 _____ () C:\Users\Public\Desktop\Canon MG3500 series On-Screen-Handbuch.lnk
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Manual
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\Program Files\Canon
2014-05-21 15:16 - 2014-05-21 15:16 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-21 15:16 - 2013-04-04 05:00 - 00391168 _____ (CANON INC.) C:\Windows\system32\CNMLMBV.DLL
2014-05-21 15:13 - 2014-06-01 09:11 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-05-21 15:13 - 2014-05-21 15:13 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-05-21 15:12 - 2014-05-21 15:25 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-12 20:41 - 2014-05-22 16:38 - 00003120 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-05-11 15:23 - 2014-05-11 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-06-08 13:58 - 2014-06-08 13:58 - 00030385 _____ () C:\Users\Barbara\Desktop\FRST.txt
2014-06-08 13:58 - 2014-06-08 13:57 - 00000000 ____D () C:\FRST
2014-06-08 13:58 - 2011-10-22 13:01 - 00000000 ____D () C:\Users\Barbara\AppData\Local\Temp
2014-06-08 13:57 - 2011-07-15 00:59 - 01298888 _____ () C:\Windows\WindowsUpdate.log
2014-06-08 13:56 - 2014-06-08 13:56 - 02072576 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe
2014-06-08 13:55 - 2014-06-08 13:55 - 00000476 _____ () C:\Users\Barbara\Desktop\defogger_disable.log
2014-06-08 13:55 - 2014-06-08 13:55 - 00000000 _____ () C:\Users\Barbara\defogger_reenable
2014-06-08 13:55 - 2011-10-22 13:01 - 00000000 ____D () C:\Users\Barbara
2014-06-08 13:54 - 2014-06-08 13:53 - 00050477 _____ () C:\Users\Barbara\Desktop\Defogger.exe
2014-06-08 13:52 - 2014-06-08 13:52 - 00001058 _____ () C:\Users\Barbara\Desktop\mbam.txt
2014-06-08 13:39 - 2014-03-19 14:34 - 00000968 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job
2014-06-08 13:39 - 2014-03-19 14:34 - 00000964 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job
2014-06-08 13:35 - 2014-03-19 14:34 - 00000300 _____ () C:\Windows\Tasks\PriceMeterUpdater.job
2014-06-08 13:17 - 2014-06-08 13:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-08 13:17 - 2011-11-19 12:31 - 00000000 ____D () C:\Users\Barbara\AppData\Local\CrashDumps
2014-06-08 13:06 - 2012-06-14 11:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-08 12:59 - 2009-07-14 06:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-08 12:59 - 2009-07-14 06:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-08 07:40 - 2014-05-29 19:40 - 00000454 _____ () C:\Windows\Tasks\ChicaPC-Shield-Notification.job
2014-06-07 21:39 - 2013-11-13 19:35 - 00092160 ___SH () C:\Users\Barbara\Desktop\Thumbs.db
2014-06-07 13:50 - 2012-07-02 16:56 - 00003198 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForBarbara
2014-06-07 13:50 - 2012-07-02 16:56 - 00000340 _____ () C:\Windows\Tasks\HPCeeScheduleForBarbara.job
2014-06-07 13:50 - 2011-10-22 13:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C9177807-72A8-4EF1-B4BF-EF146260FFFE}
2014-06-06 08:24 - 2011-07-24 17:40 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-06-06 08:24 - 2011-07-24 17:40 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-06-06 08:24 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-01 09:11 - 2014-05-21 15:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-05-29 20:02 - 2014-05-29 20:02 - 00027386 _____ () C:\Users\Barbara\Documents\trojaner.xml
2014-05-29 20:01 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Fighters
2014-05-29 19:54 - 2011-07-15 01:18 - 00000000 ____D () C:\ProgramData\Temp
2014-05-29 19:40 - 2014-05-29 19:40 - 00003526 _____ () C:\Windows\System32\Tasks\ChicaPC-Shield-Notification
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\ProgramData\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Program Files (x86)\ChicaLogic
2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Fighters
2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\ProgramData\clp
2014-05-29 19:35 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Common Toolkit Suite
2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\Users\Barbara\Documents\Simply Super Software
2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\ProgramData\Licenses
2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-05-29 18:47 - 2014-05-29 18:47 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-05-29 18:46 - 2014-05-29 18:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Barbara\Desktop\wzmp_8.exe
2014-05-29 18:46 - 2014-05-29 18:46 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-05-29 18:41 - 2011-07-24 08:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-28 20:50 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-28 14:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-28 14:55 - 2009-07-14 06:51 - 00079208 _____ () C:\Windows\setupact.log
2014-05-27 14:28 - 2014-05-27 14:29 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-05-26 22:16 - 2010-11-21 05:47 - 01241398 _____ () C:\Windows\PFRO.log
2014-05-26 22:00 - 2014-05-26 22:00 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-26 19:19 - 2014-05-26 19:19 - 00003408 _____ () C:\Windows\System32\Tasks\aviraSWU
2014-05-26 19:19 - 2014-05-26 19:19 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Avira
2014-05-26 19:19 - 2014-05-26 19:17 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-05-26 19:17 - 2014-05-26 19:17 - 00002030 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Avira
2014-05-25 19:52 - 2012-04-30 08:07 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-05-25 19:52 - 2012-03-05 08:47 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-22 17:46 - 2014-05-22 16:29 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-05-22 17:39 - 2012-01-24 09:26 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-22 17:39 - 2011-07-24 08:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-22 17:28 - 2014-04-05 19:14 - 00000000 ____D () C:\Program Files (x86)\Movies Toolbar
2014-05-22 17:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\L2Schemas
2014-05-22 17:27 - 2014-03-19 20:16 - 00000000 ____D () C:\Users\Barbara\AppData\Local\Conduit
2014-05-22 17:27 - 2014-03-19 20:16 - 00000000 ____D () C:\Program Files\Conduit
2014-05-22 17:27 - 2014-03-19 20:16 - 00000000 ____D () C:\Program Files (x86)\Conduit
2014-05-22 17:27 - 2012-10-01 10:31 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Systweak
2014-05-22 17:27 - 2012-10-01 10:31 - 00000000 ____D () C:\ProgramData\Systweak
2014-05-22 16:57 - 2014-05-22 16:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-22 16:38 - 2014-05-12 20:41 - 00003120 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-05-21 15:45 - 2014-05-21 15:44 - 00000000 ___HD () C:\ProgramData\CanonIJMIG
2014-05-21 15:44 - 2013-05-20 13:12 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\canon
2014-05-21 15:34 - 2014-05-21 15:34 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-21 15:32 - 2014-05-21 15:31 - 00000000 ___HD () C:\ProgramData\CanonIJScan
2014-05-21 15:26 - 2014-05-21 15:26 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-05-21 15:25 - 2014-05-21 15:12 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-21 15:23 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Canon IJ Network Tool
2014-05-21 15:23 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-21 15:23 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-05-21 15:22 - 2014-05-21 15:22 - 00001985 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Benutzerregistrierung
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-21 15:17 - 2014-05-21 15:17 - 00002320 _____ () C:\Users\Public\Desktop\Canon MG3500 series On-Screen-Handbuch.lnk
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Manual
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\Program Files\Canon
2014-05-21 15:16 - 2014-05-21 15:16 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-21 15:13 - 2014-05-21 15:13 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-05-15 15:19 - 2012-06-14 11:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-15 15:19 - 2012-06-14 11:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-15 15:19 - 2011-07-24 08:30 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-12 20:36 - 2013-05-22 15:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-12 07:26 - 2014-05-22 16:57 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-22 16:57 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-22 16:57 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 15:23 - 2014-05-11 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-09 11:16 - 2014-05-26 19:17 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-09 11:16 - 2014-05-26 19:17 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-09 11:16 - 2014-05-26 19:17 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

Some content of TEMP:
====================
C:\Users\Barbara\AppData\Local\Temp\AskSLib.dll
C:\Users\Barbara\AppData\Local\Temp\avgnt.exe
C:\Users\Barbara\AppData\Local\Temp\BackupSetup.exe
C:\Users\Barbara\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Barbara\AppData\Local\Temp\contentDATs.exe
C:\Users\Barbara\AppData\Local\Temp\CopyUpdate.exe
C:\Users\Barbara\AppData\Local\Temp\CPCShield_Setup.exe
C:\Users\Barbara\AppData\Local\Temp\Delta.exe
C:\Users\Barbara\AppData\Local\Temp\DeltaTB.exe
C:\Users\Barbara\AppData\Local\Temp\dltr.exe
C:\Users\Barbara\AppData\Local\Temp\EnableExtDll.dll
C:\Users\Barbara\AppData\Local\Temp\Extract.exe
C:\Users\Barbara\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Barbara\AppData\Local\Temp\FreeGamesSetup.exe
C:\Users\Barbara\AppData\Local\Temp\GCVerifier.dll
C:\Users\Barbara\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Barbara\AppData\Local\Temp\mgxfonts.exe
C:\Users\Barbara\AppData\Local\Temp\mgxoschk.dll
C:\Users\Barbara\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\Barbara\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Barbara\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Barbara\AppData\Local\Temp\Resource.exe
C:\Users\Barbara\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Barbara\AppData\Local\Temp\sp54620.exe
C:\Users\Barbara\AppData\Local\Temp\SP54714.exe
C:\Users\Barbara\AppData\Local\Temp\SP55081.exe
C:\Users\Barbara\AppData\Local\Temp\SP55083.exe
C:\Users\Barbara\AppData\Local\Temp\SP55085.exe
C:\Users\Barbara\AppData\Local\Temp\SP55152.exe
C:\Users\Barbara\AppData\Local\Temp\SP56215.exe
C:\Users\Barbara\AppData\Local\Temp\SP56878.exe
C:\Users\Barbara\AppData\Local\Temp\SP56929.exe
C:\Users\Barbara\AppData\Local\Temp\SP57049.exe
C:\Users\Barbara\AppData\Local\Temp\sp58915.exe
C:\Users\Barbara\AppData\Local\Temp\SP59202.exe
C:\Users\Barbara\AppData\Local\Temp\SP59792.exe
C:\Users\Barbara\AppData\Local\Temp\SP62234.exe
C:\Users\Barbara\AppData\Local\Temp\sp64126.exe
C:\Users\Barbara\AppData\Local\Temp\uninstall.exe
C:\Users\Barbara\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Barbara\AppData\Local\Temp\WSSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 10:06

==================== End Of Log ============================
         

Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-06-2014
Ran by Barbara at 2014-06-08 13:58:52
Running from C:\Users\Barbara\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Enabled - Out of date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Out of date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
AMD APP SDK Runtime (Version: 2.5.775.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{ACD449FA-9DF3-779D-DA68-11D486963225}) (Version: 3.0.847.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2011.0928.607.9079 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.60928.0618 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In  (Version: 1.00.0000 - AMD) Hidden
AMD System Monitor (HKLM-x32\...\{4144F415-7434-4501-97DE-CED4FAF64E7D}) (Version: 1.0.6 - Advanced Micro Devices, Inc.)
AMD VISION Engine Control Center (x32 Version: 2011.0928.607.9079 - Ihr Firmenname) Hidden
Apple Application Support (HKLM-x32\...\{122ADF8C-DDA1-480C-9936-C88F2825B265}) (Version: 2.1.9 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}) (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version:  - )
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
BIPA FotoShop (HKLM-x32\...\BIPA FotoShop) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bundled software uninstaller (HKLM-x32\...\bi_uninstaller) (Version:  - ) <==== ATTENTION
Caillous Vorschule (HKLM-x32\...\{32180A3A-F7F0-4BD9-924A-B3A271DD35AE}) (Version: 1.00.000 - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.4.1.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG3500 series Benutzerregistrierung (HKLM-x32\...\Canon MG3500 series Benutzerregistrierung) (Version:  - *Canon Inc.)
Canon MG3500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3500_series) (Version: 1.00 - Canon Inc.)
Canon MG3500 series On-screen Manual (HKLM-x32\...\Canon MG3500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.2.0 - Canon Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
ChicaPC-Shield Version 1.75.0.1400 (x32 Version: 1.75.0.1400 - ChicaLogic) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.1.4119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DriverTuner 3.1.0.0 (HKLM-x32\...\{520C1D80-935C-42B9-9340-E883849D804F}_is1) (Version: 3.1.0.0 - LionSea SoftWare)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\Firebird SQL Server D) (Version: 2.0.1.13 - MAGIX AG)
Free YouTube to MP3 Converter version 3.12.16.1030 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.16.1030 - DVDVideoSoft Ltd.)
Google Update Helper (x32 Version: 1.3.23.0 - PriceMeter) Hidden <==== ATTENTION
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{999164B6-5B78-4DD3-BACE-7292640AD0DD}) (Version: 3.1.0.9760 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6319.0 - IDT)
iTunes (HKLM\...\{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}) (Version: 10.6.3.25 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
L&H TTS3000 Deutsch (HKLM-x32\...\LHTTSGED) (Version:  - )
Macromedia Shockwave Player (HKLM-x32\...\Macromedia Shockwave Player) (Version:  - )
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
MAGIX 3D Maker (embeded) (HKLM-x32\...\MAGIX 3D Maker D) (Version: 6.0.0.2 - MAGIX AG)
MAGIX Burn routines (HKLM-x32\...\{7F2B12E7-2302-4A86-AE26-33DDD84E478A}) (Version: 9.0.0.193 - MAGIX AG)
MAGIX Foto Manager 8 6.0.1.457 (D) (HKLM-x32\...\MAGIX Foto Manager 8 D) (Version: 6.0.1.457 - MAGIX AG)
MAGIX Fotobuch 3.6 (HKLM-x32\...\MAGIX Fotobuch) (Version: 3.6 - MAGIX AG)
MAGIX Online Druck Service 3.4.3.0 (D) (HKLM-x32\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)
MAGIX Screenshare 4.3.6.1987 (D) (HKLM-x32\...\MAGIX Screenshare D) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Video deluxe 15 Plus 8.0.0.62 (D) (HKLM-x32\...\MAGIX Video deluxe 15 Plus D) (Version: 8.0.0.62 - MAGIX AG)
MAGIX Xtreme Foto Designer 6 6.0.25.0 (D) (HKLM-x32\...\MAGIX Xtreme Foto Designer 6 D) (Version: 6.0.25.0 - MAGIX AG)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2000 Premium (HKLM-x32\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ Run Time  Lib Setup (HKLM-x32\...\{AAF4238F-7C29-451D-9925-C753271A5728}) (Version: 1.0.0 - Microsoft)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mufin MusicFinder Base 1.5.3.255 (D) (HKLM-x32\...\Mufin MusicFinder Base D) (Version: 1.5.3.255 - MAGIX AG)
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version:  - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.40.126.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.83 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0706 - REALTEK Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Softonic toolbar  on IE and Chrome (HKLM-x32\...\Softonic) (Version: 1.8.21.14 - Softonic) <==== ATTENTION
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
Trojan Remover 6.9.0 (HKLM-x32\...\Trojan Remover_is1) (Version: 6.9.0 - Simply Super Software)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10798 - WinZip International LLC)

==================== Restore Points  =========================

26-05-2014 17:11:41 TuneUp Utilities 2014 wird entfernt
26-05-2014 17:12:52 TuneUp Utilities 2014 (de-DE) wird entfernt
28-05-2014 12:50:53 Entfernt Caillous Vorschule
29-05-2014 16:40:49 Entfernt Schreibwerkstatt
29-05-2014 17:36:12 Installed Fighters.
08-06-2014 08:20:20 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {10F4889C-4043-4B55-8D18-38AED14504C3} - System32\Tasks\HPCeeScheduleForBarbara => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {1E1A9442-9D9C-4933-8154-51FC541A1C39} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {41BA2CDE-5FD2-4948-AE06-B7BCD6E63A11} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-03-19] (PriceMeter) <==== ATTENTION
Task: {61BC80C9-A993-4FFD-81AA-D2EB34D268BA} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files (x86)\avira\Internet Explorer\swu.vbs"
Task: {73353FBE-2D58-4D65-876A-2A6CC96CD3C0} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {753E670C-9DD0-47AA-AF90-C3124262802A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {8AE665EB-41FC-4D28-ACA9-4D7973F1E064} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {96239A02-A250-48AC-AC95-BD611379BBDB} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {97116147-22F4-48EF-90AD-8BF0B9C39C89} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe <==== ATTENTION
Task: {B97ABC14-C081-40D4-95FE-8666316AD0BB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {BC403985-E341-453D-BD48-90BC5B6E9AF0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {BF4B4483-9CA7-4525-9EE2-01FACBE12844} - System32\Tasks\PriceMeterUpdater => C:\Users\Barbara\AppData\Roaming\PriceMeterUpdater\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {CEEC6B99-BD72-4075-910E-B36D33F25533} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-27] ()
Task: {DDCE964B-9C72-42CA-B86F-D10D38B222FD} - System32\Tasks\ChicaPC-Shield-Notification => C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Toolkit\Sync.exe [2014-05-29] (SPAMfighter ApS)
Task: {E07A3D5F-0A8F-42AD-8C43-04AB6B2A5549} - System32\Tasks\pricemeterdownloader => C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterd.exe <==== ATTENTION
Task: {E383725F-BD42-44CB-835F-3AE4F7B2983A} - System32\Tasks\{1B67B452-3D3B-4A57-9F66-7C53F3ECDBBB} => Firefox.exe 
Task: {E4B2FD4C-FDFA-4104-A6D9-57BA6831A903} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-03-19] (PriceMeter) <==== ATTENTION
Task: {F443360C-0D5C-4A4F-934B-27B975FBD02E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ChicaPC-Shield-Notification.job => C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Toolkit\Sync.exe
Task: C:\Windows\Tasks\HPCeeScheduleForBarbara.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterUpdater.job => C:\Users\Barbara\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-09-28 06:19 - 2011-09-28 06:19 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-05-21 15:24 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2011-09-28 06:19 - 2011-09-28 06:19 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-09-28 06:06 - 2011-09-28 06:06 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-05-29 18:46 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files (x86)\WinZip Malware Protector\System.Data.SQLite.dll
2014-05-29 18:46 - 2013-07-15 16:53 - 01717936 _____ () C:\Program Files (x86)\WinZip Malware Protector\aspsys.dll
2014-05-29 18:46 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files (x86)\WinZip Malware Protector\UNRAR.DLL

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:CB0AACC9

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 681584

Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 681584

Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 680586

Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 680586

Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 679572

Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 679572

Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/08/2014 01:40:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7036


System errors:
=============
Error: (06/08/2014 00:55:23 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 00:54:57 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 00:54:57 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 00:54:30 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT59

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\SYSTEM

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 10:30:11 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 10:29:44 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 10:29:44 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 10:29:08 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT59

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\SYSTEM

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 10:07:41 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (06/08/2014 10:07:15 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 0.0.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.5.0216.00

	Quellpfad: 4.5.0216.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608


Microsoft Office Sessions:
=========================
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 681584

Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 681584

Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 680586

Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 680586

Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 679572

Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 679572

Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/08/2014 01:40:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7036


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 5609.41 MB
Available physical RAM: 3299.19 MB
Total Pagefile: 11216.99 MB
Available Pagefile: 8545.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:678.85 GB) (Free:538.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.62 GB) (Free:1.7 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.1 GB) FAT32
Drive g: () (Removable) (Total:0.24 GB) (Free:0 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 1412B001)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=679 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)

========================================================
Disk: 1 (Size: 243 MB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

und zum Schluss noch GMER:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-08 14:39:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a WDC_WD75 rev.01.0 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\Barbara\AppData\Local\Temp\ufliqkog.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                           fffff80002ffd000 63 bytes [43, 4D, 33, 31, 05, 00, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 593                                                                           fffff80002ffd041 12 bytes [90, 75, 06, A0, F8, FF, FF, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                0000000075701465 2 bytes [70, 75]
.text     C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                               00000000757014bb 2 bytes [70, 75]
.text     ...                                                                                                                                          * 2
.text     C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                           0000000075701465 2 bytes [70, 75]
.text     C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          00000000757014bb 2 bytes [70, 75]
.text     ...                                                                                                                                          * 2
.text     C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[5176] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                           0000000075701465 2 bytes [70, 75]
.text     C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[5176] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                          00000000757014bb 2 bytes [70, 75]
.text     ...                                                                                                                                          * 2
.text     C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe[5612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69     0000000075701465 2 bytes [70, 75]
.text     C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe[5612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155    00000000757014bb 2 bytes [70, 75]
.text     ...                                                                                                                                          * 2

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}\Connection@Name  LAN-Verbindung* 2
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind     \Device\{DCAB6D87-D84B-4AE0-985A-AB0C8C9BD309}?\Device\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}?\Device\{8593D552-5045-4866-A983-69AB822F4415}?\Device\{CEAAA49F-84AA-4C65-B2DA-DE4F6D3F8701}?\Device\{0D3E105F-3BE4-49BC-A9AC-79361D4AA1A2}?
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route    "{DCAB6D87-D84B-4AE0-985A-AB0C8C9BD309}"?"{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}"?"{8593D552-5045-4866-A983-69AB822F4415}"?"{CEAAA49F-84AA-4C65-B2DA-DE4F6D3F8701}"?"{0D3E105F-3BE4-49BC-A9AC-79361D4AA1A2}"?
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export   \Device\TCPIP6TUNNEL_{DCAB6D87-D84B-4AE0-985A-AB0C8C9BD309}?\Device\TCPIP6TUNNEL_{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}?\Device\TCPIP6TUNNEL_{8593D552-5045-4866-A983-69AB822F4415}?\Device\TCPIP6TUNNEL_{CEAAA49F-84AA-4C65-B2DA-DE4F6D3F8701}?\Device\TCPIP6TUNNEL_{0D3E105F-3BE4-49BC-A9AC-79361D4AA1A2}?
Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}@InterfaceName                       isatap.{9A9D1FBC-87CA-4829-BC09-82D62CCE9B59}
Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}@ReusableType                        0
Reg       HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch                                                                             32256

---- EOF - GMER 2.1 ----
         

ich bitte um Rat und falls nötig und es etwas gröberes ist um professionelle Hilfe (da ich schon so einiges tolles von euch gehört habe)!!

Lieben Gruß
Andreas

hi,

Adware & Co. deinstallieren

• Lade Dir bitte von hier Revo Uninstaller herunter.
• Installiere und starte das Programm.
• Suche im Uninstallerfeld nach den Programmen, die unter:
  
  diesen Zusatz haben:
  
• Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:



Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Habe bei Revo Uninstaller leider nichts gefunden und dann Combofix gestartet.
Folgendem Ergebnis ist dabei herausgekommen:

ComboFix 14-06-04.01 - Barbara 08.06.2014  18:37:27.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.43.1031.18.5609.3880 [GMT 2:00]
ausgeführt von:: c:\users\Barbara\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Barbara\AppData\Local\TempDIR
c:\users\Barbara\AppData\Local\TempDIR\PIP2691_NDV2_.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-08 bis 2014-06-08  ))))))))))))))))))))))))))))))
.
.
2014-06-08 16:45 . 2014-06-08 16:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-08 16:13 . 2014-06-08 16:13	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-06-08 11:57 . 2014-06-08 11:59	--------	d-----w-	C:\FRST
2014-06-08 11:17 . 2014-06-08 11:17	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-29 17:39 . 2014-05-29 17:39	--------	d-----w-	c:\users\Barbara\AppData\Roaming\ChicaLogic
2014-05-29 17:39 . 2014-05-29 17:39	--------	d-----w-	c:\programdata\ChicaLogic
2014-05-29 17:39 . 2013-04-04 12:51	25928	----a-w-	c:\windows\system32\drivers\cpcs.sys
2014-05-29 17:39 . 2014-05-29 17:39	--------	d-----w-	c:\program files (x86)\ChicaLogic
2014-05-29 17:37 . 2014-05-29 17:37	--------	d-----w-	c:\programdata\clp
2014-05-29 17:37 . 2014-05-29 17:37	--------	d-----w-	c:\users\Barbara\AppData\Roaming\Fighters
2014-05-29 17:35 . 2014-05-29 18:01	--------	d-----w-	c:\programdata\Fighters
2014-05-29 17:35 . 2014-05-29 17:35	--------	d-----w-	c:\programdata\Common Toolkit Suite
2014-05-29 17:31 . 2014-05-29 17:31	--------	d-----w-	c:\programdata\Licenses
2014-05-29 16:46 . 2014-05-29 16:46	--------	d-----w-	c:\users\Barbara\AppData\Roaming\Nico Mak Computing
2014-05-29 16:46 . 2014-05-29 16:46	--------	d-----w-	c:\programdata\Nico Mak Computing
2014-05-29 16:46 . 2014-05-29 16:46	--------	d-----w-	c:\program files (x86)\WinZip Malware Protector
2014-05-29 16:46 . 2013-03-15 15:10	20480	----a-w-	c:\windows\system32\wsusnative64.exe
2014-05-26 20:00 . 2014-05-26 20:00	--------	d-----w-	c:\programdata\HitmanPro
2014-05-26 17:17 . 2014-06-08 16:26	--------	d-----w-	c:\program files (x86)\Avira
2014-05-22 14:57 . 2014-05-22 14:57	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-05-22 14:57 . 2014-05-22 14:57	--------	d-----w-	c:\programdata\Malwarebytes
2014-05-22 14:57 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-05-22 14:57 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-05-22 14:57 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-05-21 13:44 . 2014-05-21 13:45	--------	d--h--w-	c:\programdata\CanonIJMIG
2014-05-21 13:34 . 2014-05-21 13:34	--------	d--h--w-	c:\programdata\CanonIJEGV
2014-05-21 13:31 . 2014-05-21 13:32	--------	d--h--w-	c:\programdata\CanonIJScan
2014-05-21 13:26 . 2014-05-21 13:26	--------	d--h--w-	c:\programdata\CanonIJQuickMenu
2014-05-21 13:23 . 2014-05-21 13:23	--------	d-----w-	c:\programdata\Canon IJ Network Tool
2014-05-21 13:23 . 2013-02-04 13:10	321536	----a-w-	c:\windows\SysWow64\CNC_BVL.dll
2014-05-21 13:23 . 2008-08-25 16:02	15872	----a-w-	c:\windows\SysWow64\CNHMCA.dll
2014-05-21 13:22 . 2014-05-21 13:22	--------	d-----w-	c:\windows\system32\STRING
2014-05-21 13:22 . 2013-01-24 07:24	39424	----a-w-	c:\windows\system32\CNMN6UI.DLL
2014-05-21 13:22 . 2013-01-24 07:24	359936	----a-w-	c:\windows\system32\CNMN6PPM.DLL
2014-05-21 13:22 . 2013-01-24 07:23	366592	----a-w-	c:\windows\SysWow64\CNMNPPM.DLL
2014-05-21 13:22 . 2014-05-21 13:22	--------	d-----w-	c:\programdata\CanonIJWSpt
2014-05-21 13:17 . 2014-05-21 13:17	--------	d-----w-	c:\program files\Canon
2014-05-21 13:17 . 2014-05-21 13:17	--------	d--h--w-	c:\programdata\CanonBJ
2014-05-21 13:17 . 2013-04-04 03:00	30208	----a-w-	c:\windows\system32\Spool\prtprocs\x64\CNMPDBV.DLL
2014-05-21 13:17 . 2013-04-04 03:00	101888	----a-w-	c:\windows\system32\Spool\prtprocs\x64\CNMPPBV.DLL
2014-05-21 13:16 . 2013-04-04 03:00	391168	----a-w-	c:\windows\system32\CNMLMBV.DLL
2014-05-21 13:13 . 2014-06-08 16:26	--------	d-----w-	c:\programdata\CanonIJPLM
2014-05-21 13:13 . 2014-05-21 13:13	--------	d--h--w-	c:\programdata\CanonIJETV
2014-05-21 13:12 . 2014-05-21 13:25	--------	d-----w-	c:\program files (x86)\Canon
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-15 13:19 . 2012-06-14 09:16	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-15 13:19 . 2011-07-24 06:30	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-17 03:31 . 2014-04-25 18:39	10651704	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{B222B95F-1CE0-40EC-9653-6BE927BB1EFA}\mpengine.dll
2014-04-09 17:43 . 2011-10-22 12:37	90655440	----a-w-	c:\windows\system32\MRT.exe
2014-03-31 07:35 . 2010-11-21 03:27	270496	------w-	c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{A18A516C-AA41-46A9-92DB-60208917E442}]
2013-12-11 14:49	184400	----a-w-	c:\program files (x86)\Avira\Internet Explorer\avira32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}]
2013-06-11 02:28	301464	----a-w-	c:\program files (x86)\Softonic\Softonic\1.8.21.14\bh\Softonic.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-10-31 21:08	277560	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{5018CFD2-804D-4C99-9F81-25EAEA2769DE}"= "c:\program files (x86)\Softonic\Softonic\1.8.21.14\SoftonicTlbr.dll" [2013-06-11 296856]
.
[HKEY_CLASSES_ROOT\clsid\{5018cfd2-804d-4c99-9f81-25eaea2769de}]
[HKEY_CLASSES_ROOT\Softonic.dskBnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[HKEY_CLASSES_ROOT\Softonic.dskBnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-27 168504]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2014-05-08 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-05-17 61112]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"TrayServer"="c:\program files (x86)\MAGIX\Video_deluxe_15_Plus\TrayServer.exe" [2008-08-07 90112]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-09-28 343168]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"Magic Desktop for HP notification"="c:\programdata\Easybits Magic Desktop for HP\mdhpSUN.exe" [2013-12-29 1258504]
"CanonQuickMenu"="c:\program files (x86)\Canon\Quick Menu\CNQMMAIN.EXE" [2013-04-02 1282632]
"IJNetworkScannerSelectorEX"="c:\program files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2013-02-19 453736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.141\SSScheduler.exe [2014-1-16 329944]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office\OSA9.EXE -b -l [1999-2-18 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 CPCSScheduler;CPCSScheduler;c:\program files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe;c:\program files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe [x]
R2 CPCSService;CPCSService;c:\program files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe;c:\program files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe [x]
R2 pricemeterliveUpdate;PriceMeterLiveUpdate Service (pricemeterliveUpdate);c:\program files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe;c:\program files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [x]
R2 TorchCrashHandler;Torch Crash Handler;c:\users\Barbara\AppData\Local\Torch\Update\TorchCrashHandler.exe;c:\users\Barbara\AppData\Local\Torch\Update\TorchCrashHandler.exe [x]
R3 CPCSProtector;CPCSProtector;c:\windows\system32\drivers\cpcs.sys;c:\windows\SYSNATIVE\drivers\cpcs.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\MAGIX\Common\Database\bin\fbserver.exe;c:\program files (x86)\MAGIX\Common\Database\bin\fbserver.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe [x]
R3 pricemeterliveUpdatem;PriceMeterLiveUpdate Service (pricemeterliveUpdatem);c:\program files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe;c:\program files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 UPnPService;UPnPService;c:\program files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe;c:\program files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-14 13:19]
.
2014-06-08 c:\windows\Tasks\ChicaPC-Shield-Notification.job
- c:\program files (x86)\ChicaLogic\ChicaPC-Shield\Toolkit\Sync.exe [2014-05-29 17:38]
.
2014-06-08 c:\windows\Tasks\HPCeeScheduleForBarbara.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
2014-06-08 c:\windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job
- c:\program files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-03-19 12:34]
.
2014-06-08 c:\windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job
- c:\program files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-03-19 12:34]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-10-31 21:08	336952	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-12-17 525312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-05-27 21720]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.at/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{49DA899B-1780-412F-8703-22283B704288}: NameServer = 5.39.219.212
TCP: Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: DhcpNameServer = 5.39.219.212
TCP: Interfaces\{9A9D1FBC-87CA-4829-BC09-82D62CCE9B59}: NameServer = 5.39.219.212
TCP: Interfaces\{CC169F16-7B04-4A88-957B-6A93AE37389A}: NameServer = 5.39.219.212
FF - ProfilePath - c:\users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/
FF - prefs.js: keyword.URL - hxxp://dts.search.ask.com/sr?src=ffb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=9411110305954883&o=APN10640&q=
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: !HIDDEN! 2013-11-13 18:48; {ACAA314B-EEBA-48e4-AD47-84E31C44796C}; c:\program files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF - user.js: extensions.softonic_i.hmpg - true
FF - user.js: extensions.softonic_i.hmpgUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=13&cc=
FF - user.js: extensions.softonic_i.dfltSrch - true
FF - user.js: extensions.softonic_i.srchPrvdr - Search the web (Softonic)
FF - user.js: extensions.softonic_i.keyWordUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=2&cc=&q=
FF - user.js: extensions.softonic_i.dnsErr - true
FF - user.js: extensions.softonic_i.newTab - true
FF - user.js: extensions.softonic_i.newTabUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=15&cc=
FF - user.js: extensions.softonic_i.tlbrSrchUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.softonic_i.id - defcf2ea000000000000ac81129fcd74
FF - user.js: extensions.softonic_i.instlDay - 15386
FF - user.js: extensions.softonic_i.vrsn - 1.5.11.5
FF - user.js: extensions.softonic_i.vrsni - 1.5.11.5
FF - user.js: extensions.softonic_i.vrsnTs - 1.5.11.516:17
FF - user.js: extensions.softonic_i.prtnrId - softonic
FF - user.js: extensions.softonic_i.prdct - softonic
FF - user.js: extensions.softonic_i.aflt - SD
FF - user.js: extensions.softonic_i.smplGrp - eng7
FF - user.js: extensions.softonic_i.tlbrId - de12JANdefault
FF - user.js: extensions.softonic_i.instlRef - MON00015
FF - user.js: extensions.softonic_i.dfltLng - de
FF - user.js: extensions.softonic_i.excTlbr - false
FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=defcf2ea000000000000ac81129fcd74&q=
FF - user.js: extensions.Softonic.id - defcf2ea000000000000ac81129fcd74
FF - user.js: extensions.Softonic.appId - {7ABBFE1C-E485-44AA-8F36-353751B4124D}
FF - user.js: extensions.Softonic.instlDay - 16022
FF - user.js: extensions.Softonic.vrsn - 1.8.21.14
FF - user.js: extensions.Softonic.vrsni - 1.8.21.14
FF - user.js: extensions.Softonic.vrsnTs - 1.8.21.1418:49
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - OC
FF - user.js: extensions.Softonic.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - opencandy2013
FF - user.js: extensions.Softonic.instlRef - MOY00621
FF - user.js: extensions.Softonic.dfltLng - de
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.ffxUnstlRst - false
FF - user.js: extensions.Softonic.admin - false
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic.rvrt - false
FF - user.js: extensions.Softonic.hmpg - true
FF - user.js: extensions.Softonic.hmpgUrl - hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=defcf2ea000000000000ac81129fcd74
FF - user.js: extensions.Softonic.dfltSrch - true
FF - user.js: extensions.Softonic.srchPrvdr - Search the web (Softonic)
FF - user.js: extensions.Softonic.dnsErr - true
FF - user.js: extensions.Softonic.newTab - true
FF - user.js: extensions.Softonic.newTabUrl - hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=defcf2ea000000000000ac81129fcd74
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-Rainlendar2 - c:\program files (x86)\Rainlendar2\Rainlendar2.exe
Wow6432Node-HKCU-Run-iLivid - c:\users\Barbara\AppData\Local\iLivid\iLivid.exe
Wow6432Node-HKCU-Run-PriceMeterW - c:\users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe
Wow6432Node-HKCU-Run-68BEmoyz - c:\programdata\68BEmoyz.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-10 - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-bi_uninstaller - c:\users\Barbara\Local Settings\Application Data\Bundled software uninstaller\biSetup54848.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-Macromedia Shockwave Player - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-08  18:49:03
ComboFix-quarantined-files.txt  2014-06-08 16:49
.
Vor Suchlauf: 9 Verzeichnis(se), 579.295.797.248 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 582.556.811.264 Bytes frei
.
- - End Of File - - 309D9CCEF0A8546672B7C3E824CC6736
A36C5E4F47E84449FF07ED3517B43A31
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Nun habe ich Mbamüber den Computer laufen lassen , mit folgendem Ergebnis :

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 09.06.2014
Suchlauf-Zeit: 09:31:19
Logdatei: mbam1.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Barbara

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 247116
Verstrichene Zeit: 10 Min, 17 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         

anschließend ADW Cleaner scannen lassen - allerdings kamen bei mir RO und SO Logfiles heraus !!

Danach habe ich JRT installiert und laufen lassen - mit folgendem Ergebnis:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Barbara on 09.06.2014 at 10:04:28,01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BB5BE563-6BE3-473B-96FE-66E09EEE33A9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E470252B-2B36-4497-8AFE-F39C17A4E358}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{E470252B-2B36-4497-8AFE-F39C17A4E358}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\fighters"
Successfully deleted: [Folder] "C:\Users\Barbara\AppData\Roaming\fighters"
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{03139828-5D42-44A9-B40F-2505F093EAB5}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{07480BE8-814B-43F1-A164-ABB930C4BAF8}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{09ECFEF7-35DD-440F-8F71-6B53C2E71D32}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{1038DC1E-714B-4B0A-9030-D5DB09976245}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{1640DCCE-3164-4601-B5C5-62D218904408}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{16667A6A-C04A-493E-A093-1B68D5BD0665}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{1712373A-7682-4CAE-A703-8DEDBE60BDE9}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{1C8DF934-8EE2-4972-B2B2-5A5D364990A1}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{247DAFA2-F78D-4FD3-AFEA-2349A6A4388C}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{2C06832B-7A1A-4A13-B16E-99637D056AF3}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{30B27184-D219-4CE4-8509-6EEFF152B8B6}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{318DCFFA-581B-4DCB-8D77-104C917E416E}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{3620C0B8-046F-4F8B-A96D-40FBF603A4EC}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{3BCF5062-B2DA-45EB-B4DC-97A870968656}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{453CC534-BA89-4CF0-8148-14232E2D2A8F}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{49FF6901-910E-4D64-8CD0-9326622371B5}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{4B46F9B5-A6A0-4A25-9F25-40AA3C519A4D}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{51DD1532-6D7E-4A2D-8CBE-8BC808B11878}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{57660DC2-2D3E-4A15-83C0-40F36287AB27}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{5F9875C4-5E99-4F51-99CF-0EAC7504B5FD}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{6114A912-4698-4DB9-8810-8897FD5AC1CD}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{6429F0AF-881F-41FD-8156-0D7E6F7F523F}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{69407C49-2143-4CC6-822E-B4500D228960}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{6E7F948B-5916-477B-8792-0F64933569AA}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{743C0AF9-73F7-4335-91D6-953D62F5921C}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{78369B37-F636-4230-8FBB-AB69BB85ED72}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{7E0E7474-FEE2-455B-88D2-85D755325EF4}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{7F7F6E8B-2B3C-43D0-988B-585281C36668}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{7FD24000-D729-40D0-918A-469D72B1200C}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{86D6E2D1-162B-4CA9-A41F-9945F7CC623E}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{8E3AFF45-B453-4D67-BB7C-635A624ADC7E}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{97358843-F53C-4EF4-BFE3-01AF772B8D32}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{A9E820BA-B4D5-47DF-A8AE-A47B204E5DB7}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{B0852EC0-0227-4697-BF60-28108C1E3BDC}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{B1340202-D725-4409-B0F1-63420937A3C4}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{B77FB3B2-D9CD-4B53-8C46-DE4FC94DA9BC}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{BA4FBA74-6761-4BC5-993B-F7E85F7759B6}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{BC7890A8-75A3-4AB3-8AEC-A231BAF4DA3D}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{C26658E7-B24C-4F0F-94C6-3B940802E62A}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{C2A32518-5E15-4B51-8F78-FD80DFF9E123}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{CAEE2470-619B-4485-9293-F13806024EDC}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{CC2806F4-81BA-417A-B46F-EF48DA381075}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{D0476918-6720-4DDF-8088-985D27A79062}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{D7DC99DD-A04C-4AB5-AFE6-E3A85E76B654}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{DA3EEB4A-A374-44E8-BA9C-BA01BFFC2145}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{DAA0F4E7-FB09-43D8-8ABF-3B518DEE85C6}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{E690719C-596F-4BC6-9967-B36F0A211CE4}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{EE4F3EE4-D28E-4D4E-9249-FC30E583760E}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{F03015FE-75B4-4534-A84E-FB050CA537FF}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{F24B49DF-B829-4C75-A528-19B3E3660700}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{F2D2ADDF-6FFC-467D-9F65-9C00502EF637}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{F6F6F22A-4A7B-4D09-A60D-36463D3C6123}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{F7D367D1-A339-43A5-9C91-2D075DF29B25}
Successfully deleted: [Empty Folder] C:\Users\Barbara\appdata\local\{FB73DB67-3DEA-4BA1-B535-49631DE32D94}



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted the following from C:\Users\Barbara\AppData\Roaming\mozilla\firefox\profiles\o0chjimb.default\prefs.js

user_pref("keyword.URL", "hxxp://dts.search.ask.com/sr?src=ffb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=9411110305954883&o=APN10640&q="
Emptied folder: C:\Users\Barbara\AppData\Roaming\mozilla\firefox\profiles\o0chjimb.default\minidumps [329 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.06.2014 at 10:13:46,40
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Als letztes das Ergebnis des FRST Logs :


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-06-2014
Ran by Barbara (administrator) on BARBARA-HP on 09-06-2014 10:15:04
Running from C:\Users\Barbara\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
(CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [TrayServer] => C:\Program Files (x86)\MAGIX\Video_deluxe_15_Plus\TrayServer.exe [90112 2008-08-07] (MAGIX AG)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-29] (Easybits)
HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282632 2013-04-02] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-27] (Hewlett-Packard)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_uid=9411110305954883&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM - {E470252B-2B36-4497-8AFE-F39C17A4E358} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3324760&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=5&UP=SP4D3F4BC0-2AB9-4401-AA2F-CF2C2A05B600&q={searchTerms}&SSPV=
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll (CANON INC.)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Avira Savings Advisor BHO - {A18A516C-AA41-46A9-92DB-60208917E442} - C:\Program Files (x86)\avira\Internet Explorer\avira32.dll ()
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-07-24] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{49DA899B-1780-412F-8703-22283B704288}: [NameServer]5.39.219.212
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer]5.39.219.212
Tcpip\..\Interfaces\{9A9D1FBC-87CA-4829-BC09-82D62CCE9B59}: [NameServer]5.39.219.212
Tcpip\..\Interfaces\{CC169F16-7B04-4A88-957B-6A93AE37389A}: [NameServer]5.39.219.212

FireFox:
========
FF ProfilePath: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://www.google.at/
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Savings Advisor - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\ciuvo-extension@avira.de [2014-05-26]
FF Extension: Ask New Tabs - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{8E69E270-96C8-161B-D584-8E724EEC279D} [2014-04-05]
FF Extension: Movies Toolbar (Dist. by Somoto Ltd.) - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{c75a2d66-6d1d-4735-8f63-9d85dcc026a6} [2014-04-05]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-22]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (No Name) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf [2013-11-13]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-09-28] (Advanced Micro Devices, Inc.)
S2 CPCSScheduler; C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe [418376 2013-06-09] (ChicaLogic)
S2 CPCSService; C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe [701512 2013-06-09] (ChicaLogic)
S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 CPCSProtector; C:\Windows\system32\drivers\cpcs.sys [25928 2013-04-04] (ChicaLogic)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-09] (Malwarebytes Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-09 10:13 - 2014-06-09 10:13 - 00007804 _____ () C:\Users\Barbara\Desktop\JRT.txt
2014-06-09 10:04 - 2014-06-09 10:04 - 00000000 ____D () C:\Windows\ERUNT
2014-06-09 10:01 - 2014-06-09 10:02 - 01016261 _____ (Thisisu) C:\Users\Barbara\Desktop\JRT.exe
2014-06-09 09:48 - 2014-06-09 09:53 - 00000000 ____D () C:\AdwCleaner
2014-06-09 09:48 - 2014-06-09 09:48 - 01333465 _____ () C:\Users\Barbara\Desktop\adwcleaner_3.212.exe
2014-06-09 09:43 - 2014-06-09 09:43 - 00001162 _____ () C:\Users\Barbara\Desktop\mbam1.txt
2014-06-08 18:49 - 2014-06-08 18:49 - 00026648 _____ () C:\ComboFix.txt
2014-06-08 18:49 - 2014-06-08 18:49 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-08 18:49 - 2014-06-08 18:49 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-08 18:49 - 2014-06-08 18:49 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-08 18:22 - 2014-06-08 18:49 - 00000000 ____D () C:\Qoobox
2014-06-08 18:22 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-08 18:22 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-08 18:22 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-08 18:22 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-08 18:22 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-08 18:22 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-08 18:22 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-08 18:22 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-08 18:21 - 2014-06-08 18:47 - 00000000 ____D () C:\Windows\erdnt
2014-06-08 18:21 - 2014-06-08 18:21 - 05205146 ____R (Swearware) C:\Users\Barbara\Desktop\ComboFix.exe
2014-06-08 18:13 - 2014-06-08 18:13 - 00001228 _____ () C:\Users\Barbara\Desktop\Revo Uninstaller.lnk
2014-06-08 18:13 - 2014-06-08 18:13 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-08 18:12 - 2014-06-08 18:12 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Barbara\Desktop\revosetup95.exe
2014-06-08 15:33 - 2014-06-08 15:33 - 754730286 _____ () C:\Windows\MEMORY.DMP
2014-06-08 15:33 - 2014-06-08 15:33 - 00500096 _____ () C:\Windows\Minidump\060814-32963-01.dmp
2014-06-08 15:33 - 2014-06-08 15:33 - 00000000 ____D () C:\Windows\Minidump
2014-06-08 14:39 - 2014-06-08 14:39 - 00004833 _____ () C:\Users\Barbara\Desktop\gmer..log
2014-06-08 14:09 - 2014-06-08 14:09 - 00380416 _____ () C:\Users\Barbara\Desktop\Gmer-19357.exe
2014-06-08 13:58 - 2014-06-09 10:15 - 00017398 _____ () C:\Users\Barbara\Desktop\FRST.txt
2014-06-08 13:58 - 2014-06-08 13:59 - 00035817 _____ () C:\Users\Barbara\Desktop\Addition.txt
2014-06-08 13:57 - 2014-06-09 10:15 - 00000000 ____D () C:\FRST
2014-06-08 13:56 - 2014-06-08 13:56 - 02072576 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe
2014-06-08 13:55 - 2014-06-08 13:55 - 00000476 _____ () C:\Users\Barbara\Desktop\defogger_disable.log
2014-06-08 13:55 - 2014-06-08 13:55 - 00000000 _____ () C:\Users\Barbara\defogger_reenable
2014-06-08 13:53 - 2014-06-08 13:54 - 00050477 _____ () C:\Users\Barbara\Desktop\Defogger.exe
2014-06-08 13:52 - 2014-06-08 13:52 - 00001058 _____ () C:\Users\Barbara\Desktop\mbam.txt
2014-06-08 13:17 - 2014-06-09 09:30 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-29 20:02 - 2014-05-29 20:02 - 00027386 _____ () C:\Users\Barbara\Documents\trojaner.xml
2014-05-29 19:40 - 2014-06-09 09:57 - 00000454 _____ () C:\Windows\Tasks\ChicaPC-Shield-Notification.job
2014-05-29 19:40 - 2014-05-29 19:40 - 00003526 _____ () C:\Windows\System32\Tasks\ChicaPC-Shield-Notification
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\ProgramData\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Program Files (x86)\ChicaLogic
2014-05-29 19:39 - 2013-04-04 14:51 - 00025928 _____ (ChicaLogic) C:\Windows\system32\Drivers\cpcs.sys
2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\ProgramData\clp
2014-05-29 19:35 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Common Toolkit Suite
2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\ProgramData\Licenses
2014-05-29 18:47 - 2014-06-09 10:02 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-05-29 18:46 - 2014-05-29 18:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Barbara\Desktop\wzmp_8.exe
2014-05-29 18:46 - 2014-05-29 18:46 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-05-29 18:46 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-05-26 22:00 - 2014-05-26 22:00 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-26 19:19 - 2014-05-26 19:19 - 00003408 _____ () C:\Windows\System32\Tasks\aviraSWU
2014-05-26 19:17 - 2014-06-08 18:26 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-05-22 16:57 - 2014-05-22 16:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-22 16:57 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-22 16:57 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-22 16:57 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-22 16:29 - 2014-06-08 18:33 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-05-21 15:44 - 2014-05-21 15:45 - 00000000 ___HD () C:\ProgramData\CanonIJMIG
2014-05-21 15:34 - 2014-05-21 15:34 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-21 15:31 - 2014-05-21 15:32 - 00000000 ___HD () C:\ProgramData\CanonIJScan
2014-05-21 15:26 - 2014-05-21 15:26 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-05-21 15:23 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Canon IJ Network Tool
2014-05-21 15:23 - 2013-02-04 15:10 - 00321536 _____ (CANON INC.) C:\Windows\SysWOW64\CNC_BVL.dll
2014-05-21 15:23 - 2012-11-26 12:32 - 00088576 _____ () C:\Windows\SysWOW64\CNC176ED.TBL
2014-05-21 15:23 - 2008-08-25 18:02 - 00015872 _____ (CANON INC.) C:\Windows\SysWOW64\CNHMCA.dll
2014-05-21 15:22 - 2014-05-21 15:22 - 00001985 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Benutzerregistrierung
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-21 15:22 - 2013-01-24 09:24 - 00359936 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL
2014-05-21 15:22 - 2013-01-24 09:24 - 00039424 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL
2014-05-21 15:22 - 2013-01-24 09:23 - 00366592 _____ (CANON INC.) C:\Windows\SysWOW64\CNMNPPM.DLL
2014-05-21 15:17 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-21 15:17 - 2014-05-21 15:17 - 00002320 _____ () C:\Users\Public\Desktop\Canon MG3500 series On-Screen-Handbuch.lnk
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Manual
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\Program Files\Canon
2014-05-21 15:16 - 2014-05-21 15:16 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-21 15:16 - 2013-04-04 05:00 - 00391168 _____ (CANON INC.) C:\Windows\system32\CNMLMBV.DLL
2014-05-21 15:13 - 2014-06-08 18:26 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-05-21 15:13 - 2014-05-21 15:13 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-05-21 15:12 - 2014-05-21 15:25 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-11 15:23 - 2014-05-11 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-06-09 10:15 - 2014-06-08 13:58 - 00017398 _____ () C:\Users\Barbara\Desktop\FRST.txt
2014-06-09 10:15 - 2014-06-08 13:57 - 00000000 ____D () C:\FRST
2014-06-09 10:15 - 2011-10-22 13:01 - 00000000 ____D () C:\Users\Barbara\AppData\Local\Temp
2014-06-09 10:13 - 2014-06-09 10:13 - 00007804 _____ () C:\Users\Barbara\Desktop\JRT.txt
2014-06-09 10:06 - 2012-06-14 11:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-09 10:04 - 2014-06-09 10:04 - 00000000 ____D () C:\Windows\ERUNT
2014-06-09 10:04 - 2009-07-14 06:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-09 10:04 - 2009-07-14 06:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-09 10:02 - 2014-06-09 10:01 - 01016261 _____ (Thisisu) C:\Users\Barbara\Desktop\JRT.exe
2014-06-09 10:02 - 2014-05-29 18:47 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-06-09 10:01 - 2011-07-15 00:59 - 01459001 _____ () C:\Windows\WindowsUpdate.log
2014-06-09 09:57 - 2014-05-29 19:40 - 00000454 _____ () C:\Windows\Tasks\ChicaPC-Shield-Notification.job
2014-06-09 09:56 - 2010-11-21 05:47 - 01246442 _____ () C:\Windows\PFRO.log
2014-06-09 09:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-09 09:56 - 2009-07-14 06:51 - 00079376 _____ () C:\Windows\setupact.log
2014-06-09 09:53 - 2014-06-09 09:48 - 00000000 ____D () C:\AdwCleaner
2014-06-09 09:53 - 2011-10-22 15:23 - 00000000 ____D () C:\Users\Barbara\Desktop\SAVE
2014-06-09 09:48 - 2014-06-09 09:48 - 01333465 _____ () C:\Users\Barbara\Desktop\adwcleaner_3.212.exe
2014-06-09 09:43 - 2014-06-09 09:43 - 00001162 _____ () C:\Users\Barbara\Desktop\mbam1.txt
2014-06-09 09:30 - 2014-06-08 13:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-08 18:49 - 2014-06-08 18:49 - 00026648 _____ () C:\ComboFix.txt
2014-06-08 18:49 - 2014-06-08 18:49 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-08 18:49 - 2014-06-08 18:49 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-08 18:49 - 2014-06-08 18:49 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-08 18:49 - 2014-06-08 18:22 - 00000000 ____D () C:\Qoobox
2014-06-08 18:49 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-06-08 18:47 - 2014-06-08 18:21 - 00000000 ____D () C:\Windows\erdnt
2014-06-08 18:46 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-08 18:41 - 2011-07-15 01:18 - 00000000 ____D () C:\ProgramData\Temp
2014-06-08 18:33 - 2014-05-22 16:29 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-06-08 18:26 - 2014-05-26 19:17 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-06-08 18:26 - 2014-05-21 15:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-08 18:26 - 2012-07-02 16:56 - 00000340 _____ () C:\Windows\Tasks\HPCeeScheduleForBarbara.job
2014-06-08 18:21 - 2014-06-08 18:21 - 05205146 ____R (Swearware) C:\Users\Barbara\Desktop\ComboFix.exe
2014-06-08 18:13 - 2014-06-08 18:13 - 00001228 _____ () C:\Users\Barbara\Desktop\Revo Uninstaller.lnk
2014-06-08 18:13 - 2014-06-08 18:13 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-06-08 18:12 - 2014-06-08 18:12 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Barbara\Desktop\revosetup95.exe
2014-06-08 18:10 - 2012-07-02 16:56 - 00003198 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForBarbara
2014-06-08 18:10 - 2012-04-30 08:07 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-08 18:10 - 2012-03-05 08:47 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-06-08 15:38 - 2013-05-20 13:12 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\canon
2014-06-08 15:33 - 2014-06-08 15:33 - 754730286 _____ () C:\Windows\MEMORY.DMP
2014-06-08 15:33 - 2014-06-08 15:33 - 00500096 _____ () C:\Windows\Minidump\060814-32963-01.dmp
2014-06-08 15:33 - 2014-06-08 15:33 - 00000000 ____D () C:\Windows\Minidump
2014-06-08 14:39 - 2014-06-08 14:39 - 00004833 _____ () C:\Users\Barbara\Desktop\gmer..log
2014-06-08 14:32 - 2011-10-22 13:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C9177807-72A8-4EF1-B4BF-EF146260FFFE}
2014-06-08 14:09 - 2014-06-08 14:09 - 00380416 _____ () C:\Users\Barbara\Desktop\Gmer-19357.exe
2014-06-08 13:59 - 2014-06-08 13:58 - 00035817 _____ () C:\Users\Barbara\Desktop\Addition.txt
2014-06-08 13:56 - 2014-06-08 13:56 - 02072576 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe
2014-06-08 13:55 - 2014-06-08 13:55 - 00000476 _____ () C:\Users\Barbara\Desktop\defogger_disable.log
2014-06-08 13:55 - 2014-06-08 13:55 - 00000000 _____ () C:\Users\Barbara\defogger_reenable
2014-06-08 13:55 - 2011-10-22 13:01 - 00000000 ____D () C:\Users\Barbara
2014-06-08 13:54 - 2014-06-08 13:53 - 00050477 _____ () C:\Users\Barbara\Desktop\Defogger.exe
2014-06-08 13:52 - 2014-06-08 13:52 - 00001058 _____ () C:\Users\Barbara\Desktop\mbam.txt
2014-06-08 13:17 - 2011-11-19 12:31 - 00000000 ____D () C:\Users\Barbara\AppData\Local\CrashDumps
2014-06-07 21:39 - 2013-11-13 19:35 - 00092160 ___SH () C:\Users\Barbara\Desktop\Thumbs.db
2014-06-06 08:24 - 2011-07-24 17:40 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-06-06 08:24 - 2011-07-24 17:40 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-06-06 08:24 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-29 20:02 - 2014-05-29 20:02 - 00027386 _____ () C:\Users\Barbara\Documents\trojaner.xml
2014-05-29 19:40 - 2014-05-29 19:40 - 00003526 _____ () C:\Windows\System32\Tasks\ChicaPC-Shield-Notification
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\ProgramData\ChicaLogic
2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Program Files (x86)\ChicaLogic
2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\ProgramData\clp
2014-05-29 19:35 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Common Toolkit Suite
2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\ProgramData\Licenses
2014-05-29 18:46 - 2014-05-29 18:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Barbara\Desktop\wzmp_8.exe
2014-05-29 18:46 - 2014-05-29 18:46 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector
2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-05-29 18:41 - 2011-07-24 08:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-28 20:50 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-26 22:00 - 2014-05-26 22:00 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-26 19:19 - 2014-05-26 19:19 - 00003408 _____ () C:\Windows\System32\Tasks\aviraSWU
2014-05-22 17:39 - 2012-01-24 09:26 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-22 17:39 - 2011-07-24 08:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-22 17:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\L2Schemas
2014-05-22 16:57 - 2014-05-22 16:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-05-21 15:45 - 2014-05-21 15:44 - 00000000 ___HD () C:\ProgramData\CanonIJMIG
2014-05-21 15:34 - 2014-05-21 15:34 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-21 15:32 - 2014-05-21 15:31 - 00000000 ___HD () C:\ProgramData\CanonIJScan
2014-05-21 15:26 - 2014-05-21 15:26 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu
2014-05-21 15:25 - 2014-05-21 15:12 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-21 15:23 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Canon IJ Network Tool
2014-05-21 15:23 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-21 15:23 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-05-21 15:22 - 2014-05-21 15:22 - 00001985 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Benutzerregistrierung
2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-21 15:17 - 2014-05-21 15:17 - 00002320 _____ () C:\Users\Public\Desktop\Canon MG3500 series On-Screen-Handbuch.lnk
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Manual
2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\Program Files\Canon
2014-05-21 15:16 - 2014-05-21 15:16 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-21 15:13 - 2014-05-21 15:13 - 00000000 ___HD () C:\ProgramData\CanonIJETV
2014-05-15 15:19 - 2012-06-14 11:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-15 15:19 - 2012-06-14 11:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-15 15:19 - 2011-07-24 08:30 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-12 20:36 - 2013-05-22 15:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-12 07:26 - 2014-05-22 16:57 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-22 16:57 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-22 16:57 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-11 15:23 - 2014-05-11 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

Some content of TEMP:
====================
C:\Users\Barbara\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 10:06

==================== End Of Log ============================
         

--- --- ---


Gruß Andreas

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Habe versucht den eset scanner down zu loaden - werde auf die Seite auch weiter geleitet aber download startet bei mir nicht !

Mach nen Vollscan mit deinem AV Programm und lass ESET weg.

Habe jetzt mit WinZip Malware Protector einen Scan laufen lassen da mein Laptop mir die Öffnung von Avira verweigert!

Dies kann leider nur als xml ausgegeben werden:

Nico Mak Computing 
WinZip Malware Protector 
 
Datum der Überprüfung Mittwoch, 11. Juni 2014 
Datenbankversion 1830 
Gefundene Elemente insgesamt 36 
Überprüfte Objekte: 444631 
Abgelaufene Zeit: 00:52:56 
Name Gefundene Elemente 

Name der Infektion trojan-backdoor.bifrose 
Kategorie Backdoor 
Bedrohungsstufe Severe 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 1 
 
Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_current_user 
 software\wget 
  
 
 

Name der Infektion roguesecurityprogram.winantivirus-pro-2006 
Kategorie Rogue Antispyware Program 
Bedrohungsstufe Severe 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 6 
 
Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 *\shellex\contextmenuhandlers\shellextension 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 directory\shellex\contextmenuhandlers\shellextension 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 drive\shellex\contextmenuhandlers\shellextension 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 software\classes\*\shellex\contextmenuhandlers\shellextension 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 software\classes\directory\shellex\contextmenuhandlers\shellextension 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 software\classes\drive\shellex\contextmenuhandlers\shellextension 
  
 
 

Name der Infektion roguesecurityprogram.pro-antispyware-2009 
Kategorie Rogue Antispyware Program 
Bedrohungsstufe Severe 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 2 
 
Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_current_user 
 software\microsoft\windows\currentversion\drivers\video 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_current_user 
 software\microsoft\windows\currentversion\drivers\video\options 
  
 
 

Name der Infektion roguesecurityprogram.ms-antispyware-2009 
Kategorie Rogue Antispyware Program 
Bedrohungsstufe Severe 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 1 
 
Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_current_user 
 software\microsoft\windows\currentversion\drivers 
  
 
 

Name der Infektion trojan-spy.banker 
Kategorie Trojan Spy 
Bedrohungsstufe Elevated 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 6 
 
Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 system\currentcontrolset\services\catchme 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 system\currentcontrolset\services\catchme 
 type 
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 system\currentcontrolset\services\catchme 
 errorcontrol 
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 system\currentcontrolset\services\catchme 
 start 
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 system\currentcontrolset\services\catchme 
 imagepath 
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_local_machine 
 system\currentcontrolset\services\catchme 
 group 
 
 

Name der Infektion pup.optional 
Kategorie Potentially Unwanted Application 
Bedrohungsstufe High 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 13 
 
Gefundener Bereich FileSystem 
Details 
Dateiname c:\adwcleaner\quarantine\c\program files (x86)\pricemeterliveupdate\update\pricemeterliveupdate.exe.vir 
MD5 0 
Signatur 2037073289190167167 
Md5hash:  3d8b851e7efcdc130e4b301bdde10099 
 

Gefundener Bereich FileSystem 
Details 
Dateiname c:\adwcleaner\quarantine\c\program files (x86)\pricemeterliveupdate\update\1.3.23.0\pricemeterliveupdate.exe.vir 
MD5 0 
Signatur 2037073289190167167 
Md5hash:  3d8b851e7efcdc130e4b301bdde10099 
 

Gefundener Bereich FileSystem 
Details 
Dateiname c:\adwcleaner\quarantine\c\program files (x86)\pricemeterliveupdate\update\1.3.23.0\pricemeterliveupdatehandler.exe.vir 
MD5 0 
Signatur 2037073289190167167 
Md5hash:  3d8b851e7efcdc130e4b301bdde10099 
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 interface\{68fd483f-a55d-4b78-ae10-48ef2bbe317e} 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 interface\{68fd483f-a55d-4b78-ae10-48ef2bbe317e}\proxystubclsid32 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 interface\{68fd483f-a55d-4b78-ae10-48ef2bbe317e}\typelib 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 interface\{68fd483f-a55d-4b78-ae10-48ef2bbe317e}\typelib 
 version 
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 typelib\{dd7858c7-889a-42e4-9863-e4aa3a0bfe65} 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 typelib\{dd7858c7-889a-42e4-9863-e4aa3a0bfe65}\1.0 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 typelib\{dd7858c7-889a-42e4-9863-e4aa3a0bfe65}\1.0\0 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 typelib\{dd7858c7-889a-42e4-9863-e4aa3a0bfe65}\1.0\0\win64 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 typelib\{dd7858c7-889a-42e4-9863-e4aa3a0bfe65}\1.0\flags 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 typelib\{dd7858c7-889a-42e4-9863-e4aa3a0bfe65}\1.0\helpdir 
  
 
 

Name der Infektion malware.gen 
Kategorie Generic Malware  
Bedrohungsstufe High 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 1 
 
Gefundener Bereich FileSystem 
Details 
Dateiname c:\users\barbara\appdata\local\adobe\acrobat\10.0\cache\rdlang_search.deu 
MD5 0 
Signatur 17654218230491659401 
Md5hash:  196694774f04dc7f03c4971990f72205 
 
 

Name der Infektion adware.xmlmimefilter 
Kategorie Adware 
Bedrohungsstufe High 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 5 
 
Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 xmlmimefilter.xmlmimefilterpp.1\clsid 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 xmlmimefilter.xmlmimefilterpp.1 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 xmlmimefilter.xmlmimefilterpp\clsid 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 xmlmimefilter.xmlmimefilterpp\curver 
  
 

Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_classes_root 
 xmlmimefilter.xmlmimefilterpp 
  
 
 

Name der Infektion monitoring.employees-pc-monitor 
Kategorie Monitoring Tool 
Bedrohungsstufe High 
Durchgeführte Aktion NoActionTaken 
Elemente gefunden 1 
 
Gefundener Bereich Registry 
Details 
Registrierungsschlüssel hkey_users 
 s-1-5-18\software\microsoft\windows\currentversion\policies\system 
  
 
 
© 2013 WinZip International LLC. All rights reserved.
         

Habe jetzt mit WinZip Malware Protector einen Scan laufen lassen

wo hast du das her?

frisches FRST log bitte.