Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Download Protect 2.2.1 unter Firefox/Windows 8.1

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 05.08.2014, 23:56   #1
zimon
 
Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Guten Abend,

kurze Vorgeschichte: ich habe heute das Laptop einer guten Freundin bekommen mit dem Problem, dass nach der Anmeldung sich nichts mehr bedienen lies
und der Bildschirm in kurzen Abständen von komplett blau (kein bluescreen) zum Desktop und wieder zurück wechselte.
Mit einer einfachen Systemwiederherstellung war dieses Problem am Ende erledigt. Allerdings kam zwischendurch eine "0x800700b7" Fehlermeldung von Windows.
Die Wiederherstellung an sich dauerte mit rund 20 Minuten auch viiiel länger als in meiner bisherigen Erfahrung.

Aktuell: Mit dem Start von Firefox bekam ich dann die Installation von dem Download Protect 2.2.1 Add-On an den Kopf geworfen und durch bisschen Recherche lande ich nun hier. Hallo!



Wie in eurer Anleitung beschrieben gibt's folgende Logs:

- defogger: da kein Emulator installiert, nicht ausgeführt

- FRST:

FRST.txt
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Mimi (administrator) on MIRIAM on 05-08-2014 23:02:12
Running from C:\Users\Mimi\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
() C:\Windows\System32\FXSCOM64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2872176 2012-10-08] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3952128 2012-11-27] (Bitcasa, Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [Download Protect] => C:\ProgramData\dlprotect.exe
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4177645711-3970229063-862042014-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\PROGRA~2\SupTab\SEARCH~2.DLL File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => "C:\PROGRA~2\SupTab\SEARCH~1.DLL" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SYSTEM32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM-x32 - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - DefaultScope {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 209.244.0.3 209.244.0.4

FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default\user.js
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-07-14]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171664 2012-11-06] (Adobe Systems Incorporated)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1591176 2012-11-30] (Samsung Electronics CO., LTD.) [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [757872 2014-06-19] (Cherished Technololgy LIMITED)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe [264360 2013-10-08] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2878152 2012-12-21] (Samsung Electronics CO., LTD.)
R2 TiumbnailExtractionHost; C:\WINDOWS\system32\FXSCOM64.exe [119296 2014-05-25] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936 2014-07-06] (Fuyu LIMITED)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
S1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-09-26] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352456 2012-08-06] (EldoS Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSVia64.sys [520280 2013-09-24] (Symantec Corporation)
S3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\ENG64.SYS [126040 2013-10-04] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\EX64.SYS [2099288 2013-10-04] (Symantec Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-09] (Corel Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 SRTSP; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1501000.012\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-07-14] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 23:02 - 2014-08-05 23:02 - 00021289 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:01 - 2014-08-05 23:02 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files\{6C52C230-9950-4FFB-80AF-C37F06029831}
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files (x86)\{27EA5D06-3363-4C45-AA22-D4AA3CF528A1}
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-08-05 15:59 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-07-14 17:16 - 2014-08-05 16:10 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-07-14 17:16 - 2014-07-14 17:17 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-08-05 16:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-07 21:15 - 2014-08-05 15:50 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-06 18:25 - 2014-07-06 18:32 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-06 18:25 - 2014-07-06 18:28 - 00002640 _____ () C:\WINDOWS\System32\Tasks\UpdaterEX
2014-07-06 18:25 - 2014-07-06 18:28 - 00000302 _____ () C:\WINDOWS\Tasks\UpdaterEX.job
2014-07-06 18:25 - 2014-07-06 18:25 - 00000042 _____ () C:\Users\Mimi\AppData\Roaming\WB.CFG
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\Documents\PC Speed Maximizer
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\UpdaterEX
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-07-06 18:23 - 2014-07-06 18:23 - 28114944 _____ () C:\Users\Mimi\Downloads\SkypeSetup.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-05 23:02 - 2014-08-05 23:02 - 00021289 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:02 - 2014-08-05 23:01 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 23:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-05 22:57 - 2014-03-04 00:48 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-08-05 16:37 - 2013-01-03 07:27 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-05 16:35 - 2014-03-25 20:30 - 00000000 __RDO () C:\Users\Mimi\SkyDrive
2014-08-05 16:34 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-05 16:33 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-05 16:28 - 2014-04-08 15:01 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-08-05 16:11 - 2014-03-25 17:33 - 00000000 ____D () C:\Users\Mimi
2014-08-05 16:11 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 __RSD () C:\WINDOWS\Media
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-05 16:10 - 2014-07-14 17:16 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-08-05 16:10 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-05 16:10 - 2014-04-08 15:01 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iTunes
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-05 16:10 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-08-05 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2014-08-05 16:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-08-05 15:59 - 2014-07-14 17:17 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-08-05 15:56 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iPod
2014-08-05 15:55 - 2014-03-04 00:15 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4177645711-3970229063-862042014-1001
2014-08-05 15:50 - 2014-07-07 21:15 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-08-05 15:35 - 2013-11-14 09:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-05 15:35 - 2013-11-14 09:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-05 15:35 - 2013-11-14 09:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-05 15:32 - 2014-03-14 18:04 - 00266752 ___SH () C:\Users\Mimi\Downloads\Thumbs.db
2014-08-05 15:31 - 2013-08-22 16:46 - 00302552 _____ () C:\WINDOWS\setupact.log
2014-08-05 15:18 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\sonstiges
2014-08-05 15:18 - 2014-03-25 21:04 - 00419328 ___SH () C:\Users\Mimi\Desktop\Thumbs.db
2014-08-05 13:30 - 2014-03-25 17:52 - 01284851 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-05 13:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-05 11:19 - 2013-11-14 00:18 - 00968498 _____ () C:\WINDOWS\PFRO.log
2014-08-03 12:38 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\biochemie
2014-07-22 21:53 - 2014-04-01 08:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-16 20:20 - 2014-05-06 21:01 - 00000000 ____D () C:\Users\Mimi\Desktop\physiologie
2014-07-16 20:20 - 2014-04-27 20:12 - 00000000 ____D () C:\Users\Mimi\Desktop\uni
2014-07-16 20:20 - 2014-03-14 19:58 - 00000000 ____D () C:\Users\Mimi\Desktop\wp
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files\{6C52C230-9950-4FFB-80AF-C37F06029831}
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files (x86)\{27EA5D06-3363-4C45-AA22-D4AA3CF528A1}
2014-07-14 20:03 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:32 - 2014-03-05 13:25 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-07-14 17:30 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-07-14 17:16 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:16 - 2013-01-03 07:21 - 00000000 ____D () C:\ProgramData\Norton
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-13 22:34 - 2014-03-25 20:30 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DBBE89A8-5831-412F-8BAE-855B806DEBD3}
2014-07-09 12:29 - 2014-04-08 15:01 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-07-08 17:58 - 2014-03-13 15:35 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Microsoft Help
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-07 21:05 - 2014-03-04 00:06 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages
2014-07-06 18:32 - 2014-07-06 18:25 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-06 18:28 - 2014-07-06 18:25 - 00002640 _____ () C:\WINDOWS\System32\Tasks\UpdaterEX
2014-07-06 18:28 - 2014-07-06 18:25 - 00000302 _____ () C:\WINDOWS\Tasks\UpdaterEX.job
2014-07-06 18:25 - 2014-07-06 18:25 - 00000042 _____ () C:\Users\Mimi\AppData\Roaming\WB.CFG
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\Documents\PC Speed Maximizer
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\UpdaterEX
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-07-06 18:23 - 2014-07-06 18:23 - 28114944 _____ () C:\Users\Mimi\Downloads\SkypeSetup.exe

Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-05 15:31

==================== End Of Log ============================
         

Addition.txt
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-08-2014
Ran by Mimi at 2014-08-05 23:03:23
Running from C:\Users\Mimi\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton 360 (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (HKLM-x32\...\Adobe Photoshop Elements 11) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.5.100.20928 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{AE7512E0-E5C5-CD28-EE55-F778BDD73A88}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bitcasa version 0.9.20.4133 (HKLM\...\{EDA09459-AD7D-4434-BA0C-647F6703EA12}_is1) (Version: 0.9.20.4133 - Bitcasa Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Profiles Mobile (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4421.02 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.4421.02 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Easy File Share (HKLM-x32\...\{A7C37D4B-F37A-42E8-9B6A-B28C18AD4C12}) (Version: 1.3.4 - Samsung Electronics CO.,LTD.)
Elements 11 Organizer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
ETDWare X64 11.7.5.5_WHQL (HKLM\...\Elantech) (Version: 11.7.5.5 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Help Desk (HKLM\...\{3D85CD3F-00E0-4E14-82D6-1F9397DDD09B}) (Version: 1.0.8 - Samsung Electronics CO., LTD.)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33070) (Version: 3.6.1.33070.11 - Intel)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36702 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) PRO/Wireless Driver (Version: 16.01.5000.0577 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{0728A184-F899-4356-B93D-8228674F0DEB}) (Version: 2.6.1209.0268 - Motorola Solutions, Inc.)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.01.5000.0269 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.1.0.18 - Symantec Corporation)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.2.3.51 - Symantec Corporation)
Norton Online Backup ARA (x32 Version: 4.1.0.14 - Symantec Corporation) Hidden
Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
PowerXpressHybrid (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
PSE11 STI Installer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Raccolta foto (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.4.907.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6761 - Realtek Semiconductor Corp.)
Recovery (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 6.0.6.5 - Samsung Electronics CO., LTD.)
S Agent (Version: 1.0.9 - Samsung Electronics CO., LTD.) Hidden
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.3.38 - Client Connect LTD) <==== ATTENTION
Settings (HKLM-x32\...\{8CB5C357-12E5-41B1-A024-D57D4E6F32D9}) (Version: 2.0.1 - Samsung Electronics CO., LTD.)
Skype Click to Call (HKLM-x32\...\{BB285C9F-C821-4770-8970-56C4AB52C87E}) (Version: 7.2.15747.10003 - Microsoft Corporation)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Support Center (HKLM\...\{3EB3E946-FB88-45C2-A19B-410D254657D9}) (Version: 2.1.20 - Samsung Electronics CO., LTD.)
Support Center FAQ (x32 Version: 1.0.6 - Samsung Electronics CO., LTD.) Hidden
SW Update (HKLM-x32\...\{F5B5BA56-8FEB-494B-84E6-C8DA9C2BEE50}) (Version: 2.1.6 - Samsung Electronics CO., LTD.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
User Guide (HKLM-x32\...\{AAD986C1-5AC0-4E83-AEA4-44E10B78FB4A}) (Version: 1.2.00 - Samsung Electronics CO., LTD.)
Windows Live (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
WindowsMangerProtect20.0.0.502 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

14-07-2014 15:26:43 Windows Update
25-07-2014 19:57:06 Geplanter Prüfpunkt
03-08-2014 19:10:45 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0A00814E-B838-4F1B-B324-3D19B5E8F52F} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {0D088F4D-BFED-4D80-BAF9-9A306CF5EC00} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {193D7CCA-9341-4D55-9554-FD81CA24EE0B} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\WSCStub.exe [2013-10-08] (Symantec Corporation)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {36A68B68-6839-43DF-9183-E7013A56BACC} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2012-11-30] (Samsung Electronics CO., LTD.)
Task: {372DF15D-44D1-4950-99C7-2DCD7604237D} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {4A25F201-66C4-4B12-BB6D-B08F1DBF9B30} - System32\Tasks\UpdaterEX => C:\Users\Mimi\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {6497046C-59A9-41B7-B1D5-1E932E10AC16} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-06-16] (Microsoft Corporation)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6B5F1B93-37EC-47EF-B2D5-A800A9717173} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {6B8651D8-2659-410C-B7A2-3A04D7E7654B} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {79C5A075-5387-4F8A-9172-BDA03AEA28F5} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {7A0AEC93-AB2A-429D-B0C8-54CFEF56661B} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {8218CA1A-291C-49B4-BDFC-E21E76A61105} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9573E73F-F7E7-4C2D-AF44-8F132BB51F9A} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2012-10-25] (Samsung Electronics CO., LTD.)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {AC9FD6AC-6806-4359-86CE-78B1B04FB7B5} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {CA16D346-3114-4F80-9B27-29D13F6513F7} - \CreateChoiceProcessTask No Task File <==== ATTENTION
Task: {CB30FDD9-A09A-4381-AA37-7C2CE488D257} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2012-09-17] (SEC)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DE485150-987B-43AE-A495-5666621CC448} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\UpdaterEX.job => C:\Users\Mimi\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-06-22 07:42 - 2011-06-22 07:42 - 00034304 _____ () C:\WINDOWS\System32\ssp4ml6.dll
2014-05-25 10:41 - 2014-05-25 10:41 - 00119296 _____ () C:\WINDOWS\system32\FXSCOM64.exe
2012-11-30 09:26 - 2012-11-30 09:26 - 00082312 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
2014-01-25 03:22 - 2014-01-25 03:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00028792 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 01068664 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00026744 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00060536 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00103032 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll
2013-01-03 07:14 - 2012-06-25 20:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\WINDOWS\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade
AlternateDataStreams: C:\Users\Mimi\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "Bitcasa"
HKLM\...\StartupApproved\Run32: => "Adobe Reader Speed Launcher"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKCU\...\StartupApproved\Run: => "Skype"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/05/2014 07:45:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10821063

Error: (08/05/2014 07:45:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10821063

Error: (08/05/2014 07:45:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/05/2014 07:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10807110

Error: (08/05/2014 07:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10807110

Error: (08/05/2014 07:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/05/2014 04:36:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350e0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17055, Zeitstempel: 0x532954fb
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000000000005bf8
ID des fehlerhaften Prozesses: 0xf70
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Vollständiger Name des fehlerhaften Pakets: CCC.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CCC.exe5

Error: (08/05/2014 04:36:47 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
   bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
   bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   bei System.Threading.ThreadHelper.ThreadStart(System.Object)

Error: (08/05/2014 04:34:10 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start

Error: (08/05/2014 03:37:39 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1492) SRUJet: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\WINDOWS\system32\SRU\SRU005A5.log.


System errors:
=============
Error: (08/05/2014 04:30:46 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Norton 360" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/05/2014 03:23:22 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Intel® Centrino® Wireless Bluetooth® + High Speed Service" wurde nicht richtig gestartet.

Error: (08/05/2014 02:51:03 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet: 
%%2147770990

Error: (08/05/2014 01:50:04 PM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca

Error: (08/05/2014 00:54:42 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎05.‎08.‎2014 um 11:29:41 unerwartet heruntergefahren.

Error: (08/05/2014 11:29:41 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎05.‎08.‎2014 um 11:20:55 unerwartet heruntergefahren.

Error: (08/05/2014 10:47:35 AM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (08/05/2014 10:46:35 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.

Error: (08/04/2014 10:17:55 PM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (08/04/2014 10:17:25 PM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 8077.6 MB
Available physical RAM: 6795.03 MB
Total Pagefile: 16781.6 MB
Available Pagefile: 15459.62 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:907.21 GB) (Free:837.08 GB) NTFS
Drive d: (MULTIBOOT) (Removable) (Total:14.89 GB) (Free:12.2 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 03092743)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================
         



- Gmer:

schickte beim Start des Programms und am Ende des Scans folgende Meldung:

und folgende Meldung ebenfalls am Ende des Scans:


(Hab ich verpennt irgendwas zu deaktivieren?)


Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-05 23:24:59
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000025  rev. 0,00MB
Running: Gmer-19357.exe; Driver: C:\Users\Mimi\AppData\Local\Temp\ugldypod.sys


---- User code sections - GMER 2.1 ----

.text   C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                    00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                    00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                   00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                   00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                    00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                    00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                      00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                      00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                         00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                         00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                            00007ff870041f6a 4 bytes [04, 70, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                            00007ff870041f82 4 bytes [04, 70, F8, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506  00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514  00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118     00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142     00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506           00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514           00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118              00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142              00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                           00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                           00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                              00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                              00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                         00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                         00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                            00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                            00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text   C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text   C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118                                   00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text   C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142                                   00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text   C:\Program Files\Windows Media Player\wmpnetwk.exe[4808] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194                    00007ff870041f6a 4 bytes [04, 70, F8, 7F]
.text   C:\Program Files\Windows Media Player\wmpnetwk.exe[4808] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218                    00007ff870041f82 4 bytes [04, 70, F8, 7F]

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [712:736]                                                                                      fffff96000865b90
Thread  C:\WINDOWS\Explorer.EXE [2412:1056]                                                                                          00007ff86f06d6bc
Thread  C:\Windows\System32\SettingSyncHost.exe [2604:2548]                                                                          00007ff872c664f4

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                        unknown MBR code
Disk    \Device\Harddisk0\DR0                                                                                                        sector 0: rootkit-like behavior

---- EOF - GMER 2.1 ----
         


Meines Erachtens ist auch einiges an unnötiger Software installiert, aber das dürfte erstmal nebensächlich sein.
Über Hilfe bin ich (wir) sehr dankbar!


Viele Grüße,
Simon

Alt 06.08.2014, 03:47   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



hi,

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________

__________________

Alt 06.08.2014, 10:02   #3
zimon
 
Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Moin, danke für die fixe Antwort. Hab ein paar Logs dabei:

MBAM
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 06.08.2014
Suchlauf-Zeit: 09:18:20
Logdatei: mbam.txt
Administrator: Nein

Version: 2.00.2.1012
Malware Datenbank: v2014.03.04.09
Rootkit Datenbank: v2014.02.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Mimi

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 252157
Verstrichene Zeit: 8 Min, 58 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 1
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, 1244, Löschen bei Neustart, [2326e51a5d1dbe78a8922276ea17748c]

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 5
PUP.Optional.IePluginService.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, In Quarantäne, [2326e51a5d1dbe78a8922276ea17748c], 
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\sweet-pageSoftware, In Quarantäne, [e663926d6515fd3950623c83e81b0000], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, In Quarantäne, [60e944bbbfbbc96ddf97f0cfe91aa060], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [0a3f42bd7307c6705e1a1f7524de14ec], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [e26700ff4d2d57dfd1fd9b0fe1226d93], 

Registrierungswerte: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0V1D1S1R1D0V1O, In Quarantäne, [e26700ff4d2d57dfd1fd9b0fe1226d93]

Registrierungsdaten: 2
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}),Ersetzt,[af9ad72899e1d462f2bf85aa8282cd33]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}),Ersetzt,[fe4b926d3347ef478b265cd36e963dc3]

Ordner: 0
(No malicious items detected)

Dateien: 1
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, Löschen bei Neustart, [2326e51a5d1dbe78a8922276ea17748c], 

Physische Sektoren: 0
(No malicious items detected)


(end)
         


AdwCleaner
Programm ist beim ersten Löschen abgestürzt. Zweiter Versuch klappte.
Code:
ATTFilter
# AdwCleaner v3.302 - Bericht erstellt am 06/08/2014 um 09:37:02
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Mimi - MIRIAM
# Gestartet von : C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : TiumbnailExtractionHost

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Program Files (x86)\{27EA5D06-3363-4C45-AA22-D4AA3CF528A1}
Ordner Gelöscht : C:\Program Files\{6C52C230-9950-4FFB-80AF-C37F06029831}
Ordner Gelöscht : C:\Users\Mimi\AppData\Roaming\UpdaterEX
Ordner Gelöscht : C:\Users\Mimi\Documents\PC Speed Maximizer
Datei Gelöscht : C:\WINDOWS\System32\FXSCOM64.exe
Datei Gelöscht : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default\user.js

***** [ Tasks ] *****

Task Gelöscht : UpdaterEX

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Download Protect]
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\UpdaterEX
Schlüssel Gelöscht : HKLM\Software\GlobalUpdate
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsMangerProtect
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~1.DLL
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~2.DLL

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.crossrider.bic", "14639063ab64a589e6732ba7b999f4e8");

*************************

AdwCleaner[R0].txt - [3385 octets] - [06/08/2014 09:33:19]
AdwCleaner[R1].txt - [3504 octets] - [06/08/2014 09:36:13]
AdwCleaner[S0].txt - [290 octets] - [06/08/2014 09:34:56]
AdwCleaner[S1].txt - [3088 octets] - [06/08/2014 09:37:02]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [3148 octets] ##########
         


JRT
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 x64
Ran by Mimi on 06.08.2014 at  9:41:51,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\ProgramData\boost_interprocess"



~~~ FireFox

Emptied folder: C:\Users\Mimi\AppData\Roaming\mozilla\firefox\profiles\ebxpazlm.default\minidumps [13 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.08.2014 at  9:50:29,11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

und ein frisches FRST Logfile

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Mimi (administrator) on MIRIAM on 06-08-2014 09:53:27
Running from C:\Users\Mimi\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\CrashReportSender.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2872176 2012-10-08] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3952128 2012-11-27] (Bitcasa, Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4177645711-3970229063-862042014-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SYSTEM32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM-x32 - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 209.244.0.3 209.244.0.4

FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-07-14]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171664 2012-11-06] (Adobe Systems Incorporated)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1591176 2012-11-30] (Samsung Electronics CO., LTD.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe [264360 2013-10-08] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2878152 2012-12-21] (Samsung Electronics CO., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
S1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-09-26] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352456 2012-08-06] (EldoS Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSVia64.sys [520280 2013-09-24] (Symantec Corporation)
S3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\ENG64.SYS [126040 2013-10-04] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\EX64.SYS [2099288 2013-10-04] (Symantec Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-09] (Corel Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 SRTSP; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1501000.012\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-07-14] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:33 - 2014-08-06 09:39 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:17 - 2014-08-06 09:31 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-06 09:16 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-06 09:16 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-08-06 09:16 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-06 09:15 - 2014-08-06 09:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:16 - 2014-08-05 23:14 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:02 - 2014-08-06 09:53 - 00019067 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:01 - 2014-08-06 09:53 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-08-05 15:59 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-07-14 17:16 - 2014-08-05 16:10 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-07-14 17:16 - 2014-07-14 17:17 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-08-05 16:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-07 21:15 - 2014-08-05 15:50 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 09:53 - 2014-08-05 23:02 - 00019067 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-06 09:53 - 2014-08-05 23:01 - 00000000 ____D () C:\FRST
2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:50 - 2014-03-04 00:15 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4177645711-3970229063-862042014-1001
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-06 09:40 - 2013-01-03 07:27 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-06 09:39 - 2014-08-06 09:33 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:38 - 2014-03-25 20:30 - 00000000 __RDO () C:\Users\Mimi\SkyDrive
2014-08-06 09:38 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:37 - 2013-11-14 00:18 - 00969386 _____ () C:\WINDOWS\PFRO.log
2014-08-06 09:31 - 2014-08-06 09:17 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:31 - 2014-03-04 00:48 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-08-06 09:28 - 2014-04-08 15:01 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-08-06 09:28 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-06 09:28 - 2013-01-03 07:43 - 00000000 ____D () C:\WINDOWS\it
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-06 09:11 - 2014-08-06 09:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:24 - 2014-03-25 21:04 - 00432128 ___SH () C:\Users\Mimi\Desktop\Thumbs.db
2014-08-05 23:14 - 2014-08-05 23:16 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 16:11 - 2014-03-25 17:33 - 00000000 ____D () C:\Users\Mimi
2014-08-05 16:11 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 __RSD () C:\WINDOWS\Media
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-05 16:10 - 2014-07-14 17:16 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-08-05 16:10 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-05 16:10 - 2014-04-08 15:01 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iTunes
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-05 16:10 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-08-05 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2014-08-05 16:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-08-05 15:59 - 2014-07-14 17:17 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-08-05 15:56 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iPod
2014-08-05 15:50 - 2014-07-07 21:15 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-08-05 15:35 - 2013-11-14 09:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-05 15:35 - 2013-11-14 09:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-05 15:35 - 2013-11-14 09:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-05 15:32 - 2014-03-14 18:04 - 00266752 ___SH () C:\Users\Mimi\Downloads\Thumbs.db
2014-08-05 15:31 - 2013-08-22 16:46 - 00302552 _____ () C:\WINDOWS\setupact.log
2014-08-05 15:18 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\sonstiges
2014-08-05 13:30 - 2014-03-25 17:52 - 01284851 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-05 13:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-03 12:38 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\biochemie
2014-07-22 21:53 - 2014-04-01 08:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-16 20:20 - 2014-05-06 21:01 - 00000000 ____D () C:\Users\Mimi\Desktop\physiologie
2014-07-16 20:20 - 2014-04-27 20:12 - 00000000 ____D () C:\Users\Mimi\Desktop\uni
2014-07-16 20:20 - 2014-03-14 19:58 - 00000000 ____D () C:\Users\Mimi\Desktop\wp
2014-07-14 20:03 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:32 - 2014-03-05 13:25 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-07-14 17:30 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-07-14 17:16 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:16 - 2013-01-03 07:21 - 00000000 ____D () C:\ProgramData\Norton
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-13 22:34 - 2014-03-25 20:30 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DBBE89A8-5831-412F-8BAE-855B806DEBD3}
2014-07-09 12:29 - 2014-04-08 15:01 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-07-08 17:58 - 2014-03-13 15:35 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Microsoft Help
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-07 21:05 - 2014-03-04 00:06 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages

Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe


Some content of TEMP:
====================
C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-06 09:50

==================== End Of Log ============================
         
--- --- ---





Gruß,
Simon
__________________

Alt 06.08.2014, 16:36   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



  • Deaktiviere dein Anti-Viren-Programm.
  • Gehe zum Ordner C:\FRST\Quarantine.
  • Rechtsklicke auf den Ordner Quarantine und wähle > Senden an > Zip-komprimierter Ordner.
  • Es wird eine zip-Datei mit dem Namen Quarantine.zip im Ordner FRST erstellt.
  • Lade die Quarantine.zip im Upload-Channel hoch.
  • Klicke dazu auf Durchsuchen, navigiere zu der zip-Datei ( C:\FRST\Quarantine.zip ) und klicke auf Öffnen.
  • Klicke abschließend auf Hochladen.
  • Vielen Dank für deine Hilfe.
  • Aktiviere dein Anti-Viren-Programm wieder.





ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 06.08.2014, 21:06   #5
zimon
 
Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Zitat:
Zitat von schrauber Beitrag anzeigen
Noch Probleme?
Leider ja




Logs: Fixlog.txt
Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-08-2014
Ran by Mimi at 2014-08-06 19:57:26 Run:1
Running from C:\Users\Mimi\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
*****************

HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{0EB76B06-2587-43A4-B867-6C54A691E426} => value deleted successfully.
C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi => Moved successfully.

==== End of Fixlog ====
         

ESET Online Scanner liefert gleich nach Akzeptieren der AGB's folgendes:
"Updates funktionieren nicht. Ist ein Proxy eingerichtet?"
Proxy ist keiner da. Macht vielleicht die doppelte Fritzbox Probleme? (Eine Internetanschluss vom Haus, die andere danach an einem Switch angeschlossen und nur für WLAN zuständig.)



und der Log der checkup.txt
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.86  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
Norton 360         
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 	14.0.0.145  
 Adobe Reader 10.1.10 Adobe Reader out of Date!  
 Mozilla Firefox 29.0.1 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         


frischer FRST Log


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Mimi (administrator) on MIRIAM on 06-08-2014 20:53:35
Running from C:\Users\Mimi\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
() C:\Users\Mimi\Desktop\SecurityCheck.exe
() C:\Users\Mimi\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2872176 2012-10-08] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3952128 2012-11-27] (Bitcasa, Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4177645711-3970229063-862042014-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SYSTEM32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM-x32 - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\..\Interfaces\{D6F005BC-183A-40F1-AC1B-A3D51D5BFE34}: [NameServer]192.168.0.100

FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-07-14]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171664 2012-11-06] (Adobe Systems Incorporated)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1591176 2012-11-30] (Samsung Electronics CO., LTD.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe [264360 2013-10-08] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2878152 2012-12-21] (Samsung Electronics CO., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
S1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-09-26] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352456 2012-08-06] (EldoS Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSVia64.sys [520280 2013-09-24] (Symantec Corporation)
S3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\ENG64.SYS [126040 2013-10-04] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\EX64.SYS [2099288 2013-10-04] (Symantec Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-09] (Corel Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 SRTSP; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1501000.012\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-07-14] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 20:11 - 2014-04-14 05:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2014-08-06 20:04 - 2014-08-06 20:04 - 00854410 _____ () C:\Users\Mimi\Desktop\SecurityCheck.exe
2014-08-06 20:00 - 2014-08-06 20:00 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-06 20:00 - 2014-07-01 00:45 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-08-06 20:00 - 2014-06-28 09:48 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-08-06 20:00 - 2014-06-28 09:07 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-08-06 20:00 - 2014-06-06 15:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2014-08-06 20:00 - 2014-06-06 14:18 - 00488960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
2014-08-06 19:59 - 2014-08-06 19:59 - 02347384 _____ (ESET) C:\Users\Mimi\Desktop\esetsmartinstaller_deu.exe
2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:33 - 2014-08-06 09:39 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:17 - 2014-08-06 09:56 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-06 09:16 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-06 09:16 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-08-06 09:16 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-06 09:15 - 2014-08-06 09:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:16 - 2014-08-05 23:14 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:02 - 2014-08-06 20:53 - 00018952 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:01 - 2014-08-06 20:53 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-07-14 17:32 - 2014-08-06 20:10 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-08-05 15:59 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-07-14 17:16 - 2014-08-05 16:10 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-07-14 17:16 - 2014-07-14 17:17 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-08-05 16:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-07 21:15 - 2014-08-05 15:50 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-06 20:54 - 2014-08-05 23:02 - 00018952 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-06 20:53 - 2014-08-05 23:01 - 00000000 ____D () C:\FRST
2014-08-06 20:53 - 2014-03-04 00:15 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4177645711-3970229063-862042014-1001
2014-08-06 20:41 - 2014-03-25 21:04 - 00452608 ___SH () C:\Users\Mimi\Desktop\Thumbs.db
2014-08-06 20:41 - 2014-03-25 20:30 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DBBE89A8-5831-412F-8BAE-855B806DEBD3}
2014-08-06 20:13 - 2014-03-25 17:52 - 01114603 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-06 20:13 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-08-06 20:12 - 2014-03-05 13:25 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-08-06 20:12 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-08-06 20:11 - 2014-03-05 13:24 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-08-06 20:10 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-08-06 20:10 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-06 20:04 - 2014-08-06 20:04 - 00854410 _____ () C:\Users\Mimi\Desktop\SecurityCheck.exe
2014-08-06 20:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-06 20:00 - 2014-08-06 20:00 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-06 19:59 - 2014-08-06 19:59 - 02347384 _____ (ESET) C:\Users\Mimi\Desktop\esetsmartinstaller_deu.exe
2014-08-06 19:58 - 2014-03-25 20:30 - 00000000 __RDO () C:\Users\Mimi\SkyDrive
2014-08-06 19:56 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-06 19:53 - 2014-03-04 00:48 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-08-06 19:51 - 2013-01-03 07:27 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-06 19:50 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-08-06 09:56 - 2014-08-06 09:17 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:39 - 2014-08-06 09:33 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:38 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:37 - 2013-11-14 00:18 - 00969386 _____ () C:\WINDOWS\PFRO.log
2014-08-06 09:28 - 2014-04-08 15:01 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-08-06 09:28 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-06 09:28 - 2013-01-03 07:43 - 00000000 ____D () C:\WINDOWS\it
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-08-06 09:11 - 2014-08-06 09:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:14 - 2014-08-05 23:16 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 16:11 - 2014-03-25 17:33 - 00000000 ____D () C:\Users\Mimi
2014-08-05 16:11 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 __RSD () C:\WINDOWS\Media
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-05 16:10 - 2014-07-14 17:16 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-08-05 16:10 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-05 16:10 - 2014-04-08 15:01 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iTunes
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-05 16:10 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-08-05 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2014-08-05 16:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-08-05 15:59 - 2014-07-14 17:17 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-08-05 15:56 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iPod
2014-08-05 15:50 - 2014-07-07 21:15 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-08-05 15:35 - 2013-11-14 09:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-05 15:35 - 2013-11-14 09:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-05 15:35 - 2013-11-14 09:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-05 15:32 - 2014-03-14 18:04 - 00266752 ___SH () C:\Users\Mimi\Downloads\Thumbs.db
2014-08-05 15:31 - 2013-08-22 16:46 - 00302552 _____ () C:\WINDOWS\setupact.log
2014-08-05 15:18 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\sonstiges
2014-08-03 12:38 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\biochemie
2014-07-22 21:53 - 2014-04-01 08:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-16 20:20 - 2014-05-06 21:01 - 00000000 ____D () C:\Users\Mimi\Desktop\physiologie
2014-07-16 20:20 - 2014-04-27 20:12 - 00000000 ____D () C:\Users\Mimi\Desktop\uni
2014-07-16 20:20 - 2014-03-14 19:58 - 00000000 ____D () C:\Users\Mimi\Desktop\wp
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-07-14 17:16 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:16 - 2013-01-03 07:21 - 00000000 ____D () C:\ProgramData\Norton
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-09 12:29 - 2014-04-08 15:01 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-07-08 17:58 - 2014-03-13 15:35 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Microsoft Help
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-07 21:05 - 2014-03-04 00:06 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages

Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe


Some content of TEMP:
====================
C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-06 09:50

==================== End Of Log ============================
         
--- --- ---

--- --- ---

--- --- ---




Gruß,
Simon

Und direkter Nachtrag:
Download Protect taucht nicht mehr bei den Firefox Add-Ons auf

Eine weitere Frage stellt sich mir noch: Es ist wohl Norton und McAfee installiert.
Beides zugleich und noch die Windows Firewall drauf ist wohl nicht ratsam.
Kann ich da eine Meinung bekommen was behalten und was runterwerfen? Oder komplett umsteigen?
Ich nutze seit Jahren Avira und bin hochzufrieden mit. Aber da es sich wie gesagt nicht um mein Laptop handelt, wollte ich hier noch eine Meinung einholen

Gruß,
Simon


Alt 07.08.2014, 17:51   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Beides deinstallieren, Avira is auch Müll. Ich empfehle immer Emsisoft.

Adobe und Firefox updaten.

Upload gemacht?
__________________
--> Download Protect 2.2.1 unter Firefox/Windows 8.1

Alt 07.08.2014, 21:17   #7
zimon
 
Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Hallo,

ja, Upload der Quarantine.zip hab ich gemacht, blos vergessen zu erwähnen.
Sehen die Log's gut aus und die Reise ist am Ende?

Großes schonmal!

Alt 08.08.2014, 17:24   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.





Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 09.08.2014, 16:43   #9
zimon
 
Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Hallo,

das Laptop ist für paar Tage nicht mehr in meiner Hand, werde die letzten paar Schritte aber noch nachholen.
Ansonsten kann ich nur ein doppeltes und riesiges aussprechen und noch ein schönes Wochenende wünschen.

(PS: Thread brauch kein Abo mehr )

Alt 10.08.2014, 07:15   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Download Protect 2.2.1 unter Firefox/Windows 8.1 - Standard

Download Protect 2.2.1 unter Firefox/Windows 8.1



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Download Protect 2.2.1 unter Firefox/Windows 8.1
bildschirm, bluescreen, branding, download protect 2.2.1, flash player, homepage, installation, kein bluescreen, mozilla, problem, pup.optional.crossrider.a, pup.optional.iepluginservice.a, pup.optional.installcore.a, pup.optional.sweetpage.a, realtek, software, svchost.exe, sweet-page, sweet-page entfernen, sweetpage, sweetpage entfernen, symantec, warnung, windowsmangerprotect



Ähnliche Themen: Download Protect 2.2.1 unter Firefox/Windows 8.1


  1. Download Protect 2.2.14 unter win8 kann ich nicht löschen!
    Log-Analyse und Auswertung - 31.10.2015 (5)
  2. "Download Protect 2.2.12" in Chrome unter Windows 10
    Log-Analyse und Auswertung - 28.09.2015 (9)
  3. Download Protect entfernen, firefox
    Log-Analyse und Auswertung - 23.08.2015 (21)
  4. Download Protect 2.2.8 - Firefox
    Log-Analyse und Auswertung - 23.08.2015 (6)
  5. Download Protect 2.2.11 in Chrome und Firefox
    Log-Analyse und Auswertung - 30.07.2015 (43)
  6. Firefox und Download Protect 2.2.11
    Log-Analyse und Auswertung - 24.07.2015 (14)
  7. Add-On "Download Protect 2.2.6" in Firefox entfernen / Windows 8.1 Pro N 64-Bit
    Plagegeister aller Art und deren Bekämpfung - 03.06.2015 (12)
  8. Firefox - addons verschwunden - Download Protect als Ursache?
    Plagegeister aller Art und deren Bekämpfung - 21.11.2014 (7)
  9. Firefox Add-on Download Protect 2.2.4 entfernen
    Log-Analyse und Auswertung - 03.09.2014 (7)
  10. Download Protect 2.2.5 lässt sich aus Firefox nicht entfernen
    Log-Analyse und Auswertung - 13.08.2014 (12)
  11. download protect 2.2.1 / 2.2.4 unter windows 7 lässt sich nicht entfernen
    Log-Analyse und Auswertung - 31.07.2014 (23)
  12. Download Protect 2.2.4 Firefox
    Log-Analyse und Auswertung - 21.07.2014 (13)
  13. Wie werde ich Download Protect 2.2.4 (Add on bei Firefox) wieder los?
    Plagegeister aller Art und deren Bekämpfung - 17.07.2014 (13)
  14. Download Protect 2.2.1 aus Firefox dauerhaft entfernen!
    Plagegeister aller Art und deren Bekämpfung - 07.07.2014 (5)
  15. Download Protect in Firefox läßt sich nicht dauerhaft entfernen - Windows 8.1
    Log-Analyse und Auswertung - 16.06.2014 (11)
  16. Download Protect 2.2.1 in Chrome und Firefox!
    Log-Analyse und Auswertung - 11.06.2014 (3)
  17. Add on: Download Protect lässt sich nicht entfernen. (Windows 7, Mozilla Firefox)
    Log-Analyse und Auswertung - 15.04.2014 (5)

Zum Thema Download Protect 2.2.1 unter Firefox/Windows 8.1 - Guten Abend, kurze Vorgeschichte: ich habe heute das Laptop einer guten Freundin bekommen mit dem Problem, dass nach der Anmeldung sich nichts mehr bedienen lies und der Bildschirm in kurzen - Download Protect 2.2.1 unter Firefox/Windows 8.1...
Archiv
Du betrachtest: Download Protect 2.2.1 unter Firefox/Windows 8.1 auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.