Schwarzer Bildschirm nach dem Einloggen auf Win8 Notebook

KlarerFall · 02.09.2014, 22:32

Guten Abend
nun hat es wohl meine Frau an ihrem Notebook erwischt.
Was war passiert: Soweit wir es noch rekonstruieren können, wollte sie am Sonntag 31.08.2014 aus dem wiso Steuer-Sparbuch heraus drucken, was jedoch nicht gelang. Ich habe dann eine Testseite drucken können - sodass ich wusste, dass der Drucker nicht die Ursache des Problems war. Der Rechner blieb noch über Nacht in diesem Zustand. Beim Speichern der wiso-Daten muß auch etwas fehlgeschlagen sein und sie ist aus dem Programm "rausgeflogen". Dazu später mehr.
Danach war sie wohl noch 2mal im Internet - ebay und bei einem Steueramt. Alles in allem keine großen Anzeichen eines Problems. Als sie dann am Montag das Notebook nochmal hochfuhr konnte sie sich noch einloggen und danach kam der schwarze Bildschirm, das ganze 3x versucht und dann wurde ich von der Sache informiert.

Was ich gemacht habe war, den Rechner im Abgesicherten Modus hochgefahren. Das wiso-Programm lies sich noch starten und wir fanden die Mitteilung, dass beim letzten Speichern ein Problem aufgetreten ist und er eine Sicherungskopie der Daten angelegt hat, die wir auch wieder einspielen konnten. So wie es aussieht ging dabei nichts verloren.

Ich habe mich dann auf dem Rechner umgeschaut und kann zu meinem Erstaunen kein Kasperski mehr finden. Hat der Virus den gefressen?
Ausserdem steht unter Windows Sicherheitscenterdienst (Wichtig) Der Windows-Sicherheitscenterdienst ist deaktiviert Ich weiss jetzt nicht, ob das wegen dem abgesicherten Modus so ist.

Danach habe ich die Scans gemacht, so wie es in der Anleitung auf dieser Site steht.
Bei GMER habe ich zwischendurch die Meldung bekommen
C:\windows\system\config\system
Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Ebenso mit C:\Users/Silvia Maria/ntuser.dat

So jetzt ist leider doch ein Roman geworden. Könnt ihr an Hand den Daten irgend etwas feststellen?

Ich bedanke mich schon mal in Voraus
Viele Grüße
Jürgen

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:03 on 02/09/2014 (Silvia Maria)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Silvia Maria (administrator) on SILVIA on 02-09-2014 21:12:09
Running from F:\
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Safe Mode (with Networking)

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] => C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [TPUReg(x86)] => "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\Run: [MyTomTomSA.exe] => C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [458680 2013-08-01] (TomTom)
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\MountPoints2: {43285018-35a7-11e2-be71-806e6f6e6963} - "E:\start.exe" /auto
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\MountPoints2: {4d9989a9-39ac-11e3-be86-2016d83b0756} - "F:\WD SmartWare.exe" autoplay=true
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [232896 2014-08-15] (Client Connect LTD)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [187328 2014-08-15] (Client Connect LTD)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Audible, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Silvia Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.ganzheitlichelebenshilfe.de/index.php
hxxp://www.ritus-shaman.de/index.php
SearchScopes: HKLM - DefaultScope {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - DefaultScope {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovigo.com/Results.aspx?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovigo.com/Results.aspx?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&q={searchTerms}&SSPV=
SearchScopes: HKCU - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = 
BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

FireFox:
========
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovigo.com/?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovigo.com/?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&SSPV="
CHR DefaultSearchKeyword: Default -> DFD8361BBF8643DAC1391493A3AFEF6859D25886D4550BFBACADAE54E01A6682
CHR DefaultSearchURL: Default -> 533AEDE957531FC70C08A707932AFA3361A4D1952F1FFFBBF04CBF17FFEBBC78
CHR Profile: C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-18]
CHR Extension: (Google Drive) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-18]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-28]
CHR Extension: (YouTube) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-18]
CHR Extension: (Last updated at $time$ on $date$) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-03-22]
CHR Extension: (Google Search) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-18]
CHR Extension: (DVDVideoSoft) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-10-02]
CHR Extension: (Google Wallet) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-25]
CHR Extension: (Gmail) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-18]
CHR Extension: (Extutil) - C:\Users\SILVIA~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-03-01]
CHR Extension: (Managera) - C:\Users\SILVIA~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-03-01]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-09-29]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2991552 2014-08-15] (Client Connect LTD)
S2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] () [File not signed]
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)
S2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)
S2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
S3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
S3 SPPD; \??\C:\windows\system32\drivers\SPPD.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 21:12 - 2014-09-02 21:12 - 00000000 ____D () C:\FRST
2014-08-28 09:58 - 2014-08-23 08:47 - 04036096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-08-17 20:50 - 2014-08-17 20:56 - 00000000 ____D () C:\Users\Silvia Maria\Documents\YouTubeVideo_Download
2014-08-17 20:46 - 2014-08-17 20:46 - 00004036 _____ () C:\windows\System32\Tasks\LaunchSignup
2014-08-17 20:45 - 2014-08-17 20:45 - 00001300 _____ () C:\Users\Public\Desktop\YTD Video Downloader.lnk
2014-08-17 20:45 - 2014-08-17 20:45 - 00000000 ____D () C:\ProgramData\YTD Video Downloader
2014-08-17 20:45 - 2014-08-17 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader
2014-08-17 20:45 - 2014-08-17 20:45 - 00000000 ____D () C:\Program Files (x86)\GreenTree Applications
2014-08-17 20:41 - 2014-08-17 20:43 - 17042944 _____ () C:\Users\Silvia Maria\Downloads\YTDSetup.exe
2014-08-16 20:26 - 2014-09-01 12:29 - 00307968 _____ () C:\windows\system32\FNTCACHE.DAT
2014-08-16 10:40 - 2014-07-16 00:51 - 00071168 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hdaudbus.sys
2014-08-13 17:51 - 2014-06-11 00:44 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
2014-08-13 17:51 - 2014-06-11 00:43 - 00035480 _____ (Microsoft Corporation) C:\windows\SysWOW64\TsWpfWrp.exe
2014-08-13 17:08 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-08-13 17:08 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-08-13 17:08 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-08-13 17:08 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-08-13 17:08 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-08-13 17:08 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-08-13 17:08 - 2014-07-24 10:03 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-08-13 17:08 - 2014-06-13 03:57 - 01453400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2014-08-13 17:08 - 2014-06-13 03:55 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
2014-08-13 17:07 - 2014-07-16 01:03 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-08-13 17:07 - 2014-07-12 04:36 - 01023488 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-08-13 17:07 - 2014-06-20 01:35 - 01312768 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2014-08-13 17:07 - 2014-06-20 00:24 - 00694272 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2014-08-13 17:07 - 2014-06-05 19:56 - 00112984 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2014-08-13 17:07 - 2014-06-05 19:30 - 10116608 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2014-08-13 17:07 - 2014-06-05 19:29 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-08-13 17:07 - 2014-06-05 19:29 - 00393216 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2014-08-13 17:07 - 2014-06-05 19:28 - 02306560 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2014-08-13 17:07 - 2014-06-05 19:28 - 02146304 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2014-08-13 17:07 - 2014-06-05 15:12 - 08857600 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2014-08-13 17:07 - 2014-06-05 15:11 - 02416128 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-08-13 17:07 - 2014-06-05 15:11 - 00295424 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2014-08-13 17:07 - 2014-06-05 15:10 - 02037760 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2014-08-13 17:07 - 2014-06-05 15:10 - 00754176 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
2014-08-13 17:07 - 2014-05-29 06:04 - 00094552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2014-08-13 17:07 - 2014-05-08 03:34 - 00328024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2014-08-12 20:57 - 2014-08-12 20:57 - 00001794 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iPod
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-05 14:10 - 2014-08-05 14:10 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-02 21:12 - 2014-09-02 21:12 - 00000000 ____D () C:\FRST
2014-09-02 21:08 - 2013-03-18 22:06 - 00001132 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-02 21:08 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-09-01 21:49 - 2014-02-14 19:03 - 00000547 _____ () C:\windows\wiso.ini
2014-09-01 21:18 - 2013-03-18 18:50 - 01474159 _____ () C:\windows\WindowsUpdate.log
2014-09-01 21:02 - 2012-07-26 07:26 - 00524288 ___SH () C:\windows\system32\config\BBI
2014-09-01 20:00 - 2012-08-01 18:38 - 00753134 _____ () C:\windows\system32\perfh007.dat
2014-09-01 20:00 - 2012-08-01 18:38 - 00155826 _____ () C:\windows\system32\perfc007.dat
2014-09-01 20:00 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-09-01 20:00 - 2012-07-26 09:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2014-09-01 19:52 - 2013-03-18 22:06 - 00001136 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-01 19:35 - 2012-07-26 09:21 - 00041228 _____ () C:\windows\setupact.log
2014-09-01 17:28 - 2013-03-18 18:51 - 00000000 ____D () C:\Users\Silvia Maria
2014-09-01 12:29 - 2014-08-16 20:26 - 00307968 _____ () C:\windows\system32\FNTCACHE.DAT
2014-08-30 16:01 - 2013-03-18 22:19 - 00002186 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-30 15:52 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-08-29 12:45 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-08-26 08:12 - 2014-03-01 21:09 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-08-23 08:47 - 2014-08-28 09:58 - 04036096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-08-18 12:38 - 2013-03-18 18:58 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-711957141-987489330-1238217342-1001
2014-08-17 21:30 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\NDF
2014-08-17 20:56 - 2014-08-17 20:50 - 00000000 ____D () C:\Users\Silvia Maria\Documents\YouTubeVideo_Download
2014-08-17 20:46 - 2014-08-17 20:46 - 00004036 _____ () C:\windows\System32\Tasks\LaunchSignup
2014-08-17 20:45 - 2014-08-17 20:45 - 00001300 _____ () C:\Users\Public\Desktop\YTD Video Downloader.lnk
2014-08-17 20:45 - 2014-08-17 20:45 - 00000000 ____D () C:\ProgramData\YTD Video Downloader
2014-08-17 20:45 - 2014-08-17 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader
2014-08-17 20:45 - 2014-08-17 20:45 - 00000000 ____D () C:\Program Files (x86)\GreenTree Applications
2014-08-17 20:43 - 2014-08-17 20:41 - 17042944 _____ () C:\Users\Silvia Maria\Downloads\YTDSetup.exe
2014-08-16 20:27 - 2012-07-26 10:12 - 00000000 ___RD () C:\windows\ToastData
2014-08-16 10:47 - 2013-08-29 19:33 - 00000000 ____D () C:\windows\system32\MRT
2014-08-16 10:43 - 2013-03-23 12:13 - 99218768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-08-12 20:57 - 2014-08-12 20:57 - 00001794 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iPod
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-11 19:36 - 2013-03-18 18:51 - 00000000 ____D () C:\Users\Silvia Maria\AppData\Local\Packages
2014-08-07 22:34 - 2014-02-17 14:58 - 00000000 ____D () C:\Users\Silvia Maria\Documents\Mein Steuer-Sparbuch Heute
2014-08-05 14:10 - 2014-08-05 14:10 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

Some content of TEMP:
====================
C:\Users\Silvia Maria\AppData\Local\Temp\AudibleDM_iTunesSetup.exe
C:\Users\Silvia Maria\AppData\Local\Temp\BackupSetup.exe
C:\Users\Silvia Maria\AppData\Local\Temp\nscE8A5.exe
C:\Users\Silvia Maria\AppData\Local\Temp\nshF2B.exe
C:\Users\Silvia Maria\AppData\Local\Temp\nsmE6C0.exe
C:\Users\Silvia Maria\AppData\Local\Temp\nsy10C3.exe
C:\Users\Silvia Maria\AppData\Local\Temp\sp-downloader.exe
C:\Users\Silvia Maria\AppData\Local\Temp\SPSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-26 01:09

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2014 02
Ran by Silvia Maria at 2014-09-02 21:13:05
Running from F:\
Boot Mode: Safe Mode (with Networking)
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audible Download Manager (HKLM-x32\...\AudibleDownloadManager) (Version: 6.6.0.15 - Audible, Inc.)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
DJ_AIO_06_F2400_SW_Min (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
F2400 (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Free Audio Converter version 5.0.28.827 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.28.827 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.13.925 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.13.925 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.102 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6 (HKLM\...\{CDBF8C2D-04B0-4F9B-9AE1-7422F7F0EC94}) (Version: 13.0 - HP)
hpWLPGInstaller (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MyTomTom 3.2.0.1220 (HKLM-x32\...\MyTomTom) (Version: 3.2.0.1220 - TomTom)
Nero 12 Essentials Toshiba (HKLM-x32\...\{BA8958DC-ADD7-41E5-8436-5883C7E871C7}) (Version: 12.0.00400 - Nero AG)
Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden
Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden
Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden
Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden
Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden
Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden
Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden
Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden
Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden
Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden
Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{94F03B8E-CB73-4653-AFE9-79112C01FED2}) (Version: 1.12.4600 - SRS Labs, Inc.)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek Bluetooth Filter Driver Package (HKLM-x32\...\InstallShield_{0CC0980D-811D-43B8-A455-8D150EB5BC0D}) (Version: 12.24.2012.0802 - REALTEK Semiconductor Corp)
Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6687 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.16.31.75 - Client Connect LTD) <==== ATTENTION
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
StreamTransport version: 1.1.1.1 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version:  - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.0007.00002 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
Toshiba Password Utility (HKLM-x32\...\InstallShield_{6D35FF17-A8B3-43D3-917E-5A1F2C3FB628}) (Version: 2.00.910 - Toshiba Corporation)
Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
Toshiba Places Icon Utility (HKLM\...\{C991A8C4-307C-4FDD-8AAE-A1BF44881E95}) (Version: 2.1.1 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0012 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.2.1 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden
WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.37 - WildTangent) Hidden
Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (HKLM\...\57F58DC141BEB353704E041792E5B00606694FEA) (Version: 07/11/2012 2.3.13.3 - Realtek Semiconductor Corp.)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{9537F9A6-6F5A-43C3-A585-786A026771ED}) (Version: 21.00.8480 - Buhl Data Service GmbH)
YTD Video Downloader 4.8.3 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.3 - GreenTree Applications SRL)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-711957141-987489330-1238217342-1001_Classes\CLSID\{00000001-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll (Toshiba Corporation)

==================== Restore Points  =========================

13-08-2014 15:49:26 Windows Update
22-08-2014 16:51:08 Geplanter Prüfpunkt
30-08-2014 13:48:12 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-08-14] (Toshiba Europe GmbH)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {28BDAB60-B680-47B0-9F86-CDDEDFB8ED71} - System32\Tasks\{24D94FA0-DE88-406A-9B3E-D43C9002AA88} => Iexplore.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.3.0.105&amp;LastError=12002
Task: {5DC593ED-A74A-4E2E-A8AB-2DAEBE0E1DBC} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {70FA7AC2-82C9-4B8C-B713-72B899B56FE4} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {844F4FD6-1DCF-4219-AA21-1CEA3ED4D62F} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-28] (TOSHIBA Corporation)
Task: {88449A6F-387E-414F-A70A-7E6A1F577E98} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-18] (Google Inc.)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {C35C6794-32BA-4603-8EA9-B54F23FD314D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2014-08-16] (Microsoft Corporation)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CFDD9BFE-16E7-4325-A583-D258237141DF} - System32\Tasks\{93011967-D34C-4C8F-963C-533C39CF8AD0} => Iexplore.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.3.0.105&amp;LastError=12002
Task: {E632B8A5-B625-48E2-9E21-41121AB8CAAA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-18] (Google Inc.)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKCU\...\StartupApproved\Run: => "MyTomTomSA.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/01/2014 02:35:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15515

Error: (09/01/2014 02:35:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15515

Error: (09/01/2014 02:35:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/31/2014 09:10:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmain14.dll, Version: 2014.21.2.8520, Zeitstempel: 0x52b2f84b
Name des fehlerhaften Moduls: bdrm.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x13b04f5c
ID des fehlerhaften Prozesses: 0x128
Startzeit der fehlerhaften Anwendung: 0xwmain14.dll0
Pfad der fehlerhaften Anwendung: wmain14.dll1
Pfad des fehlerhaften Moduls: wmain14.dll2
Berichtskennung: wmain14.dll3
Vollständiger Name des fehlerhaften Pakets: wmain14.dll4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: wmain14.dll5

Error: (08/31/2014 09:05:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: LiveComm.exe, Version: 17.0.1119.516, Zeitstempel: 0x519504e1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16912, Zeitstempel: 0x536464ba
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000005491
ID des fehlerhaften Prozesses: 0x1fb8
Startzeit der fehlerhaften Anwendung: 0xLiveComm.exe0
Pfad der fehlerhaften Anwendung: LiveComm.exe1
Pfad des fehlerhaften Moduls: LiveComm.exe2
Berichtskennung: LiveComm.exe3
Vollständiger Name des fehlerhaften Pakets: LiveComm.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LiveComm.exe5

Error: (08/31/2014 08:38:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: LiveComm.exe, Version: 17.0.1119.516, Zeitstempel: 0x519504e1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16912, Zeitstempel: 0x536464ba
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000005491
ID des fehlerhaften Prozesses: 0x1fb8
Startzeit der fehlerhaften Anwendung: 0xLiveComm.exe0
Pfad der fehlerhaften Anwendung: LiveComm.exe1
Pfad des fehlerhaften Moduls: LiveComm.exe2
Berichtskennung: LiveComm.exe3
Vollständiger Name des fehlerhaften Pakets: LiveComm.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LiveComm.exe5

Error: (08/30/2014 10:00:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2719

Error: (08/30/2014 10:00:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2719

Error: (08/30/2014 10:00:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/30/2014 10:00:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1109


System errors:
=============
Error: (09/02/2014 09:13:06 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (09/02/2014 09:12:11 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (09/02/2014 09:11:32 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (09/02/2014 09:11:25 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (09/02/2014 09:11:20 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (09/02/2014 09:11:15 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084ShellHWDetectionNicht verfügbar{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (09/02/2014 09:11:14 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084WSearchNicht verfügbar{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (09/02/2014 09:11:14 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084WSearchNicht verfügbar{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (09/02/2014 09:11:14 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084WSearchNicht verfügbar{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (09/02/2014 09:11:14 PM) (Source: DCOM) (EventID: 10005) (User: SILVIA)
Description: 1084WSearchNicht verfügbar{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}


Microsoft Office Sessions:
=========================
Error: (09/01/2014 02:35:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15515

Error: (09/01/2014 02:35:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15515

Error: (09/01/2014 02:35:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/31/2014 09:10:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: wmain14.dll2014.21.2.852052b2f84bbdrm.dll_unloaded0.0.0.02a425e19c00001a513b04f5c12801cfbf992ebb3151C:\Program Files (x86)\WISO\Steuersoftware 2014\wmain14.dllbdrm.dll6b256977-3142-11e4-be9b-2016d83b0756

Error: (08/31/2014 09:05:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: LiveComm.exe17.0.1119.516519504e1ntdll.dll6.2.9200.16912536464bac000000500000000000054911fb801cfbeb5fd981355C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exeC:\windows\SYSTEM32\ntdll.dllb5bf11e2-3141-11e4-be9b-2016d83b0756microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbweMicrosoft.WindowsLive.Mail

Error: (08/31/2014 08:38:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: LiveComm.exe17.0.1119.516519504e1ntdll.dll6.2.9200.16912536464bac000000500000000000054911fb801cfbeb5fd981355C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exeC:\windows\SYSTEM32\ntdll.dll0b056d28-313e-11e4-be9b-2016d83b0756microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbweMicrosoft.WindowsLive.Mail

Error: (08/30/2014 10:00:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2719

Error: (08/30/2014 10:00:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2719

Error: (08/30/2014 10:00:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/30/2014 10:00:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1109


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Percentage of memory in use: 24%
Total physical RAM: 3979.21 MB
Available physical RAM: 3008.75 MB
Total Pagefile: 4683.21 MB
Available Pagefile: 3764.78 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (TI30992300A) (Fixed) (Total:259.97 GB) (Free:169.59 GB) NTFS
Drive d: (Daten) (Fixed) (Total:195.31 GB) (Free:193.5 GB) NTFS
Drive f: () (Removable) (Total:14.83 GB) (Free:10.86 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 14.8 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=14.8 GB) - (Type=0C)

==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-02 22:16:06
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003c Hitachi_HTS545050A7E380 rev.GG2OA7A0 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\SILVIA~1\AppData\Local\Temp\awdoypod.sys


---- Threads - GMER 2.1 ----

Thread  C:\windows\system32\csrss.exe [484:544]  fffff9600080a5e8

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                    unknown MBR code

---- EOF - GMER 2.1 ----

schrauber · 03.09.2014, 05:52

hi,

Adware & Co. deinstallieren

Lade Dir bitte von hier Revo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:

diesen Zusatz haben:
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

KlarerFall · 03.09.2014, 16:27

Hallo Schrauber
leider keine Erfolgsmeldung: Ich habe Search Protect im Uninstallerfeld gefunden und wollte es nach Anleitung löschen. Nach kurzer Zeit kam von Windows die Meldung Auf dem PC ist ein Problem aufgetreten und ich musste den PC wieder neustarten. Ich hab's noch mal versucht mit dem gleichen Ergebnis.
Dieses Search Protect wurde am 26.08.2014 wohl unbewußt installiert-das habe ich in der Systemsteuerung unter Programme gelesen.

Soll ich jetzt mit ComboFix weitermachen ?

schrauber · 04.09.2014, 11:22

Du hast es aber schon mit Revo versucht? Dann jetzt Combofix

KlarerFall · 04.09.2014, 20:30

Hallo Schrauber
so ich habe jetzt das log-fiie von Combofix
Gruß
Jürgen

Code:

ATTFilter

Combofix Logfile:

	Code: 

 ATTFilter

  
	ComboFix 14-08-31.01 - Silvia Maria 04.09.2014  21:05:22.1.4 - x64 NETWORK
Microsoft Windows 8  6.2.9200.0.1252.49.1031.18.3979.3252 [GMT 2:00]
ausgeführt von:: c:\users\Silvia Maria\Desktop\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\program files (x86)\SearchProtect
c:\program files (x86)\SearchProtect\EULA.txt
c:\program files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
c:\program files (x86)\SearchProtect\Main\bin\SPTool.dll
c:\program files (x86)\SearchProtect\Main\bin\uninstall.exe
c:\program files (x86)\SearchProtect\Main\rep\SystemRepository.dat
c:\program files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll
c:\program files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
c:\program files (x86)\SearchProtect\UI\bin\cltmngui.exe
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bg-uninstall.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bg.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\button-bg.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\hez.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\text-field.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\v.png
c:\program files (x86)\SearchProtect\UI\dialogs\Images\x.png
c:\program files (x86)\SearchProtect\UI\dialogs\libs\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\main.js
c:\program files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js
c:\program files (x86)\SearchProtect\UI\dialogs\protection\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\protection\protection.css
c:\program files (x86)\SearchProtect\UI\dialogs\protection\protection.html
c:\program files (x86)\SearchProtect\UI\dialogs\protection\protection.js
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html
c:\program files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js
c:\program files (x86)\SearchProtect\UI\dialogs\settings.html
c:\program files (x86)\SearchProtect\UI\dialogs\settings\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\settings\settings.css
c:\program files (x86)\SearchProtect\UI\dialogs\settings\settings.html
c:\program files (x86)\SearchProtect\UI\dialogs\settings\settings.js
c:\program files (x86)\SearchProtect\UI\dialogs\style.css
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html
c:\program files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_CltMngSvc
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-04 bis 2014-09-04  ))))))))))))))))))))))))))))))
.
.
2014-09-04 19:11 . 2014-09-04 19:11	--------	d-----w-	c:\users\Silvia Maria\AppData\Local\temp
2014-09-03 14:42 . 2014-09-03 14:42	--------	d-----w-	c:\program files (x86)\VS Revo Group
2014-09-02 19:12 . 2014-09-02 20:06	--------	d-----w-	C:\FRST
2014-08-31 18:51 . 2014-08-21 03:43	11319192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4D658B03-F4BA-4D04-8051-3D913BDE1317}\mpengine.dll
2014-08-28 07:58 . 2014-08-23 06:47	4036096	----a-w-	c:\windows\system32\win32k.sys
2014-08-17 18:45 . 2014-08-17 18:45	--------	d-----w-	c:\programdata\YTD Video Downloader
2014-08-17 18:45 . 2014-08-17 18:45	--------	d-----w-	c:\program files (x86)\GreenTree Applications
2014-08-16 08:40 . 2014-07-15 22:51	71168	----a-w-	c:\windows\system32\drivers\hdaudbus.sys
2014-08-13 15:51 . 2014-06-10 22:44	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2014-08-13 15:51 . 2014-06-10 22:43	35480	----a-w-	c:\windows\SysWow64\TsWpfWrp.exe
2014-08-13 15:07 . 2014-07-15 23:03	1300992	----a-w-	c:\windows\system32\gdi32.dll
2014-08-12 18:57 . 2014-08-12 18:57	--------	d-----w-	c:\program files\iPod
2014-08-12 18:57 . 2014-08-12 18:57	--------	d-----w-	c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-12 18:57 . 2014-08-12 18:57	--------	d-----w-	c:\program files\iTunes
2014-08-12 18:57 . 2014-08-12 18:57	--------	d-----w-	c:\program files (x86)\iTunes
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-16 08:43 . 2013-03-23 10:13	99218768	----a-w-	c:\windows\system32\MRT.exe
2014-08-12 18:18 . 2012-07-26 08:13	23256	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-02 00:15 . 2013-11-23 18:13	704480	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-08-02 00:15 . 2013-11-23 18:13	105440	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-22 13:27 . 2014-07-22 13:27	232896	----a-w-	c:\windows\apppatch\apppatch64\SPVCLdr64.dll
2014-06-17 23:27 . 2014-07-09 14:12	1440256	----a-w-	c:\windows\SysWow64\osk.exe
2014-06-17 23:24 . 2014-07-09 14:12	1557504	----a-w-	c:\windows\system32\osk.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-09-26 13:59	277560	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmazonMP3DownloaderHelper"="c:\users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe" [2013-05-22 400704]
"MyTomTomSA.exe"="c:\program files (x86)\MyTomTom 3\MyTomTomSA.exe" [2013-08-01 458680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Intel AppUp(SM) center"="c:\program files (x86)\Intel\IntelAppStore\bin\ismagent.exe" [2012-08-01 155488]
"ToshibaDynamicIconUtility"="c:\program files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe" [2012-08-09 1498624]
"TPUReg"="c:\program files (x86)\TOSHIBA\Password Utility\TosPU.exe" [2012-08-23 6884352]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-07-31 43816]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-08-01 152392]
.
c:\users\Silvia Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\
Audible Download Manager.lnk - c:\program files (x86)\Audible\Bin\AudibleDownloadHelper.exe /Startup [2011-3-14 2125472]
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe [2014-2-14 1427760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 GFNEXSrv;GFNEX Service;c:\program files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe;c:\program files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [x]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
R2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
R2 PEGAGFN;PEGAGFN;c:\program files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys;c:\program files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [x]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\Teco\TecoService.exe;c:\program files\TOSHIBA\Teco\TecoService.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 BthLEEnum;Treiber für energiearme Bluetooth-Geräte;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 NETwNe64;@netwne64.inf,___ %NIC_Service_DispName_WIN7_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNe64.sys;c:\windows\SYSNATIVE\DRIVERS\NETwNe64.sys [x]
R3 RtkBtFilter;Realtek Bluetooth Filter Driver;c:\windows\system32\DRIVERS\RtkBtfilter.sys;c:\windows\SYSNATIVE\DRIVERS\RtkBtfilter.sys [x]
R3 SPPD;SPPD;c:\windows\system32\drivers\SPPD.sys;c:\windows\SYSNATIVE\drivers\SPPD.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TemproMonitoringService;TEMPRO Service;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]
R3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\System32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung;c:\windows\System32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;c:\windows\system32\DRIVERS\rtwlane.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlane.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
S3 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\System32\drivers\tos_sps64.sys;c:\windows\SYSNATIVE\drivers\tos_sps64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-30 13:52	1096520	----a-w-	c:\program files (x86)\Google\Chrome\Application\37.0.2062.102\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-18 20:06]
.
2014-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-18 20:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-09-26 13:59	336952	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-08-08 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-08-08 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-08-08 440640]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-07-13 12936848]
"TODDMain"="c:\program files (x86)\TOSHIBA\System Setting\TODDMain.exe" [2012-08-04 213136]
"TecoResident"="c:\program files\TOSHIBA\Teco\TecoResident.exe" [2012-08-14 169896]
"SRS Premium Sound HD"="c:\program files\SRS Labs\SRS Control Panel\SRSPanel_64.exe" [2012-07-27 2170784]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/de
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-TPUReg(x86) - c:\program files\TOSHIBA\Password Utility\TosPU.exe
Toolbar-Locked - (no file)
HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\Hotkey\TCrdMain_Win8.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-Toshiba TEMPRO - c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2014-09-04  21:21:47 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-09-04 19:21
.
Vor Suchlauf: 10 Verzeichnis(se), 183.639.027.712 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 184.552.046.592 Bytes frei
.
- - End Of File - - E290CD93A722EFF43F38E590E6456317
         
 --- --- ---

schrauber · 05.09.2014, 20:02

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

KlarerFall · 05.09.2014, 22:43

Hallo Schrauber
so alles erledigt. Bereits nach MBAM konnte ich mich wieder normal anmelden, also kein Schwarzer Bildschirm mehr.

Viele Grüße
Jürgen

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 05.09.2014
Suchlauf-Zeit: 22:19:37
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.09.05.08
Rootkit Datenbank: v2014.08.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: Silvia Maria

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 313019
Verstrichene Zeit: 30 Min, 6 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 5
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-711957141-987489330-1238217342-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [38d42cbedf9c40f639fede9ef1113ec2], 
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, In Quarantäne, [2ae255951f5c9e98940273ed7b8912ee], 
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, In Quarantäne, [3fcd11d91a61999dcfc67ce4976daf51], 
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT, In Quarantäne, [4cc0b2380e6d9b9b76e543bf55aed52b], 
PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD, In Quarantäne, [57b5ac3e7ffc1521b0ec55a624decf31], 

Registrierungswerte: 2
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\WOW6432NODE\SEARCHPROTECT|InstallDir, C:\PROGRA~2\SearchProtect, In Quarantäne, [4cc0b2380e6d9b9b76e543bf55aed52b]
PUP.Optional.SearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SPPD|ImagePath, \??\C:\windows\system32\drivers\SPPD.sys, In Quarantäne, [57b5ac3e7ffc1521b0ec55a624decf31]

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 8
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\Logs, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\SearchProtect, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\SearchProtect\Logs, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\SearchProtect\rep, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\SearchProtect\STG, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\UI, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\UI\rep, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 

Dateien: 8
PUP.Optional.Spigot, C:\Users\Silvia Maria\Downloads\YTDSetup.exe, In Quarantäne, [29e36b7f562590a634dad8d17b8649b7], 
PUP.Optional.SearchProtect.A, C:\Windows\apppatch\apppatch64\SPVCLdr64.dll, In Quarantäne, [0ffd9c4eb6c5b6803587bbdfab5611ef], 
PUP.Optional.SearchProtect, C:\Windows\apppatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, In Quarantäne, [bc5030baa2d9b97d0891f070d331b050], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\SearchProtect\rep\Cvc.dat, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\SearchProtect\rep\UserRepository.dat, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\SearchProtect\rep\UserSettings.dat, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.SearchProtect.A, C:\Users\Silvia Maria\AppData\Local\SearchProtect\UI\rep\UIRepository.dat, In Quarantäne, [fe0e9c4e5b201521acf0bc22669cfc04], 
PUP.Optional.Trovigo.A, C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ({"apps":{"shortcuts_have_been_created":true},"autofill":{"negative_upload_rate":1.0,"positive_upload_rate":1.0},"bookmark_bar":{"show_on_all_tabs":true},"browser":{"check_default_browser":true,"clear_lso_data_enabled":true,"last_known_google_url":"https://www.google.de/","last_prompted_google_url":"https://www.google.de/","pepper_flash_settings_enabled":true,"show_home_button":true,"window_placement":{"bottom":845,"left":59,"maximized":false,"right":1109,"top":5,"work_area_bottom":860,"work_area_left":0,"work_area_right":1600,"work_area_top":0}},"cloud_print":{"email":""},"countryid_at_install":17477,"default_apps_install_state":3,"default_search_provider":{"enabled":true,"id":"2"},"distribution":{"make_chrome_default_for_user":true},"dns_prefetching":{"host_referral_list":[2,["hxxp://platform.twitter.com/",["hxxp://cdn.api.twitter.com/",2.2733802,"https://cdn.api.twitter.com/",2.2733802,"https://syndication.twitter.com/",2.048762464]],["hxxp://www.kicker.de/",["hxxp://adserver.mundo-service.de/",2.2733802,"hxxp://dcs.netbiscuits.net/",2.2733802,"hxxp://im.banner.t-online.de/",5.906902399999998,"hxxp://js.revsci.net/",2.6037003999999997,"hxxp://kicker.ivwbox.de/",2.6037003999999997,"hxxp://mediadb.kicker.de/",45.87564660000014,"hxxp://rss.kicker.de/",2.9340205999999998,"hxxp://ue.kicker.de/",2.2733802,"hxxp://www.kicker.de/",4.585621599999999,"https://www.facebook.com/",2.2733802]],["https://accounts.google.com/",["https://accounts.youtube.com/",0.99028441512,"https://apis.google.com/",1.500430932,"https://fonts.gstatic.com/",1.13417189424,"https://oauth.googleusercontent.com/",1.500430932,"https://ssl.gstatic.com/",1.6399581844799997]],["https://apis.google.com/",["https://apis.google.com/",3.0331166599999997,"https://fonts.gstatic.com/",1.7184422639999999,"https://lh5.googleusercontent.com/",1.7184422639999999,"https://ssl.gstatic.com/",1.500430932]],["https://www.facebook.com/",["https://fbcdn-profile-a.akamaihd.net/",1.3715286797963517,"https://fbstatic-a.akamaihd.net/",0.887042863035616]],["https://www.google.de/",["https://apis.google.com/",2.2733802,"https://ssl.gstatic.com/",2.2733802,"https://www.google.com/",2.2733802,"https://www.google.de/",4.585621599999999,"https://www.gstatic.com/",2.2733802]]],"startup_list":[1,"hxxp://voting.kicker.de/","hxxp://www.kicker.de/","https://accounts.google.com/","https://accounts.youtube.com/","https://apis.google.com/","https://fonts.gstatic.com/","https://ssl.gstatic.com/","https://www.google.com/","https://www.google.de/","https://www.gstatic.com/"]},"download":{"directory_upgrade":true,"extensions_to_open":"adh"},"enhanced_bookmarks_enabled":0,"extensions":{"alerts":{"initialized":true},"autoupdate":{"last_check":"13053983903240766","next_check":"13054244193937842"},"blacklistupdate":{"lastpingday":"13028630399103409","version":"0.0.0.149"},"chrome_url_overrides":{"bookmarks":["chrome-extension://eemcgdkfndhakfknompkggombfjjjeno/main.html"]},"commands":{},"install_signature":{"expire_date":"2014-11-21","ids":["aohghmighlieiainnegkcijnfilokake","bepbmhgboaologfdajaanbcjmnhjmhfn","cfhdojbkjhnklbpkdaibdccddilifddb"],"invalid_ids":["nikpibnbobmbdbheedjfogjlikpgpnhp"],"salt":"zN86Jh2zJBZgyOvMH/SkO/Zb8qmb0vap605O3cQJlsk=","signature":"U8v3ErrN65Cb56EJJNbSZOEWaBThkCzN2hRTUxMl2Q9B42r+HGeA/EBiHoj87vhNiwuhr/j6KCx7tYuSFLCxhpyO7H6deSBShj24xwjSVjpQ76sa1inaS5f6nK2MqhmSeWrzV4gcizWAl8erL9rLCUj68kNilYCdF67QMBVdRmDgxzaVwutjB3/9WQ16grkjyJmUu/GhYsBS6cp9W9wIYXTiWW2kioieRuSI0TpJP0AXuSIjdze/ijonWlvR1/JJe9zgRhHe6Gv3os8ZVwu2GBlI/m3zVm5L3nHvqrhNN1gZXO71E7iLqavs0Xu9QfGtE1WmDPeuvcCKTYWGM/31aw==","signature_format_version":2,"timestamp":"13053782717951779"},"known_disabled":["bepbmhgboaologfdajaanbcjmnhjmhfn","nikpibnbobmbdbheedjfogjlikpgpnhp"],"last_chrome_version":"37.0.2062.102","settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","webstorePrivate"],"manifest_permissions":[]},"app_launcher_ordinal":"n","creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"install_time":"13015973774467677","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Chrome Web Store","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Store","permissions":["webstorePrivate","management"],"version":"0.2"},"page_ordinal":"n","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\27.0.1453.110\\resources\\web_store","was_installed_by_default":false},"aohghmighlieiainnegkcijnfilokake":{"ack_external":true,"active_permissions":{"api":[],"manifest_permissions":[]},"app_launcher_ordinal":"w","content_settings":[],"creation_flags":137,"events":[],"exclude_from_sideload_wipeout":true,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":[],"manifest_permissions":[]},"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13049137502514920","lastpingday":"13053941999904547","location":1,"manifest":{"api_console_project_id":"619683526622","app":{"launch":{"local_path":"main.html"}},"container":"GOOGLE_DRIVE","current_locale":"de","default_locale":"en_US","description":"Dokumente erstellen und bearbeiten","icons":{"128":"icon_128.png","16":"icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJhLK6fk/BWTEvJhywpk7jDe4A2r0bGXGOLZW4/AdBp3IiD9o9nx4YjLAtv0tIPxi7MvFd/GUUbQBwHT5wQWONJj1z/0Rc2qBkiJA0yqXh42p0snuA8dCfdlhOLsp7/XTMEwAVasjV5hC4awl78eKfJYlZ+8fM/UldLWJ/51iBQwIDAQAB","manifest_version":2,"name":"Google Docs","offline_enabled":true,"update_url":"https://clients2.google.com/service/update2/crx","version":"0.7"},"page_ordinal":"n","path":"aohghmighlieiainnegkcijnfilokake\\0.7_0","preferences":{},"regular_only_preferences":{},"state":1,"was_installed_by_default":true,"was_installed_by_oem":false},"apdfllckaahabafndbhieahigkjlhalf":{"ack_external":true,"active_permissions":{"api":["background","clipboardRead","clipboardWrite","notifications","unlimitedStorage"],"manifest_permissions":[]},"app_launcher_ordinal":"y","creation_flags":137,"events":[],"exclude_from_sideload_wipeout":true,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["background","clipboardRead","clipboardWrite","notifications","unlimitedStorage"],"manifest_permissions":[]},"install_time":"13008457583485190","lastpingday":"13053941999904547","location":1,"manifest":{"app":{"launch":{"web_url":"https://drive.google.com/?usp=chrome_app"},"urls":["hxxp://docs.google.com/","hxxp://drive.google.com/","https://docs.google.com/","https://drive.google.com/"]},"background":{"allow_js_access":false},"current_locale":"de","default_locale":"en_US","description":"Google Drive: Alle Inhalte an einem Ort erstellen, teilen und speichern.","icons":{"128":"128.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIl5KlKwL2TSkntkpY3naLLz5jsN0YwjhZyObcTOK6Nda4Ie21KRqZau9lx5SHcLh7pE2/S9OiArb+na2dn7YK5EvH+aRXS1ec3uxVlBhqLdnleVgwgwlg5fH95I52IeHcoeK6pR4hW/Nv39GNlI/Uqk6O6GBCCsAxYrdxww9BiQIDAQAB","manifest_version":2,"name":"Google Drive","offline_enabled":true,"options_page":"https://drive.google.com/settings","permissions":["background","clipboardRead","clipboardWrite","notifications","unlimitedStorage"],"update_url":"hxxp://clients2.google.com/service/update2/crx","version":"6.3"},"page_ordinal":"n","path":"apdfllckaahabafndbhieahigkjlhalf\\6.3_0","state":1,"was_installed_by_default":true},"bepbmhgboaologfdajaanbcjmnhjmhfn":{"ack_external":true,"active_permissions":{"api":["audioCapture","hotwordPrivate","management","power","tabs","webConnectable"],"explicit_host":["*://*.google.co.uk/*","*://*.google.com/*","*://*.google.de/*","*://*.google.fr/*","*://*.google.ru/*"],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":137,"disable_reasons":1,"ephemeral_app":false,"events":[],"from_bookmark":false,"from_webstore":true,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13053688814685219","lastpingday":"13053941999904547","location":10,"manifest":{"background":{"page":"background.html"},"description":"This extension allows you to say â??Ok Googleâ?? and start speaking your search.","externally_connectable":{"ids":["dnhpdliibojhegemfjheidglijccjfmc"],"matches":["*://*.google.com/*","*://*.google.ru/*","*://*.google.co.uk/*","*://*.google.fr/*","*://*.google.de/*","chrome://newtab/"]},"icons":{"128":"images/icon-128.png","16":"images/icon-16.png","48":"images/icon-48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXIZX6oiu1YU4WTZBC5FCFw08u8fPtm75p6l9IzYaCCOjJh47sg1M5eatyBuVVvC2ahku3PzgquBZQZcRkr6kd9sa8jHUBeTQsvPv8yFicYlAqdguFtEK2kbXN2Ff5i61kIe79I6hZKlTJ6KsxiAcOPQpV1uIgJFyrFxTyC1u+WwIDAQAB","manifest_version":2,"minimum_chrome_version":"31","name":"Google Voice Search Hotword (Beta)","options_page":"options.html","permissions":["*://*.google.com/*","*://*.google.ru/*","*://*.google.co.uk/*","*://*.google.fr/*","*://*.google.de/*","audioCapture","hotwordPrivate","management","power","tabs"],"platforms":[{"lang":"de","nacl_arch":"arm","sub_package_path":"_platform_specific/arm_de/"},{"lang":"de","nacl_arch":"x86-32","sub_package_path":"_platform_specific/x86-32_de/"},{"lang":"de","nacl_arch":"x86-64","sub_package_path":"_platform_specific/x86-64_de/"},{"lang":"en-GB","nacl_arch":"arm","sub_package_path":"_platform_specific/arm_en-gb/"},{"lang":"en-GB","nacl_arch":"x86-32","sub_package_path":"_platform_specific/x86-32_en-gb/"},{"lang":"en-GB","nacl_arch":"x86-64","sub_package_path":"_platform_specific/x86-64_en-gb/"},{"lang":"fr","nacl_arch":"arm","sub_package_path":"_platform_specific/arm_fr/"},{"lang":"fr","nacl_arch":"x86-32","sub_package_path":"_platform_specific/x86-32_fr/"},{"lang":"fr","nacl_arch":"x86-64","sub_package_path":"_platform_specific/x86-64_fr/"},{"lang":"ru","nacl_arch":"arm","sub_package_path":"_platform_specific/arm_ru/"},{"lang":"ru","nacl_arch":"x86-32","sub_package_path":"_platform_specific/x86-32_ru/"},{"lang":"ru","nacl_arch":"x86-64","sub_package_path":"_platform_specific/x86-64_ru/"},{"nacl_arch":"arm","sub_package_path":"_platform_specific/arm_/"},{"nacl_arch":"x86-32","sub_package_path":"_platform_specific/x86-32_/"},{"nacl_arch":"x86-64","sub_package_path":"_platform_specific/x86-64_/"}],"update_url":"https://clients2.google.com/service/update2/crx","version":"0.1.1.5023","web_accessible_resources":["audio/1_short_Open_16_16.wav"]},"path":"bepbmhgboaologfdajaanbcjmnhjmhfn\\0.1.1.5023_0","preferences":{},"regular_only_preferences":{},"state":0,"was_installed_by_default":true,"was_installed_by_oem":false},"blpcfgokakmgnkcojhhkbfbldkacnbeo":{"ack_external":true,"active_bit":false,"active_permissions":{"api":[],"manifest_permissions":[]},"app_launcher_ordinal":"z","creation_flags":153,"events":[],"exclude_from_sideload_wipeout":true,"from_bookmark":true,"from_webstore":true,"granted_permissions":{"api":[],"manifest_permissions":[]},"install_time":"13023104845827058","last_active_pingday":"13008409199986190","lastpingday":"13053941999904547","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"hxxp://www.youtube.com/?feature=ytca"},"web_content":{"enabled":true,"origin":"hxxp://www.youtube.com"}},"current_locale":"de","default_locale":"en","description":"Die beliebteste Online-Video-Community der Welt","icons":{"128":"128.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/HotmFlyuz5FaHaIbVBhhL4BwbcUtsfWwzgUMpZt5ZsLB2nW/Y5xwNkkPANYGdVsJkT2GPpRRIKBO5QiJ7jPMa3EZtcZHpkygBlQLSjMhdrAKevpKgIl6YTkwzNvExY6rzVDzeE9zqnIs33eppY4S5QcoALMxuSWlMKqgFQjHQIDAQAB","manifest_version":2,"name":"YouTube","permissions":["appNotifications"],"update_url":"hxxp://clients2.google.com/service/update2/crx","version":"4.2.6"},"page_ordinal":"n","path":"blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.6_0","state":1,"was_installed_by_default":true},"booedmolknjekdopkepjjeckmjkdpfgl":{"active_permissions":{"api":["tabs","webNavigation","webRequest","webRequestBlocking"],"explicit_host":["chrome://newtab/*","chrome://settings-frame/*","hxxp://*/*","https://*/*"],"manifest_permissions":[],"scriptable_host":["chrome://settings-frame/*"]},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13038174574769994","location":5,"manifest":{"background":{"persistent":true,"scripts":["bk.js"]},"content_scripts":[{"js":["cs.js"],"matches":["chrome://settings-frame/*"]}],"content_security_policy":"default-src 'self'; script-src chrome://resources 'self' chrome://settings-frame 'unsafe-eval'; frame-src 'self' chrome://settings-frame; style-src 'self' 'unsafe-inline';object-src 'self';","description":"Extutil","incognito":"spanning","key":"MIAfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+ea9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB","manifest_version":2,"name":"Extutil","permissions":["chrome://newtab/","tabs","webNavigation","webRequest","webRequestBlocking","hxxp://*/*","https://*/*","chrome://settings-frame/"],"version":"0.1"},"path":"C:\\Users\\SILVIA~1\\AppData\\Local\\Temp\\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false},"cfhdojbkjhnklbpkdaibdccddilifddb":{"active_permissions":{"api":["contextMenus","notifications","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking"],"explicit_host":["hxxp://*/*","https://*/*"],"manifest_permissions":[],"scriptable_host":["hxxp://*/*","https://*/*"]},"content_settings":[],"creation_flags":9,"events":[],"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["contextMenus","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hxxp://*/*","https://*/*"],"scriptable_host":["hxxp://*/*","https://*/*"]},"has_declarative_rules":{"declarativeContent":{"onPageChanged":false},"declarativeWebRequest":{"onRequest":false}},"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13046804707750778","lastpingday":"13053941999904547","location":1,"manifest":{"background":{"scripts":["ext/common.js","ext/background.js","lib/compat.js","lib/info.js","lib/io.js","lib/adblockplus.js","lib/punycode.js","lib/publicSuffixList.js","lib/basedomain.js","lib/sha1.js","lib/jsbn.js","lib/rsa.js","webrequest.js","popupBlocker.js","iconAnimation.js","background.js"]},"browser_action":{"default_icon":{"19":"icons/abp-19.png","38":"icons/abp-38.png"},"default_popup":"popup.html","default_title":"Adblock Plus"},"content_scripts":[{"all_frames":true,"js":["ext/common.js","ext/content.js","include.preload.js"],"match_about_blank":true,"matches":["hxxp://*/*","https://*/*"],"run_at":"document_start"},{"all_frames":true,"js":["include.postload.js"],"match_about_blank":true,"matches":["hxxp://*/*","https://*/*"],"run_at":"document_end"}],"current_locale":"de","default_locale":"en_US","description":"Der kostenlose Werbeblocker fÃ¼r Chrome: Blockiert nervige Videowerbung auf YouTube, Facebook-Werbung, Werbebanner und vieles mehr.","icons":{"128":"icons/abp-128.png","16":"icons/abp-16.png","32":"icons/abp-32.png","48":"icons/abp-48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxGWIIBRUVzQIXITqE6+js1FA24fsZC58G0fxcO1Duwfps+9gip5tedTziErKEpeAQVkgasdT4kk+b6Lw27yp3oysAj6zD9j+j4W+EMArTXqMIc6SMYD7Z8bPcwPb3tC1MUxMSpO6oOVpFE23UhKe91SYnrK92nHI2cmsor5elXQIDAQAB","manifest_version":2,"minimum_chrome_version":"28.0","name":"Adblock Plus","options_page":"options.html","permissions":["tabs","hxxp://*/*","https://*/*","contextMenus","webRequest","webRequestBlocking","webNavigation","unlimitedStorage","notifications"],"update_url":"https://clients2.google.com/service/update2/crx","version":"1.8.3","web_accessible_resources":["block.html"]},"path":"cfhdojbkjhnklbpkdaibdccddilifddb\\1.8.3_0","preferences":{},"regular_only_preferences":{},"state":1,"was_installed_by_default":false,"was_installed_by_oem":false},"coobgpohoikkiipiblmjeljniedjpjpf":{"ack_external":true,"active_permissions":{"api":[],"manifest_permissions":[]},"app_launcher_ordinal":"yn","creation_flags":153,"events":[],"exclude_from_sideload_wipeout":true,"from_bookmark":true,"from_webstore":true,"granted_permissions":{"api":[],"manifest_permissions":[]},"install_time":"13023104854464058","lastpingday":"13053941999904547","location":1,"manifest":{"app":{"launch":{"web_url":"hxxp://www.google.com/webhp?source=search_app"},"urls":["*://www.google.com/search","*://www.google.com/webhp","*://www.google.com/imgres"]},"current_locale":"de","default_locale":"en","description":"Die schnellste Suche im Web.","icons":{"128":"128.png","16":"16.png","32":"32.png","48":"48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIiso3Loy5VJHL40shGhUl6it5ZG55XB9q/2EX6aa88jAxwPutbCgy5d9bm1YmBzLfSgpX4xcpgTU08ydWbd7b50fbkLsqWl1mRhxoqnN01kuNfv9Hbz9dWWYd+O4ZfD3L2XZs0wQqo0y6k64n+qeLkUMd1MIhf6MR8Xz1SOA8pwIDAQAB","manifest_version":2,"name":"Google-Suche","update_url":"hxxp://clients2.google.com/service/update2/crx","version":"0.0.0.20"},"page_ordinal":"n","path":"coobgpohoikkiipiblmjeljniedjpjpf\\0.0.0.20_0","state":1,"was_installed_by_default":true},"dnhpdliibojhegemfjheidglijccjfmc":{"active_permissions":{"api":["hotwordPrivate","tabs","webConnectable"],"explicit_host":["*://*.google.co.uk/*","*://*.google.com/*","*://*.google.de/*","*://*.google.fr/*","*://*.google.ru/*","chrome://newtab/*"],"manifest_permissions":[]},"commands":{},"content_settings":[],"creation_flags":1,"ephemeral_app":false,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13053688808970535","location":5,"manifest":{"background":{"persistent":false,"scripts":["manager.js"]},"externally_connectable":{"matches":["*://*.google.com/*","*://*.google.ru/*","*://*.google.co.uk/*","*://*.google.fr/*","*://*.google.de/*","chrome://newtab/"]},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDagiQy1VGkO2CHJSjVh7eU5GtuBuOlg2/cTZt7203AcevqpcDd+65S2/yd9KAELYcU6pK8nHVGYBMI6s0u+0RgXfIJ0eFOlTlgfAQWHvg8ovHtJlFJd1COrOkbntD9+s9Jobr3ldmow87aZF1bVHUY4khVP56cZe6adlVw2wK31QIDAQAB","manifest_version":2,"minimum_chrome_version":"32","name":"hotword helper","permissions":["*://*.google.com/*","*://*.google.ru/*","*://*.google.co.uk/*","*://*.google.fr/*","*://*.google.de/*","chrome://newtab/","hotwordPrivate","tabs"],"version":"0.0.2.0"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\37.0.2062.94\\resources\\hotword_helper","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false,"was_installed_by_oem":false},"eemcgdkfndhakfknompkggombfjjjeno":{"active_permissions":{"api":["bookmarks","bookmarkManagerPrivate","metricsPrivate","systemPrivate","tabs"],"explicit_host":["chrome://favicon/*","chrome://resources/*"],"manifest_permissions":[]},"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"install_time":"13008111595126124","location":5,"manifest":{"chrome_url_overrides":{"bookmarks":"main.html"},"content_security_policy":"object-src 'none'; script-src chrome://resources 'self'","description":"Bookmark Manager","incognito":"split","key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB","manifest_version":2,"name":"Bookmark Manager","permissions":["bookmarks","bookmarkManagerPrivate","systemPrivate","tabs","chrome://favicon/","chrome://resources/"],"version":"0.1"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\25.0.1364.172\\resources\\bookmark_manager","was_installed_by_default":false},"ennkphjdgehloodpbhlhldgbnhmacadg":{"active_permissions":{"api":[],"explicit_host":["chrome://settings-frame/*"],"manifest_permissions":[]},"app_launcher_ordinal":"t","creation_flags":1,"events":["app.runtime.onLaunched"],"from_bookmark":false,"from_webstore":false,"install_time":"13015973774467677","location":5,"manifest":{"app":{"background":{"scripts":["settings_app.js"]}},"description":"Settings","display_in_launcher":false,"icons":{"128":"settings_app_icon_128.png","16":"settings_app_icon_16.png","32":"settings_app_icon_32.png","48":"settings_app_icon_48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoVDPGX6fvKPVVgc+gnkYlGqHuuapgFDyKhsy4z7UzRLO/95zXPv8h8e5EacqbAQJLUbP6DERH5jowyNEYVxq9GJyntJMwP1ejvoz/52hnY3CCGGCmttmKzzpp5zwLuq3iZf8bslwywfflNUYtaCFSDa0TtrBZz0aOPrAAd/AhNwIDAQAB","manifest_version":2,"name":"Settings","permissions":["chrome://settings-frame/"],"version":"0.2"},"page_ordinal":"n","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\27.0.1453.110\\resources\\settings_app","running":false,"was_installed_by_default":false},"flpcjncodpafbgdpnkljologafpionhb":{"active_permissions":{"api":["tabs","webNavigation"],"explicit_host":["chrome://favicon/*","chrome://resources/*","chrome://settings-frame/*","hxxp://*.conduit.com/*","hxxp://*.devqaguard-search.com/*","hxxp://*.devtrovi.com/*","hxxp://*.devtrovigo.com/*","hxxp://*.guard-search.com/*","hxxp://*.qaautoguard-search.com/*","hxxp://*.qaautotrovi.com/*","hxxp://*.qaautotrovigo.com/*","hxxp://*.qaguard-search.com/*","hxxp://*.qasite-auto.com/*","hxxp://*.qasite.com/*","hxxp://*.qatrovi.com/*","hxxp://*.qatrovigo.com/*","hxxp://*.search.site.com/*","hxxp://*.trovi.com/*","hxxp://*.trovigo.com/*","hxxp://*/*","https://*/*"],"manifest_permissions":[],"scriptable_host":["chrome://settings-frame/*","hxxp://*.conduit.com/*","hxxp://*.devqaguard-search.com/*","hxxp://*.devtrovi.com/*","hxxp://*.devtrovigo.com/*","hxxp://*.guard-search.com/*","hxxp://*.qaautoguard-search.com/*","hxxp://*.qaautotrovi.com/*","hxxp://*.qaautotrovigo.com/*","hxxp://*.qaguard-search.com/*","hxxp://*.qasite-auto.com/*","hxxp://*.qasite.com/*","hxxp://*.qatrovi.com/*","hxxp://*.qatrovigo.com/*","hxxp://*.search.site.com/*","hxxp://*.trovi.com/*","hxxp://*.trovigo.com/*"]},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13038174574784994","location":5,"manifest":{"background":{"page":"background___background.html","persistent":true},"content_scripts":[{"js":["cs.js"],"matches":["hxxp://search.conduit.com/*","hxxp://search.qasite.com/*","chrome://settings-frame/*"]}],"content_security_policy":"default-src 'self'; script-src chrome://resources 'self' chrome://settings-frame 'unsafe-eval'; frame-src 'self' chrome://settings-frame; style-src 'self' 'unsafe-inline';object-src 'self';","description":"Managera","incognito":"spanning","key":"MIAfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB","manifest_version":2,"name":"Managera","permissions":["tabs","webNavigation","hxxp://search.conduit.com/*","hxxp://search.qasite.com/*","chrome://favicon/","chrome://resources/","chrome://settings-frame/","chrome://resources/","hxxp://*/*","https://*/*"],"version":"0.1"},"path":"C:\\Users\\SILVIA~1\\AppData\\Local\\Temp\\38fdaae5-8e0e-493c-88ec-e05c3be06e42","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false},"gfdkimpbcpahaombhbimeihdjnejgicl":{"active_permissions":{"api":["feedbackPrivate"],"explicit_host":["chrome://resources/*"],"manifest_permissions":[]},"creation_flags":1,"events":["feedbackPrivate.onFeedbackRequested"],"from_bookmark":false,"from_webstore":false,"initial_keybindings_set":true,"install_time":"13029705203232714","location":5,"manifest":{"app":{"background":{"scripts":["js/event_handler.js"]},"content_security_policy":"default-src 'none'; script-src 'self' chrome://resources; style-src 'unsafe-inline' *; img-src *; media-src 'self'"},"description":"User feedback extension","display_in_launcher":false,"display_in_new_tab_page":false,"icons":{"32":"images/icon32.png","64":"images/icon64.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMZElzFX2J1g1nRQ/8S3rg/1CjFyDltWOxQg+9M8aVgNVxbutEWFQz+oQzIP9BB67mJifULgiv12ToFKsae4NpEUR8sPZjiKDIHumc6pUdixOm8SJ5Rs16SMR6+VYxFUjlVW+5CA3IILptmNBxgpfyqoK0qRpBDIhGk1KDEZ4zqQIDAQAB","manifest_version":2,"name":"Feedback","permissions":["feedbackPrivate","chrome://resources/"],"version":"1.0"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\31.0.1650.57\\resources\\feedback","running":false,"was_installed_by_default":false},"kmendfapggjehodndflmmgagdbamhnfd":{"active_permissions":{"api":["hid","usb",{"usbDevices":[{"interfaceId":-1,"productId":512,"vendorId":4176},{"interfaceId":-1,"productId":529,"vendorId":4176}]},"webConnectable"],"explicit_host":["https://www.gstatic.com/*"],"manifest_permissions":[]},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13050445059205326","location":5,"manifest":{"background":{"persistent":false,"scripts":["util.js","b64.js","closeable.js","countdown.js","sha256.js","llgnubby.js","llhidgnubby.js","llusbgnubby.js","gnubbies.js","gnubby.js","gnubby-u2f.js","gnubbycodetypes.js","gnubbyfactory.js","gnubbymsgtypes.js","usbgnubbyfactory.js","devicestatuscodes.js","enroller.js","enrollhelper.js","usbenrollhelper.js","requestqueue.js","signer.js","signhelper.js","singlesigner.js","multiplesigner.js","usbsignhelper.js","webrequest.js","background.js"]},"description":"CryptoToken Component Extension","externally_connectable":{"accepts_tls_channel_id":true,"matches":["https://login.corp.google.com/*","https://accounts.google.com/*","https://security.google.com/*"]},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7zRobvA+AVlvNqkHSSVhh1sEWsHSqz4oR/XptkDe/Cz3+gW9ZGumZ20NCHjaac8j1iiesdigp8B1LJsd/2WWv2Dbnto4f8GrQ5MVphKyQ9WJHwejEHN2K4vzrTcwaXqv5BSTXwxlxS/mXCmXskTfryKTLuYrcHEWK8fCHb+0gvr8b/kvsi75A1aMmb6nUnFJvETmCkOCPNX5CHTdy634Ts/x0fLhRuPlahk63rdf7agxQv5viVjQFk+tbgv6aa9kdSd11Js/RZ9yZjrFgHOBWgP4jTBqud4+HUglrzu8qynFipyNRLCZsaxhm+NItTyNgesxLdxZcwOz56KD1Q4IQIDAQAB","manifest_version":2,"name":"CryptoTokenExtension","permissions":["hid","usb",{"usbDevices":[{"productId":512,"vendorId":4176},{"productId":529,"vendorId":4176}]},"https://www.gstatic.com/"],"version":"0.0.1"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\36.0.1985.125\\resources\\cryptotoken","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false,"was_installed_by_oem":false},"mfehgcgbbipciphmccgaenjidiccnmng":{"active_permissions":{"api":["cloudPrintPrivate"],"manifest_permissions":[]},"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"install_time":"13008111595126124","location":5,"manifest":{"app":{"launch":{"web_url":"https://www.google.com/cloudprint"},"urls":["https://www.google.com/cloudprint","https://www.google.com/cloudprint/enable_chrome_connector"]},"description":"Cloud Print","display_in_launcher":false,"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqOhnwk4+HXVfGyaNsAQdU/js1Na56diW08oF1MhZiwzSnJsEaeuMN9od9q9N4ZdK3o1xXOSARrYdE+syV7Dl31nf6qz3A6K+D5NHe6sSB9yvYlIiN37jdWdrfxxE0pRYEVYZNTe3bzq3NkcYJlOdt1UPcpJB+isXpAGUKUvt7EQIDAQAB","name":"Cloud Print","permissions":["cloudPrintPrivate"],"version":"0.1"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\25.0.1364.172\\resources\\cloud_print","was_installed_by_default":false},"mfffpogegjflfpflabcdkioaeobkgjik":{"active_permissions":{"api":["webRequest","webRequestBlocking"],"explicit_host":["\u003Call_urls>","chrome://favicon/*"],"manifest_permissions":[],"scriptable_host":["\u003Call_urls>"]},"commands":{},"content_settings":[],"creation_flags":1,"ephemeral_app":false,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13054231704000842","location":5,"manifest":{"background":{"scripts":["background.js","channel.js"]},"content_scripts":[{"all_frames":true,"js":["channel.js","saml_injected.js"],"matches":["\u003Call_urls>"]}],"content_security_policy":"default-src 'self'; script-src 'self'; frame-src *; style-src 'self' 'unsafe-inline'","description":"GAIA Component Extension","key":"MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC4L17nAfeTd6Xhtx96WhQ6DSr8KdHeQmfzgCkieKLCgUkWdwB9G1DCuh0EPMDn1MdtSwUAT7xE36APEzi0X/UpKjOVyX8tCC3aQcLoRAE0aJAvCcGwK7qIaQaczHmHKvPC2lrRdzSoMMTC5esvHX+ZqIBMi123FOL0dGW6OPKzIwIBIw==","manifest_version":2,"name":"GaiaAuthExtension","permissions":["\u003Call_urls>","webRequest","webRequestBlocking"],"version":"0.0.1","web_accessible_resources":["main.css","main.html","main.js","offline.css","offline.html","offline.js","success.html","success.js","util.js"]},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\37.0.2062.102\\resources\\gaia_auth","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false,"was_installed_by_oem":false},"mgndgikekgjfcpckkfioiadnlibdjbkf":{"active_permissions":{"api":[],"manifest_permissions":[]},"app_launcher_ordinal":"zm","creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"install_time":"13015973774467677","location":5,"manifest":{"app":{"launch":{"web_url":"hxxp://THIS-WILL-BE-REPLACED"}},"description":"Chrome as an app","display_in_launcher":true,"display_in_new_tab_page":false,"icons":{"128":"product_logo_128.png","16":"product_logo_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNuYLEQ1QPMcc5HfWI/9jiEf6FdJWqEtgRmIeI7qtjPLBM5oje+Ny2E2mTAhou5qdJiO2CHWdU1DQXY2F7Zu2gZaKZgHLfK4WimHxUT5Xd9/aro/R9PCzjguM1BLusiWYc9xlj1IsZpyiN1hcjU7SCnBhv1feQlv2WSB5KRiXwhQIDAQAB","name":"Chrome","version":"0.1"},"page_ordinal":"n","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\27.0.1453.110\\resources\\chrome_app","was_installed_by_default":false},"neajdppkdcdipfabeoofebfddakdcjhd":{"active_permissions":{"api":["systemPrivate","ttsEngine"],"explicit_host":["https://www.google.com/*"],"manifest_permissions":[]},"content_settings":[],"creation_flags":1,"events":["ttsEngine.onPause","ttsEngine.onResume","ttsEngine.onSpeak","ttsEngine.onStop"],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13037924344578509","location":5,"manifest":{"background":{"persistent":false,"scripts":["tts_extension.js"]},"description":"Component extension providing speech via the Google network text-to-speech service.","key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8GSbNUMGygqQTNDMFGIjZNcwXsHLzkNkHjWbuY37PbNdSDZ4VqlVjzbWqODSe+MjELdv5Keb51IdytnoGYXBMyqKmWpUrg+RnKvQ5ibWr4MW9pyIceOIdp9GrzC1WZGgTmZismYR3AjaIpufZ7xDdQQv+XrghPWCkdVqLN+qZDA1HU+DURznkMICiDDSH2sU0egm9UbWfS218bZqzKeQDiC3OnTPlaxcbJtKUuupIm5knjze3Wo9Ae9poTDMzKgchg0VlFCv3uqox+wlD8sjXBoyBCCK9HpImdVAF1a7jpdgiUHpPeV/26oYzM9/grltwNR3bzECQgSpyXp0eyoegwIDAQAB","manifest_version":2,"name":"Google Network Speech","permissions":["systemPrivate","ttsEngine","https://www.google.com/"],"tts_engine":{"voices":[{"event_types":["start","end","error"],"gender":"female","lang":"en-US","remote":true,"voice_name":"Google US English"},{"event_types":["start","end","error"],"gender":"male","lang":"en-GB","remote":true,"voice_name":"Google UK English Male"},{"event_types":["start","end","error"],"gender":"female","lang":"en-GB","remote":true,"voice_name":"Google UK English Female"},{"event_types":["start","end","error"],"gender":"female","lang":"es-ES","remote":true,"voice_name":"Google EspaÃ±ol"},{"event_types":["start","end","error"],"gender":"female","lang":"fr-FR","remote":true,"voice_name":"Google FranÃ§ais"},{"event_types":["start","end","error"],"gender":"female","lang":"it-IT","remote":true,"voice_name":"Google Italiano"},{"event_types":["start","end","error"],"gender":"female","lang":"de-DE","remote":true,"voice_name":"Google Deutsch"},{"event_types":["start","end","error"],"gender":"female","lang":"ja-JP","remote":true,"voice_name":"Google æ?¥æ?¬äºº"},{"event_types":["start","end","error"],"gender":"female","lang":"ko-KR","remote":true,"voice_name":"Google í??êµ*ì?"},{"event_types":["start","end","error"],"gender":"female","lang":"zh-CN","remote":true,"voice_name":"Google ä¸*å?½ç??"}]},"version":"1.0"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\33.0.1750.117\\resources\\network_speech_synthesis","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false},"nikpibnbobmbdbheedjfogjlikpgpnhp":{"ack_external":true,"active_permissions":{"api":["contextMenus","plugin","tabs"],"explicit_host":["hxxp://*.youtube.com/*","https://*.youtube.com/*"],"manifest_permissions":[],"scriptable_host":["hxxp://*.youtube.com/*","https://*.youtube.com/*"]},"creation_flags":1,"from_bookmark":false,"from_webstore":false,"initial_keybindings_set":true,"install_time":"13025218260176513","lastpingday":"13053941999904547","location":3,"manifest":{"background":{"page":"background.html"},"content_scripts":[{"css":["dvs_freeyoutubedownload.css"],"js":["dvs_freeyoutubedownload.js"],"matches":["hxxp://*.youtube.com/*","https://*.youtube.com/*"],"run_at":"document_end"}],"current_locale":"de","default_locale":"en","description":"DVDVideoSoft Free YouTube Download starten","icons":{"128":"dvs_logo_128.png","16":"dvs_logo.png","32":"dvs_logo_32.png","48":"dvs_logo_48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaCWFizilBLd9sYTblYhFnaowEtfxkyIRw5PA8K1HhC0IFf5qzC/uzCcFX5SJJV9DtPPBnpdyiOwFhFeBysVN2OB/CfBGxHqeUUpxcBU8fZvYsg30+VK1KOHfycyARvdk9P6AgNvHT2YmgJza0IZBUR1U7idBjBFwNe+AhEHCe5QIDAQAB","manifest_version":2,"name":"DVDVideoSoft","permissions":["tabs","hxxp://*.youtube.com/*","https://*.youtube.com/*","contextMenus"],"plugins":[{"path":"np_dvs_plugin.dll"}],"version":"1.3.0.0","web_accessible_resources":["images/YoutubeToMp3.png","images/small.png","images/YoutubeDownloader.png","images/download_video_btn.png","images/download_mp3_btn.png","images/backbar.png","images/download.png","images/headphone.png","fs.png","dvs_freeyoutubedownload.css","dvs_freeyoutubedownload.js","logo.png","errorRunProgramm.html","dvs_logo.ico","dvs_logo.png","dvs_logo_32.png","dvs_logo_48.png","dvs_logo_128.png"]},"path":"nikpibnbobmbdbheedjfogjlikpgpnhp\\1.3.0.0_0","state":0,"was_installed_by_default":false},"nkeimhogjdpnpccoofpliimaahmaaome":{"active_permissions":{"api":["alarms","desktopCapture","processes","webConnectable","webrtcAudioPrivate","webrtcLoggingPrivate","system.cpu"],"manifest_permissions":[]},"creation_flags":1,"events":["alarms.onAlarm","runtime.onStartup"],"from_bookmark":false,"from_webstore":false,"initial_keybindings_set":true,"install_time":"13034507785206799","location":5,"manifest":{"background":{"page":"background.html","persistent":false},"externally_connectable":{"matches":["https://*.google.com/hangouts*","*://localhost/*"]},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB","manifest_version":2,"name":"Hangout Services","permissions":["desktopCapture","system.cpu","webrtcAudioPrivate","webrtcLoggingPrivate"],"version":"1.0"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\32.0.1700.76\\resources\\hangout_services","was_installed_by_default":false},"nmmhkkegccagdldgiimedpiccmgmieda":{"ack_external":true,"active_permissions":{"api":["identity","webview"],"explicit_host":["https://checkout.google.com/*","https://sandbox.google.com/*","https://www.google.com/*","https://www.googleapis.com/*"],"manifest_permissions":[]},"creation_flags":137,"events":["app.runtime.onLaunched"],"from_bookmark":false,"from_webstore":true,"has_declarative_rules":{"declarativeContent":{"onPageChanged":false},"declarativeWebRequest":{"onRequest":false}},"initial_keybindings_set":true,"install_time":"13037311064775111","lastpingday":"13053941999904547","location":10,"manifest":{"app":{"background":{"scripts":["craw_background.js"]}},"current_locale":"de","default_locale":"en","description":"Google Wallet fÃ¼r digitale Produkte","display_in_launcher":false,"display_in_new_tab_page":false,"icons":{"128":"images/icon_128.png","16":"images/icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB","manifest_version":2,"minimum_chrome_version":"29","name":"Google Wallet","oauth2":{"auto_approve":true,"client_id":"203784468217.apps.googleusercontent.com","scopes":["https://www.googleapis.com/auth/sierra","https://www.googleapis.com/auth/sierrasandbox","https://www.googleapis.com/auth/chromewebstore","https://www.googleapis.com/auth/chromewebstore.readonly"]},"permissions":["identity","webview","https://checkout.google.com/","https://sandbox.google.com/checkout/","https://www.google.com/","https://www.googleapis.com/*"],"update_url":"https://clients2.google.com/service/update2/crx","version":"0.0.6.1"},"path":"nmmhkkegccagdldgiimedpiccmgmieda\\0.0.6.1_0","running":false,"state":1,"was_installed_by_default":true},"pafkbggdmjlpgkdkcbjmhmfcdpncadgh":{"active_permissions":{"api":["alarms","identity","metricsPrivate","notifications","pushMessaging","storage","tabs","webstorePrivate"],"explicit_host":["*://*.google.com/*","*://*.gstatic.com/*","https://*.googleapis.com/*","https://*.googleusercontent.com/*"],"manifest_permissions":[]},"content_settings":[],"creation_flags":1,"events":["alarms.onAlarm","identity.onSignInChanged","notifications.onButtonClicked","notifications.onClicked","notifications.onClosed","notifications.onPermissionLevelChanged","notifications.onShowSettings","pushMessaging.onMessage","runtime.onInstalled","runtime.onStartup","runtime.onSuspend","storage.onChanged"],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"initial_keybindings_set":true,"install_time":"13047929361180757","location":5,"manifest":{"background":{"persistent":false,"scripts":["utility.js","cards.js","background.js"]},"description":"Integrates Google Now into Chrome.","icons":{"128":"images/icon128.png","16":"images/icon16.png","48":"images/icon48.png"},"key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkhqJr32OFD/bMXW4Md7jMfd7LbwHXVc6x5bBQG5U+dloofoxrICDR20yur/40mQ8O//0sS1b8srvbab1CRlSrxoNCr9T80NAkfzx0gHyVS+p1Zow+1FzLMu9PiGwwFyN80HIB7GI/dIa0wC9K/2OrrzcHEhVH96DacTtWQqjfDVtZPjT7Xwv23dgoWcpbkRC86jMJot3dmX9xnn0KzoVc9gDOHSIkBLbkkr6Sp3LGXCCM4L0DJgxdFwaLr5WBzgC3y5x0/wwPIwN4PtIaK3BhH6njlksfnKwwIJ9iRT41V4BqbWu4mszO/7VJ3HJyw2DBpIc2grU9ZRRxrV3fRQG4wIDAQAB","manifest_version":2,"name":"Google Now","oauth2":{"auto_approve":true,"scopes":["https://www.googleapis.com/auth/googlenow"]},"optional_permissions":["background"],"permissions":["alarms","identity","metricsPrivate","notifications","pushMessaging","storage","tabs","webstorePrivate","\u003Call_urls>"],"version":"1.2.0.1"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\35.0.1916.153\\resources\\google_now","preferences":{},"regular_only_preferences":{},"was_installed_by_default":false,"was_installed_by_oem":false},"pjkljhegncpnkpknbcohdijeoejaedia":{"ack_external":true,"active_permissions":{"api":["notifications"],"manifest_permissions":[]},"app_launcher_ordinal":"x","creation_flags":137,"events":[],"exclude_from_sideload_wipeout":true,"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["notifications"],"manifest_permissions":[]},"install_time":"13008111598275457","lastpingday":"13053941999904547","location":1,"manifest":{"app":{"launch":{"container":"tab","web_url":"https://mail.google.com/mail/ca"},"urls":["*://mail.google.com/mail/ca"]},"current_locale":"de","default_locale":"en","description":"Schneller E-Mail-Dienst mit Suchfunktion und wenig Spam.","icons":{"128":"128.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB","name":"Google Mail","options_page":"https://mail.google.com/mail/ca/#settings","permissions":["notifications"],"update_url":"hxxp://clients2.google.com/service/update2/crx","version":"7"},"page_ordinal":"n","path":"pjkljhegncpnkpknbcohdijeoejaedia\\7_0","state":1,"was_installed_by_default":true}},"sideload_wipeout_done":true,"toolbar":["cfhdojbkjhnklbpkdaibdccddilifddb"],"toolbarsize":-1},"google":{"services":{"last_username":"","signin":{"LSID":"","SID":""}}},"homepage":"hxxp://www.trovigo.com/?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&SSPV=","homepage_is_newtabpage":false,"hotword":{"previous_language":"de"},"intl":{"accept_languages":"de-DE,de,en-US,en"},"invalidator":{"client_id":"/tcmAdgRpLfPWo+m1PmI6w=="},"media":{"device_id_salt":"oAPjO7TsbVWHoIfBNooV2Q=="},"net":{"http_server_properties":{"servers":{"1523642.fls.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"2793343.fls.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"2842197.fls.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"3049647.fls.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"}},"3053213.fls.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"3090800.fls.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"4433837.fls.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"946800.fls.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"accounts.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"accounts.youtube.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"ad-emea.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"}},"ad-emea.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"ad.de.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"ad.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"ad.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"ajax.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"ajax.googleapis.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"api.autocompleteplus.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"api.facebook.com:443":{"supports_spdy":true},"apis.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"chrome.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"chtatic.appspot.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"chtatic.appspot.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"clients1.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"clients1.google.de:443":{"supports_spdy":true},"clients2.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"clients2.googleusercontent.com:443":{"supports_spdy":true},"cm.g.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"cm.g.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"csi.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"csi.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"easylist-downloads.adblockplus.org:443":{"supports_spdy":true},"encrypted-tbn2.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"encrypted-tbn3.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"fbcdn-profile-a.akamaihd.net:443":{"supports_spdy":true},"fbstatic-a.akamaihd.net:443":{"supports_spdy":true},"fls.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"fls.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"fonts.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"fonts.googleapis.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"fonts.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"fonts.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"gartenkai.files.wordpress.com:443":{"supports_spdy":true},"gdata.youtube.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"gdata.youtube.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"gg.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"googleads.g.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"googleads.g.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"gp3.googleusercontent.com:443":{"supports_spdy":true},"gp4.googleusercontent.com:443":{"supports_spdy":true},"gp5.googleusercontent.com:443":{"supports_spdy":true},"gp6.googleusercontent.com:443":{"supports_spdy":true},"graph.facebook.com:443":{"supports_spdy":true},"i.ytimg.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"i1.ytimg.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"i1.ytimg.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"id.google.de:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"khms0.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"}},"khms1.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"lh3.googleusercontent.com:443":{"supports_spdy":true},"lh4.ggpht.com:443":{"supports_spdy":true},"lh4.googleusercontent.com:443":{"supports_spdy":true},"lh5.googleusercontent.com:443":{"settings":{"4":100},"supports_spdy":true},"lh6.googleusercontent.com:443":{"supports_spdy":true},"maps-api-ssl.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"maps.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"maps.google.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"maps.google.de:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"maps.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"maps.googleapis.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"maps.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"maps.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"mts.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"mts0.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"mts0.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"mts1.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"mts1.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"notification.adblockplus.org:443":{"supports_spdy":true},"oauth.googleusercontent.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"pagead2.googlesyndication.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"partner.googleadservices.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"pixel.facebook.com:443":{"supports_spdy":true},"plus.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"plus.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"plusone.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"pubads.g.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"pubads.g.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"public-api.wordpress.com:443":{"supports_spdy":true},"r.twimg.com:443":{"supports_spdy":true},"r3---sn-4g57knkd.googlevideo.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"}},"s.youtube.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"s.youtube.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"s.ytimg.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"s.ytimg.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"s2.youtube.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"scontent-b-ams.xx.fbcdn.net:443":{"supports_spdy":true},"seal.globalsign.com:443":{"supports_spdy":true},"secure.avaaz.org:443":{"supports_spdy":true},"snapabug.appspot.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"snapabug.appspot.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"ssif1.globalsign.com:443":{"supports_spdy":true},"ssl.google-analytics.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"ssl.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"stats.avaaz.org:443":{"supports_spdy":true},"stats.g.doubleclick.net:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"stats.g.doubleclick.net:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"syndication.twitter.com:443":{"supports_spdy":true},"themes.googleusercontent.com:443":{"supports_spdy":true},"twitter.com:443":{"supports_spdy":true},"www.facebook.com:443":{"supports_spdy":true},"www.google-analytics.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"www.google-analytics.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.google.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"www.google.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.google.de:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"www.google.de:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.googleadservices.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"www.googleadservices.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.googleapis.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"www.googletagmanager.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"www.googletagmanager.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.googletagservices.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"www.googletagservices.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.gstatic.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"settings":{"4":100},"supports_spdy":true},"www.gstatic.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.ig.gmodules.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.paypal.com:443":{"supports_spdy":true},"www.snapengage.com:443":{"supports_spdy":true},"www.snapengage.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.youtube-nocookie.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"www.youtube-nocookie.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"www.youtube.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true},"www.youtube.com:80":{"alternate_protocol":{"port":80,"protocol_str":"quic"}},"yt3.ggpht.com:443":{"alternate_protocol":{"port":443,"protocol_str":"quic"},"supports_spdy":true}},"version":3}},"ntp":{"app_page_names":["Apps"]},"pinned_tabs":[],"plugins":{"enabled_internal_pdf3":true,"enabled_nacl":true,"last_internal_directory":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\37.0.2062.102","migrated_to_pepper_flash":true,"plugins_list":[{"enabled":true,"name":"Shockwave Flash","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\37.0.2062.102\\PepperFlash\\pepflashplayer.dll","version":"11.6.602.180"},{"enabled":true,"name":"Chrome Remote Desktop Viewer","path":"internal-remoting-viewer","version":""},{"enabled":true,"name":"Native Client","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\37.0.2062.102\\ppGoogleNaClPluginChrome.dll","version":""},{"enabled":true,"name":"Chrome PDF Viewer","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\37.0.2062.102\\pdf.dll","version":""},{"enabled":true,"name":"Nero Kwik Media Helper","path":"C:\\PROGRA~2\\COMMON~1\\Nero\\BROWSE~1\\NPBROW~1.DLL","version":"1.1.2.0"},{"enabled":true,"name":"Google Update","path":"C:\\Program Files (x86)\\Google\\Update\\1.3.21.135\\npGoogleUpdate3.dll","version":"1.3.21.135"},{"enabled":true,"name":"IntelÂ® Identity Protection Technology","path":"C:\\Program Files (x86)\\Intel\\Intel(R) Management Engine Components\\IPT\\npIntelWebAPIIPT.dll","version":"2.1.42.0"},{"enabled":true,"name":"IntelÂ® Identity Protection Technology","path":"C:\\Program Files (x86)\\Intel\\Intel(R) Management Engine Components\\IPT\\npIntelWebAPIUpdater.dll","version":"2.1.42.0"},{"enabled":true,"name":"McAfee SecurityCenter","path":"c:\\progra~2\\mcafee\\msc\\npmcsn~1.dll","version":"11,6,334,0"},{"enabled":true,"name":"Adobe Flash Player"},{"enabled":true,"name":"Chrome PDF Viewer"},{"enabled":true,"name":"Chrome Remote Desktop Viewer"},{"enabled":true,"name":"Google Update"},{"enabled":true,"name":"IntelÂ® Identity Protection Technology"},{"enabled":true,"name":"McAfee SecurityCenter"},{"enabled":true,"name":"Native Client"},{"enabled":true,"name":"Nero Kwik Media Helper"}],"removed_old_component_pepper_flash_settings":true},"printing":{"print_preview_sticky_settings":{"appState":"{\"version\":2,\"isGcpPromoDismissed\":false,\"selectedDestinationId\":\"Epson AL-C1100\",\"selectedDestinationOrigin\":\"local\",\"customMargins\":null,\"undefined\":{\"version\":\"1.0\",\"printer\":{\"collate\":{\"default\":true},\"color\":{\"option\":[{\"type\":\"STANDARD_COLOR\",\"is_default\":true},{\"type\":\"STANDARD_MONOCHROME\",\"is_default\":false}]},\"copies\":{\"default\":1},\"duplex\":{\"option\":[{\"type\":\"NO_DUPLEX\",\"is_default\":true},{\"type\":\"LONG_EDGE\",\"is_default\":false}]},\"page_orientation\":{\"option\":[{\"type\":\"PORTRAIT\",\"is_default\":true},{\"type\":\"LANDSCAPE\"}]}}},\"selectedDestinationName\":\"Epson AL-C1100\"}"}},"profile":{"avatar_index":0,"content_settings":{"clear_on_exit_migrated":true,"pattern_pairs":{"hxxp://www.lte-anbieter.info:80,hxxp://www.lte-anbieter.info:80":{"geolocation":2},"https://[*.]www.youtube.com:443,*":{"fullscreen":1}},"pref_version":1},"exit_type":"Normal","exited_cleanly":true,"icon_version":2,"managed_user_id":"","name":"Erster Nutzer","per_host_zoom_levels":{"www.ganzheitlichelebenshilfe.de":1.2239010334014893}},"protection":{"macs":{"browser":{"show_home_button":"0018D52A2F5663B947F2D4E73AF6E1425CB8D070DCBE1DF62FCD508BB388FB14"},"default_search_provider":{"keyword":"DFD8361BBF8643DAC1391493A3AFEF6859D25886D4550BFBACADAE54E01A6682","name":"C6536FF21661B7B36838A5226A45784BEFA74951C4C23B934883B4C9B77FED19","search_url":"533AEDE957531FC70C08A707932AFA3361A4D1952F1FFFBBF04CBF17FFEBBC78"},"default_search_provider_data":{"template_url_data":"04B732E4AFD816D4583B0699059AFDC0F82D9086B6592040BB9DDB7BC53A9770"},"extensions":{"known_disabled":"3F9CE86EE55E0B2760386B0F1266D7B4A91FEDC7AB151F5B1F2D06A2423CCC8C","settings":{"ahfgeienlihckogmohjhadlkjgocpleb":"5F81415C02A97B935A3011C52AED129DD5C17C5467829189D5AA30BBFF7314CE","aohghmighlieiainnegkcijnfilokake":"3E5360C32F54BDB7C573F4D8381D63666BAA2760E5CB83851D351F13876CC4F8","apdfllckaahabafndbhieahigkjlhalf":"A4CC3E2151E93C8AB9948A7803FFF0D4A0BF4E18FB77344EA77F4DAA32164DED","bepbmhgboaologfdajaanbcjmnhjmhfn":"BC3947A8110FFB0EEF781537F576BE91A36D27B6641D85A09BCC373A67E95441","blpcfgokakmgnkcojhhkbfbldkacnbeo":"A0F21C3FFCDE3D8241F8A62BFA29EDC7227B0A48D488716588F6083A26A46015","booedmolknjekdopkepjjeckmjkdpfgl":"620766B373F8286DF6E4A305A1F5F0A9CD875C44C9FD6032ABC09540194A6AE3","cfhdojbkjhnklbpkdaibdccddilifddb":"415FA322928FC256E94AF707E29A120909E799F5694511D43939CBFFCFD90358","coobgpohoikkiipiblmjeljniedjpjpf":"AEB96B8F430DFF499E62BCA31593AEC848DC2C4E90589BA2A77BFB1A3A263C3F","dnhpdliibojhegemfjheidglijccjfmc":"E26E12A6D1E1C5C5854ED36D128EF16DE9FF2E1743BDDDC241E276C9DD9AC612","eemcgdkfndhakfknompkggombfjjjeno":"47C39C5EDEB37591B9E09D58484124A675F51495ACCD1BF690E7A4930E932076","ennkphjdgehloodpbhlhldgbnhmacadg":"A876ADF77E82CDF460245A43007F22422700C26C1BD0BDE4EE8C07BAEB4103E8","flpcjncodpafbgdpnkljologafpionhb":"8C6CAD6DCB414695EBAFFB20C3AC8BB7F64081D2774C8E9AB84D2CD00EAB3513","gfdkimpbcpahaombhbimeihdjnejgicl":"7593F6476425091C8FE439B2921927B557811A9049F1A8D83FB840B8CC615984","kmendfapggjehodndflmmgagdbamhnfd":"C6B9D1AE776D868759488710426ED7B34A01E3FEEE9A491B262B218E79DE30EE","mfehgcgbbipciphmccgaenjidiccnmng":"40C88B84A5323697AA40E64DF2938B3E210EE059608353380E8B5F253539E7BD","mfffpogegjflfpflabcdkioaeobkgjik":"AEFA8799C4F154879A7F05A16DDE1BD06566C2E30C93D8514DA424A3E45FEDC1","mgndgikekgjfcpckkfioiadnlibdjbkf":"E91F999281F2EB2342CE8780CA22B4257665EA3773D2DB1074ADDEF337D8DC6F","neajdppkdcdipfabeoofebfddakdcjhd":"564EE1990D5714319E1649D60EAEDDFEFFBD691F286133EC6AA6584EE94B4BE5","nikpibnbobmbdbheedjfogjlikpgpnhp":"3005DBC68EFB86EDE9E9A38C6A9A40E4FA58C726B317B1179520762F7D6B0F86","nkeimhogjdpnpccoofpliimaahmaaome":"14695EE66483A91BB87E2F66DF17D7D43AC3709ED8D30F6A4DFDB9A04BF73984","nmmhkkegccagdldgiimedpiccmgmieda":"5C3C375B5951BA6F38F2D644B1958F33A398FD330279E73217781DA78D7235CB","pafkbggdmjlpgkdkcbjmhmfcdpncadgh":"AFD3FC077E025CBFCB8AC702FF2E92F26E2B5D205B01734C409A7D4BFBE84A58","pjkljhegncpnkpknbcohdijeoejaedia":"E6DFD59E90172F7779226EF89BD111946983AE01FC600BAC12CE68E7D251C01A"}},"google":{"services":{"last_username":"A0FCDF1F4D68B1E4BC5F80D220AB171DF66338DCAF74321A001F05CD17F31070"}},"homepage":"9F84AD1D95601C5365E9E0F550710A09FC0D50B9844D672C978D94CBAE4C1032","homepage_is_newtabpage":"81D84562E30C3F9BD66FB21F0FF4B0FB732D7C1624CF0E8C74DBFD986275E13F","pinned_tabs":"D14A22F9D54694E91FCDFEEE4E78F1547F07B485392342B668C068CF4AEE8313","prefs":{"preference_reset_time":"DADB77505A01E595A10FD741EFDCDAA52D0EDA7EED4FD9480FACA567FC9FD3CA"},"profile":{"reset_prompt_memento":"186F27D2B5B7333C906D40513EC19A3879C4371C953C3872F8412602952DD609"},"safebrowsing":{"incident_report_sent":"663662B252D49C25927C4B2B758553124FCD0CA547989E72DBC2461FDA2F4993"},"search_provider_overrides":"6D988DF439F4DA5101424F93A040CA58604724FE726C79E5D175A06D03639C89","session":{"restore_on_startup":"3B68211568C412AB1B7EC6F03C0455B3699AF50BA1CD7274C25CB5B6A94F1D69","startup_urls":"B3D2B8FF2D9508C8C0FD30A33C2C614B4360FFD6C7CC8D3AB89B4DC3152F1645"},"sync":{"remaining_rollback_tries":"CEB65D5FC286A4496B055E4EBF517AE8CBDD47A1A10860EDF372FB44AF2B5B2B"}}},"savefile":{"default_directory":"D:\\Allgemeines","type":1},"selectfile":{"last_directory":"F:\\"},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"startup_urls":["hxxp://www.trovigo.com/?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&SSPV="],"startup_urls_migration_time":"13034507784924799"},"sync":{"remaining_rollback_tries":0,"suppress_start":true},"sync_promo":{"startup_count":10,"view_count":7},"translate_accepted_count":{"en":0},"translate_blocked_languages":["de"],"translate_denied_count":{"en":1},"translate_whitelists":{},"variations_seed":"Cig5NzU2ZGM3MzA4ZDhlMDEwNmFlNDAyMDk4YWFiODQyMjkyOWNlNTQwEmgKCEFzeW5jRG5zGMTypI0FOABCClN5c3RlbURuc0FKDgoKU3lzdGVtRG5zQRAZSg4KClN5c3RlbURuc0IQGUoOCglBc3luY0Ruc0EQ2wNKDgoJQXN5bmNEbnNCENsDUggSBDI1LiooAxJuCghBc3luY0RucxjEm+OKBTgAQgpTeXN0ZW1EbnNBSg4KClN5c3RlbURuc0EQGUoOCgpTeXN0ZW1EbnNCEBlKDQoJQXN5bmNEbnNBEBlKDQoJQXN5bmNEbnNCEBlSEBIEMjQuKiAAIAEoACgBKAISagoIQXN5bmNEbnMYxNiGjAU4AEIKU3lzdGVtRG5zQUoOCgpTeXN0ZW1EbnNBEC1KDgoKU3lzdGVtRG5zQhAtSg0KCUFzeW5jRG5zQRAFSg0KCUFzeW5jRG5zQhAFUgwSBDI2LiogAigBKAISjwEKGkF1dG9jb21wbGV0ZUR5bmFtaWNUcmlhbF8wGIC1jZYFOAFCE0xpdmVTcGVsbGluZ0NvbnRyb2xKIAoWTGl2ZVNwZWxsaW5nRXhwZXJpbWVudBC2BxiGhMoBShwKE0xpdmVTcGVsbGluZ0NvbnRyb2wQMhiHhMoBUhQSBDI2LiogACABIAIgAygAKAEoAhKBAgoaQXV0b2NvbXBsZXRlRHluYW1pY1RyaWFsXzEYgK2ajQU4AUIORGVmYXVsdENvbnRyb2xKHAoTRGlzYWJsZWRQcm92aWRlcnNfMRBkGIiEygFKHQoURGlzYWJsZWRQcm92aWRlcnNfMTYQZBiJhMoBSh4KFURpc2FibGVkUHJvdmlkZXJzXzUxMhBkGIqEygFKEgoJUmVzZXJ2ZWQxEGQYi4TKAUoSCglSZXNlcnZlZDIQZBiMhMoBShIKCVJlc2VydmVkMxBkGI2EygFKGAoORGVmYXVsdENvbnRyb2wQkAMYjoTKAVIYEgwyNi4wLjE0MTAuMTkgASACKAAoASgCEocBChpBdXRvY29tcGxldGVEeW5hbWljVHJpYWxfMhiArZqNBTgBQg5EZWZhdWx0Q29udHJvbEoeChRFbmFibGVDdXJzb3JQb3NpdGlvbhDIARiPhMoBShgKDkRlZmF1bHRDb250cm9sEKAGGJCEygFSFxILMjYuMC4xNDEwLiogASACKAAoASgCEpgBChhDYWNoZVNlbnNpdGl2aXR5QW5hbHlzaXMYxLSNlgVCAk5vSgYKAk5vECRKDAoIQ29udHJvbEEQCEoMCghDb250cm9sQhAISggKBDEwMEEQCEoICgQxMDBCEAhKCAoEMjAwQRAISggKBDIwMEIQCEoICgQ0MDBBEAhKCAoENDAwQhAIUhISBDI1LiogACABIAIoACgBKAISRAoRRG5zUHJvYmUtQXR0ZW1wdHMYgLWNlgU4AUIHZGVmYXVsdEoLCgdkZWZhdWx0EFpKBQoBMRAKUgoSBDI1LiogACABEkcKD0Ruc1Byb2JlLUVuYWJsZRiAtY2WBTgBQgdkaXNhYmxlSgsKB2Rpc2FibGUQAEoKCgZlbmFibGUQZFIKEgQyNS4qIAAgARJjCiNVTUEtRHluYW1pYy1CaW5hcnktVW5pZm9ybWl0eS1UcmlhbBiAnJKlBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQMhiptskBShEKCGdyb3VwXzAxEDIYqrbJAVIGIAAgASACEl8KI1VNQS1EeW5hbWljLUJpbmFyeS1Vbmlmb3JtaXR5LVRyaWFsGICckqUFOAFCB2RlZmF1bHRKEAoHZGVmYXVsdBBjGKm2yQFKEQoIZ3JvdXBfMDEQARiqtskBUgIgAxJXChRGb3JjZUNvbXBvc2l0aW5nTW9kZRiAkoiWBTgBQgdkaXNhYmxlSgsKB2Rpc2FibGUQZEoLCgdlbmFibGVkEABKCgoGdGhyZWFkEABSCBIEMjQuKigCElsKFEZvcmNlQ29tcG9zaXRpbmdNb2RlGICSiJYFOAFCB2Rpc2FibGVKCwoHZGlzYWJsZRAASgsKB2VuYWJsZWQQZEoKCgZ0aHJlYWQQAFIMEgQyNC4qIAEgACgBElsKFEZvcmNlQ29tcG9zaXRpbmdNb2RlGICSiJYFOAFCB2Rpc2FibGVKCwoHZGlzYWJsZRBkSgsKB2VuYWJsZWQQAEoKCgZ0aHJlYWQQAFIMEgQyNC4qIAMgAigBElcKFEZvcmNlQ29tcG9zaXRpbmdNb2RlGICSiJYFOAFCB2Rpc2FibGVKCwoHZGlzYWJsZRAASgsKB2VuYWJsZWQQAEoKCgZ0aHJlYWQQZFIIEgQyNC4qKAASWQoURm9yY2VDb21wb3NpdGluZ01vZGUYgJKIlgU4AUIHZGlzYWJsZUoLCgdkaXNhYmxlEABKCwoHZW5hYmxlZBAySgoKBnRocmVhZBAyUgoSBDI0LiogAygAEosBCg1Ib3N0Q2FjaGVTaXplGMTNiIcFOABCB0RlZmF1bHRKCwoHRGVmYXVsdBAASggKBDEwMEEQCkoICgQxMDBCEApKCAoEMzAwQRAKSggKBDMwMEIQCkoJCgUxMDAwQRAKSgkKBTEwMDBCEApKCQoFMzAwMEEQCkoJCgUzMDAwQhAKUggSBDI1LiooAxKTAQoNSG9zdENhY2hlU2l6ZRjErPeHBTgAQgdEZWZhdWx0SgsKB0RlZmF1bHQQAEoICgQxMDBBEApKCAoEMTAwQhAKSggKBDMwMEEQCkoICgQzMDBCEApKCQoFMTAwMEEQCkoJCgUxMDAwQhAKSgkKBTMwMDBBEApKCQoFMzAwMEIQClIQEgQyNS4qIAAgASgAKAEoAhJECg1JbmZpbml0ZUNhY2hlGMS0jZYFOAFCAk5vSgcKAk5vENQHSgcKA1llcxAKSgsKB0NvbnRyb2wQClIIIAIoACgBKAISRgoNSW5maW5pdGVDYWNoZRjEtI2WBTgBQgJOb0oHCgJObxCEB0oHCgNZZXMQMkoLCgdDb250cm9sEDJSCiAAIAEoACgBKAISRAoNSW5maW5pdGVDYWNoZRjEtI2WBTgBQgJOb0oHCgJObxDmB0oHCgNZZXMQAUoLCgdDb250cm9sEAFSCCADKAAoASgCEnkKD0luc3RhbnRFeHRlbmRlZBiA6r2OBTgBQgxEZWZhdWx0R3JvdXBKFQoGR3JvdXAxEPoBGOeDygEg54PKAUoWCgdDb250cm9sEPoBGOiDygEg6IPKAUoRCgxEZWZhdWx0R3JvdXAQ9ANSDhIEMjcuKiAAKAAoASgDEnkKD0luc3RhbnRFeHRlbmRlZBiA6r2OBTgBQgxEZWZhdWx0R3JvdXBKFQoGR3JvdXAxEPoBGOWDygEg5YPKAUoWCgdDb250cm9sEPoBGOaDygEg5oPKAUoRCgxEZWZhdWx0R3JvdXAQ9ANSDhIEMjcuKiABKAAoASgDElYKDE5ld01lbnVTdHlsZRiA0J+NBTgBQgdEZWZhdWx0SgsKB0RlZmF1bHQQUEoMCghOZXdTdHlsZRAKSgwKCE9sZFN0eWxlEApSDBIEMjYuKiABKAAoAxJXCgxOZXdUYWJCdXR0b24YgLWNlgU4AUIHZGVmYXVsdEoLCgdkZWZhdWx0EGJKCwoHQ29udHJvbBABSggKBFBsdXMQAVISEgwyMS4wLjExODAuMTUgAygAEmQKF1ByZXJlbmRlckxvY2FsUHJlZGljdG9yGMS0jZYFQghEaXNhYmxlZEoNCghEaXNhYmxlZBDUB0oLCgdFbmFibGVkEApKCwoHQ29udHJvbBAKUhASBDI1LiogAyACKAAoASgCEmQKF1ByZXJlbmRlckxvY2FsUHJlZGljdG9yGMS0jZYFQghEaXNhYmxlZEoMCghEaXNhYmxlZBBkSgwKB0VuYWJsZWQQoAZKCwoHQ29udHJvbBBkUhASBDI1LiogACABKAAoASgCEjYKDlNCSW50ZXJzdGl0aWFsGMDSjYkFOAFCAlYxSgYKAlYxEAFKBgoCVjIQY1IIKAAoASgCKAMSYgoTU2hvd1Byb2ZpbGVTd2l0Y2hlchjAyuCKBTgBQgdkZWZhdWx0SgsKB2RlZmF1bHQQUEoLCgdjb250cm9sEApKDgoKQWx3YXlzU2hvdxAKUhASBDI2LiogACABKAAoASgCElEKD1NpZGVsb2FkV2lwZW91dDgBQghEaXNhYmxlZEoMCghEaXNhYmxlZBAASgsKB0VuYWJsZWQQZFIXEgsyNS4wLjEzNjAuKiAAIAEgAiADKAASZQoaU2lnbkluVG9DaHJvbWVDb25maXJtYXRpb24YwMrgigU4AUIHZGVmYXVsdEoLCgdkZWZhdWx0EFBKCwoHY29udHJvbBAKSgoKBkJ1YmJsZRAKUhASBDI2LiogACABKAAoASgCEpUDCh5TcGVjdWxhdGl2ZVJlc291cmNlUHJlZmV0Y2hpbmcYgJzjigU4AUIIRGlzYWJsZWRKDAoIRGlzYWJsZWQQKEoQCgxMZWFybmluZ0hvc3QQCkoPCgtMZWFybmluZ1VSTBAKSgwKCExlYXJuaW5nEApKEwoPUHJlZmV0Y2hpbmdIb3N0EApKEgoOUHJlZmV0Y2hpbmdVUkwQCkoPCgtQcmVmZXRjaGluZxAKShwKGFByZWZldGNoaW5nTG93Q29uZmlkZW5jZRAASh0KGVByZWZldGNoaW5nSGlnaENvbmZpZGVuY2UQAEocChhQcmVmZXRjaGluZ01vcmVSZXNvdXJjZXMQAEoTCg9MZWFybmluZ1NtYWxsREIQAEoWChJQcmVmZXRjaGluZ1NtYWxsREIQAEojCh9QcmVmZXRjaGluZ1NtYWxsREJMb3dDb25maWRlbmNlEABKJAogUHJlZmV0Y2hpbmdTbWFsbERCSGlnaENvbmZpZGVuY2UQAFIVEgsyNS4wLjEzNjQuKiACKAAoASgCEpcDCh5TcGVjdWxhdGl2ZVJlc291cmNlUHJlZmV0Y2hpbmcYgJzjigU4AUIIRGlzYWJsZWRKDAoIRGlzYWJsZWQQKEoQCgxMZWFybmluZ0hvc3QQCkoPCgtMZWFybmluZ1VSTBAKSgwKCExlYXJuaW5nEApKEwoPUHJlZmV0Y2hpbmdIb3N0EApKEgoOUHJlZmV0Y2hpbmdVUkwQCkoPCgtQcmVmZXRjaGluZxAKShwKGFByZWZldGNoaW5nTG93Q29uZmlkZW5jZRAASh0KGVByZWZldGNoaW5nSGlnaENvbmZpZGVuY2UQAEocChhQcmVmZXRjaGluZ01vcmVSZXNvdXJjZXMQAEoTCg9MZWFybmluZ1NtYWxsREIQAEoWChJQcmVmZXRjaGluZ1NtYWxsREIQAEojCh9QcmVmZXRjaGluZ1NtYWxsREJMb3dDb25maWRlbmNlEABKJAogUHJlZmV0Y2hpbmdTbWFsbERCSGlnaENvbmZpZGVuY2UQAFIXEgsyNS4wLjEzNjQuKiAAIAEoACgBKAISVAoKU3BlbGxjaGVjaxjE15KWBTgBQgdEZWZhdWx0SgsKB0RlZmF1bHQQMkoPCgtTdWdnZXN0aW9ucxAyUhcSCzI2LjAuMTQwMy4wIAMgAiABIAAoABJUCgpTcGVsbGNoZWNrGMTXkpYFOAFCB0RlZmF1bHRKCwoHRGVmYXVsdBBkSg8KC1N1Z2dlc3Rpb25zEABSFxILMjYuMC4xNDAzLjAgAyACIAEoAigDEk8KDUVuYWJsZVN0YWdlM0QYgIj+hgU4AUIHZW5hYmxlZEoMCgdlbmFibGVkELYHSg8KC2JsYWNrbGlzdGVkEDJSDhIEMjIuKiAAIAEgAigAElEKDUVuYWJsZVN0YWdlM0QYgIj+hgU4AUIHZW5hYmxlZEoMCgdlbmFibGVkEOgHSg8KC2JsYWNrbGlzdGVkEABSEBIEMjIuKhoEMjIuKiADKAASaAoNRW5hYmxlU3RhZ2UzRBiAgsWJBTgBQg9lbmFibGVkX2RlZmF1bHRKEwoPZW5hYmxlZF9kZWZhdWx0EABKDAoHZW5hYmxlZBDoB0oPCgtibGFja2xpc3RlZBAAUgoSBDIzLiogAygAEkEKE1Rlc3QwUGVyY2VudERlZmF1bHQYgJySpQU4AUIHZGVmYXVsdEoLCgdkZWZhdWx0EABKDAoIZ3JvdXBfMDEQZBLvAQofVU1BLVVuaWZvcm1pdHktVHJpYWwtMTAtUGVyY2VudBiAnJKlBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQARiYtskBShEKCGdyb3VwXzAxEAEYmbbJAUoRCghncm91cF8wMhABGJq2yQFKEQoIZ3JvdXBfMDMQARibtskBShEKCGdyb3VwXzA0EAEYnLbJAUoRCghncm91cF8wNRABGJ22yQFKEQoIZ3JvdXBfMDYQARietskBShEKCGdyb3VwXzA3EAEYn7bJAUoRCghncm91cF8wOBABGKC2yQFKEQoIZ3JvdXBfMDkQARihtskBEpwPCh5VTUEtVW5pZm9ybWl0eS1UcmlhbC0xLVBlcmNlbnQYgJySpQU4AUIHZGVmYXVsdEoQCgdkZWZhdWx0EAEYoLXJAUoRCghncm91cF8wMRABGKG1yQFKEQoIZ3JvdXBfMDIQARiitckBShEKCGdyb3VwXzAzEAEYo7XJAUoRCghncm91cF8wNBABGKS1yQFKEQoIZ3JvdXBfMDUQARiltckBShEKCGdyb3VwXzA2EAEYprXJAUoRCghncm91cF8wNxABGKe1yQFKEQoIZ3JvdXBfMDgQARiotckBShEKCGdyb3VwXzA5EAEYqbXJAUoRCghncm91cF8xMBABGKq1yQFKEQoIZ3JvdXBfMTEQARirtckBShEKCGdyb3VwXzEyEAEYrLXJAUoRCghncm91cF8xMxABGK21yQFKEQoIZ3JvdXBfMTQQARiutckBShEKCGdyb3VwXzE1EAEYr7XJAUoRCghncm91cF8xNhABGLC1yQFKEQoIZ3JvdXBfMTcQARixtckBShEKCGdyb3VwXzE4EAEYsrXJAUoRCghncm91cF8xORABGLO1yQFKEQoIZ3JvdXBfMjAQARi0tckBShEKCGdyb3VwXzIxEAEYtbXJAUoRCghncm91cF8yMhABGLa1yQFKEQoIZ3JvdXBfMjMQARi3tckBShEKCGdyb3VwXzI0EAEYuLXJAUoRCghncm91cF8yNRABGLm1yQFKEQoIZ3JvdXBfMjYQARi6tckBShEKCGdyb3VwXzI3EAEYu7XJAUoRCghncm91cF8yOBABGLy1yQFKEQoIZ3JvdXBfMjkQARi9tckBShEKCGdyb3VwXzMwEAEYvrXJAUoRCghncm91cF8zMRABGL+1yQFKEQoIZ3JvdXBfMzIQARjAtckBShEKCGdyb3VwXzMzEAEYwbXJAUoRCghncm91cF8zNBABGMK1yQFKEQoIZ3JvdXBfMzUQARjDtckBShEKCGdyb3VwXzM2EAEYxLXJAUoRCghncm91cF8zNxABGMW1yQFKEQoIZ3JvdXBfMzgQARjGtckBShEKCGdyb3VwXzM5EAEYx7XJAUoRCghncm91cF80MBABGMi1yQFKEQoIZ3JvdXBfNDEQARjJtckBShEKCGdyb3VwXzQyEAEYyrXJAUoRCghncm91cF80MxABGMu1yQFKEQoIZ3JvdXBfNDQQARjMtckBShEKCGdyb3VwXzQ1EAEYzbXJAUoRCghncm91cF80NhABGM61yQFKEQoIZ3JvdXBfNDcQARjPtckBShEKCGdyb3VwXzQ4EAEY0LXJAUoRCghncm91cF80ORABGNG1yQFKEQoIZ3JvdXBfNTAQARjStckBShEKCGdyb3VwXzUxEAEY07XJAUoRCghncm91cF81MhABGNS1yQFKEQoIZ3JvdXBfNTMQARjVtckBShEKCGdyb3VwXzU0EAEY1rXJAUoRCghncm91cF81NRABGNe1yQFKEQoIZ3JvdXBfNTYQARjYtckBShEKCGdyb3VwXzU3EAEY2bXJAUoRCghncm91cF81OBABGNq1yQFKEQoIZ3JvdXBfNTkQARjbtckBShEKCGdyb3VwXzYwEAEY3LXJAUoRCghncm91cF82MRABGN21yQFKEQoIZ3JvdXBfNjIQARjetckBShEKCGdyb3VwXzYzEAEY37XJAUoRCghncm91cF82NBABGOC1yQFKEQoIZ3JvdXBfNjUQARjhtckBShEKCGdyb3VwXzY2EAEY4rXJAUoRCghncm91cF82NxABGOO1yQFKEQoIZ3JvdXBfNjgQARjktckBShEKCGdyb3VwXzY5EAEY5bXJAUoRCghncm91cF83MBABGOa1yQFKEQoIZ3JvdXBfNzEQARjntckBShEKCGdyb3VwXzcyEAEY6LXJAUoRCghncm91cF83MxABGOm1yQFKEQoIZ3JvdXBfNzQQARjqtckBShEKCGdyb3VwXzc1EAEY67XJAUoRCghncm91cF83NhABGOy1yQFKEQoIZ3JvdXBfNzcQARjttckBShEKCGdyb3VwXzc4EAEY7rXJAUoRCghncm91cF83ORABGO+1yQFKEQoIZ3JvdXBfODAQARjwtckBShEKCGdyb3VwXzgxEAEY8bXJAUoRCghncm91cF84MhABGPK1yQFKEQoIZ3JvdXBfODMQARjztckBShEKCGdyb3VwXzg0EAEY9LXJAUoRCghncm91cF84NRABGPW1yQFKEQoIZ3JvdXBfODYQARj2tckBShEKCGdyb3VwXzg3EAEY97XJAUoRCghncm91cF84OBABGPi1yQFKEQoIZ3JvdXBfODkQARj5tckBShEKCGdyb3VwXzkwEAEY+rXJAUoRCghncm91cF85MRABGPu1yQFKEQoIZ3JvdXBfOTIQARj8tckBShEKCGdyb3VwXzkzEAEY/bXJAUoRCghncm91cF85NBABGP61yQFKEQoIZ3JvdXBfOTUQARj/tckBShEKCGdyb3VwXzk2EAEYgLbJAUoRCghncm91cF85NxABGIG2yQFKEQoIZ3JvdXBfOTgQARiCtskBShEKCGdyb3VwXzk5EAEYg7bJARKQAQofVU1BLVVuaWZvcm1pdHktVHJpYWwtMjAtUGVyY2VudBiAnJKlBTgBQgdkZWZhdWx0ShAKB2RlZmF1bHQQARiitskBShEKCGdyb3VwXzAxEAEYo7bJAUoRCghncm91cF8wMhABGKS2yQFKEQoIZ3JvdXBfMDMQARiltskBShEKCGdyb3VwXzA0EAEYprbJARJXCh9VTUEtVW5pZm9ybWl0eS1UcmlhbC01MC1QZXJjZW50GICckqUFOAFCB2RlZmF1bHRKEAoHZGVmYXVsdBABGKe2yQFKEQoIZ3JvdXBfMDEQARiotskBEqwDCh5VTUEtVW5pZm9ybWl0eS1UcmlhbC01LVBlcmNlbnQYgJySpQU4AUIHZGVmYXVsdEoQCgdkZWZhdWx0EAEYhLbJAUoRCghncm91cF8wMRABGIW2yQFKEQoIZ3JvdXBfMDIQARiGtskBShEKCGdyb3VwXzAzEAEYh7bJAUoRCghncm91cF8wNBABGIi2yQFKEQoIZ3JvdXBfMDUQARiJtskBShEKCGdyb3VwXzA2EAEYirbJAUoRCghncm91cF8wNxABGIu2yQFKEQoIZ3JvdXBfMDgQARiMtskBShEKCGdyb3VwXzA5EAEYjbbJAUoRCghncm91cF8xMBABGI62yQFKEQoIZ3JvdXBfMTEQARiPtskBShEKCGdyb3VwXzEyEAEYkLbJAUoRCghncm91cF8xMxABGJG2yQFKEQoIZ3JvdXBfMTQQARiStskBShEKCGdyb3VwXzE1EAEYk7bJAUoRCghncm91cF8xNhABGJS2yQFKEQoIZ3JvdXBfMTcQARiVtskBShEKCGdyb3VwXzE4EAEYlrbJAUoRCghncm91cF8xORABGJe2yQE="}), Ersetzt,[808ca04acdae78bed20080a209fcbc44]

Physische Sektoren: 0
(No malicious items detected)


(end)

Code:

ATTFilter

# AdwCleaner v3.309 - Bericht erstellt am 05/09/2014 um 23:14:59
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Silvia Maria - SILVIA
# Gestartet von : C:\Users\Silvia Maria\Desktop\adwcleaner_3.309.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\GreenTree Applications
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\windows\SysWOW64\SearchProtect
Ordner Gelöscht : C:\Users\Silvia Maria\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk

***** [ Tasks ] *****

Task Gelöscht : LaunchSignup

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.17054


-\\ Google Chrome v37.0.2062.102

[ Datei : C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2313 octets] - [05/09/2014 23:10:14]
AdwCleaner[S0].txt - [2226 octets] - [05/09/2014 23:14:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2286 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Silvia Maria on 05.09.2014 at 23:22:39,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.09.2014 at 23:25:56,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Silvia Maria (administrator) on SILVIA on 05-09-2014 23:34:08
Running from C:\Users\Silvia Maria\Desktop
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Audible, Inc.) C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] => C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\Run: [MyTomTomSA.exe] => C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [458680 2013-08-01] (TomTom)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Audible, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Silvia Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKCU - DefaultScope {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = 
SearchScopes: HKCU - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = 

FireFox:
========
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Profile: C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-18]
CHR Extension: (Google Drive) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-18]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-28]
CHR Extension: (YouTube) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-18]
CHR Extension: (Last updated at $time$ on $date$) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-03-22]
CHR Extension: (Google Search) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-18]
CHR Extension: (No Name) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-10-02]
CHR Extension: (Google Wallet) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-25]
CHR Extension: (Gmail) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-18]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] () [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-05 23:25 - 2014-09-05 23:25 - 00000799 _____ () C:\Users\Silvia Maria\Desktop\JRT.txt
2014-09-05 23:22 - 2014-09-05 23:22 - 00000000 ____D () C:\windows\ERUNT
2014-09-05 23:18 - 2014-09-05 23:18 - 00002374 _____ () C:\Users\Silvia Maria\Desktop\AdwCleaner[S0].txt
2014-09-05 23:10 - 2014-09-05 23:15 - 00000000 ____D () C:\AdwCleaner
2014-09-05 22:59 - 2014-09-05 22:59 - 00075893 _____ () C:\Users\Silvia Maria\Desktop\mbam.txt
2014-09-05 22:15 - 2014-09-05 22:15 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-05 21:40 - 2014-09-05 21:40 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-05 21:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-09-05 21:40 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-09-05 21:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-09-05 21:37 - 2014-09-05 21:31 - 01016261 _____ (Thisisu) C:\Users\Silvia Maria\Desktop\JRT.exe
2014-09-05 21:37 - 2014-09-05 21:30 - 01370483 _____ () C:\Users\Silvia Maria\Desktop\adwcleaner_3.309.exe
2014-09-05 21:37 - 2014-09-05 21:28 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Silvia Maria\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-04 21:31 - 2014-09-04 21:21 - 00018259 _____ () C:\Users\Silvia Maria\Desktop\ComboFix.txt
2014-09-04 21:21 - 2014-09-04 21:21 - 00018259 _____ () C:\ComboFix.txt
2014-09-04 21:03 - 2014-09-04 21:21 - 00000000 ____D () C:\Qoobox
2014-09-04 21:03 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-09-04 21:03 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-09-04 21:03 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-09-04 21:01 - 2014-09-04 21:19 - 00000000 ____D () C:\windows\erdnt
2014-09-03 17:12 - 2014-09-03 17:12 - 00281320 _____ () C:\windows\Minidump\090314-21875-01.dmp
2014-09-03 16:59 - 2014-09-03 16:59 - 00281264 _____ () C:\windows\Minidump\090314-22265-01.dmp
2014-09-03 16:44 - 2014-09-02 21:13 - 00024365 _____ () C:\Users\Silvia Maria\Desktop\Addition.txt
2014-09-03 16:42 - 2014-09-03 16:42 - 00001275 _____ () C:\Users\Silvia Maria\Desktop\Revo Uninstaller.lnk
2014-09-03 16:42 - 2014-09-03 16:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-03 16:42 - 2014-09-03 11:00 - 05576326 ____R (Swearware) C:\Users\Silvia Maria\Desktop\ComboFix.exe
2014-09-03 16:41 - 2014-09-03 10:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Silvia Maria\Desktop\revosetup95.exe
2014-09-02 22:16 - 2014-09-02 22:16 - 00000504 _____ () C:\Users\Silvia Maria\Desktop\Gmer.txt
2014-09-02 22:05 - 2014-09-05 23:34 - 00013504 _____ () C:\Users\Silvia Maria\Desktop\FRST.txt
2014-09-02 22:03 - 2014-09-02 22:03 - 00000486 _____ () C:\Users\Silvia Maria\Desktop\defogger_disable.log
2014-09-02 22:03 - 2014-09-02 22:03 - 00000000 _____ () C:\Users\Silvia Maria\defogger_reenable
2014-09-02 21:57 - 2014-09-02 21:53 - 00380416 _____ () C:\Users\Silvia Maria\Desktop\Gmer-19357.exe
2014-09-02 21:57 - 2014-09-02 21:52 - 02104832 _____ (Farbar) C:\Users\Silvia Maria\Desktop\FRST64.exe
2014-09-02 21:57 - 2014-09-02 21:49 - 00050477 _____ () C:\Users\Silvia Maria\Desktop\Defogger.exe
2014-09-02 21:12 - 2014-09-05 23:34 - 00000000 ____D () C:\FRST
2014-08-28 09:58 - 2014-08-23 08:47 - 04036096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-08-17 20:50 - 2014-08-17 20:56 - 00000000 ____D () C:\Users\Silvia Maria\Documents\YouTubeVideo_Download
2014-08-17 20:45 - 2014-08-17 20:45 - 00001300 _____ () C:\Users\Public\Desktop\YTD Video Downloader.lnk
2014-08-16 20:26 - 2014-09-01 12:29 - 00307968 _____ () C:\windows\system32\FNTCACHE.DAT
2014-08-16 10:40 - 2014-07-16 00:51 - 00071168 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hdaudbus.sys
2014-08-13 17:51 - 2014-06-11 00:44 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
2014-08-13 17:51 - 2014-06-11 00:43 - 00035480 _____ (Microsoft Corporation) C:\windows\SysWOW64\TsWpfWrp.exe
2014-08-13 17:08 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-08-13 17:08 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-08-13 17:08 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-08-13 17:08 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-08-13 17:08 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-08-13 17:08 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-08-13 17:08 - 2014-07-24 10:03 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-08-13 17:08 - 2014-06-13 03:57 - 01453400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2014-08-13 17:08 - 2014-06-13 03:55 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
2014-08-13 17:07 - 2014-07-16 01:03 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-08-13 17:07 - 2014-07-12 04:36 - 01023488 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-08-13 17:07 - 2014-06-20 01:35 - 01312768 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2014-08-13 17:07 - 2014-06-20 00:24 - 00694272 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2014-08-13 17:07 - 2014-06-05 19:56 - 00112984 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2014-08-13 17:07 - 2014-06-05 19:30 - 10116608 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2014-08-13 17:07 - 2014-06-05 19:29 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-08-13 17:07 - 2014-06-05 19:29 - 00393216 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2014-08-13 17:07 - 2014-06-05 19:28 - 02306560 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2014-08-13 17:07 - 2014-06-05 19:28 - 02146304 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2014-08-13 17:07 - 2014-06-05 15:12 - 08857600 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2014-08-13 17:07 - 2014-06-05 15:11 - 02416128 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-08-13 17:07 - 2014-06-05 15:11 - 00295424 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2014-08-13 17:07 - 2014-06-05 15:10 - 02037760 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2014-08-13 17:07 - 2014-06-05 15:10 - 00754176 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
2014-08-13 17:07 - 2014-05-29 06:04 - 00094552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2014-08-13 17:07 - 2014-05-08 03:34 - 00328024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2014-08-12 20:57 - 2014-08-12 20:57 - 00001794 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iPod
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files (x86)\iTunes

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-05 23:34 - 2014-09-02 22:05 - 00013504 _____ () C:\Users\Silvia Maria\Desktop\FRST.txt
2014-09-05 23:34 - 2014-09-02 21:12 - 00000000 ____D () C:\FRST
2014-09-05 23:28 - 2013-03-18 18:50 - 01599095 _____ () C:\windows\WindowsUpdate.log
2014-09-05 23:25 - 2014-09-05 23:25 - 00000799 _____ () C:\Users\Silvia Maria\Desktop\JRT.txt
2014-09-05 23:22 - 2014-09-05 23:22 - 00000000 ____D () C:\windows\ERUNT
2014-09-05 23:21 - 2012-08-01 18:38 - 00753134 _____ () C:\windows\system32\perfh007.dat
2014-09-05 23:21 - 2012-08-01 18:38 - 00155826 _____ () C:\windows\system32\perfc007.dat
2014-09-05 23:21 - 2012-07-26 09:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2014-09-05 23:18 - 2014-09-05 23:18 - 00002374 _____ () C:\Users\Silvia Maria\Desktop\AdwCleaner[S0].txt
2014-09-05 23:17 - 2013-03-18 22:06 - 00001132 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-05 23:16 - 2012-09-11 07:42 - 00018440 _____ () C:\windows\PFRO.log
2014-09-05 23:16 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-09-05 23:16 - 2012-07-26 07:26 - 00524288 ___SH () C:\windows\system32\config\BBI
2014-09-05 23:15 - 2014-09-05 23:10 - 00000000 ____D () C:\AdwCleaner
2014-09-05 23:08 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-09-05 23:02 - 2012-07-26 10:12 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2014-09-05 22:59 - 2014-09-05 22:59 - 00075893 _____ () C:\Users\Silvia Maria\Desktop\mbam.txt
2014-09-05 22:15 - 2014-09-05 22:15 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-05 21:40 - 2014-09-05 21:40 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-05 21:31 - 2014-09-05 21:37 - 01016261 _____ (Thisisu) C:\Users\Silvia Maria\Desktop\JRT.exe
2014-09-05 21:30 - 2014-09-05 21:37 - 01370483 _____ () C:\Users\Silvia Maria\Desktop\adwcleaner_3.309.exe
2014-09-05 21:28 - 2014-09-05 21:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Silvia Maria\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-04 21:21 - 2014-09-04 21:31 - 00018259 _____ () C:\Users\Silvia Maria\Desktop\ComboFix.txt
2014-09-04 21:21 - 2014-09-04 21:21 - 00018259 _____ () C:\ComboFix.txt
2014-09-04 21:21 - 2014-09-04 21:03 - 00000000 ____D () C:\Qoobox
2014-09-04 21:19 - 2014-09-04 21:01 - 00000000 ____D () C:\windows\erdnt
2014-09-04 21:16 - 2012-07-26 07:26 - 00000215 _____ () C:\windows\system.ini
2014-09-04 21:11 - 2012-07-26 07:26 - 74711040 _____ () C:\windows\system32\config\SOFTWARE.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 13893632 _____ () C:\windows\system32\config\SYSTEM.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 00786432 _____ () C:\windows\system32\config\DEFAULT.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 00262144 _____ () C:\windows\system32\config\SECURITY.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 00262144 _____ () C:\windows\system32\config\SAM.bak
2014-09-03 17:12 - 2014-09-03 17:12 - 00281320 _____ () C:\windows\Minidump\090314-21875-01.dmp
2014-09-03 17:11 - 2013-10-14 18:25 - 373588902 _____ () C:\windows\MEMORY.DMP
2014-09-03 17:00 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-09-03 16:59 - 2014-09-03 16:59 - 00281264 _____ () C:\windows\Minidump\090314-22265-01.dmp
2014-09-03 16:42 - 2014-09-03 16:42 - 00001275 _____ () C:\Users\Silvia Maria\Desktop\Revo Uninstaller.lnk
2014-09-03 16:42 - 2014-09-03 16:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-03 11:00 - 2014-09-03 16:42 - 05576326 ____R (Swearware) C:\Users\Silvia Maria\Desktop\ComboFix.exe
2014-09-03 10:58 - 2014-09-03 16:41 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Silvia Maria\Desktop\revosetup95.exe
2014-09-02 22:16 - 2014-09-02 22:16 - 00000504 _____ () C:\Users\Silvia Maria\Desktop\Gmer.txt
2014-09-02 22:03 - 2014-09-02 22:03 - 00000486 _____ () C:\Users\Silvia Maria\Desktop\defogger_disable.log
2014-09-02 22:03 - 2014-09-02 22:03 - 00000000 _____ () C:\Users\Silvia Maria\defogger_reenable
2014-09-02 22:03 - 2013-03-18 18:51 - 00000000 ____D () C:\Users\Silvia Maria
2014-09-02 21:53 - 2014-09-02 21:57 - 00380416 _____ () C:\Users\Silvia Maria\Desktop\Gmer-19357.exe
2014-09-02 21:52 - 2014-09-02 21:57 - 02104832 _____ (Farbar) C:\Users\Silvia Maria\Desktop\FRST64.exe
2014-09-02 21:49 - 2014-09-02 21:57 - 00050477 _____ () C:\Users\Silvia Maria\Desktop\Defogger.exe
2014-09-02 21:13 - 2014-09-03 16:44 - 00024365 _____ () C:\Users\Silvia Maria\Desktop\Addition.txt
2014-09-01 21:49 - 2014-02-14 19:03 - 00000547 _____ () C:\windows\wiso.ini
2014-09-01 19:52 - 2013-03-18 22:06 - 00001136 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-01 19:35 - 2012-07-26 09:21 - 00041228 _____ () C:\windows\setupact.log
2014-09-01 12:29 - 2014-08-16 20:26 - 00307968 _____ () C:\windows\system32\FNTCACHE.DAT
2014-08-30 16:01 - 2013-03-18 22:19 - 00002186 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-30 15:52 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-08-23 08:47 - 2014-08-28 09:58 - 04036096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-08-18 12:38 - 2013-03-18 18:58 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-711957141-987489330-1238217342-1001
2014-08-17 21:30 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\NDF
2014-08-17 20:56 - 2014-08-17 20:50 - 00000000 ____D () C:\Users\Silvia Maria\Documents\YouTubeVideo_Download
2014-08-17 20:45 - 2014-08-17 20:45 - 00001300 _____ () C:\Users\Public\Desktop\YTD Video Downloader.lnk
2014-08-16 20:27 - 2012-07-26 10:12 - 00000000 ___RD () C:\windows\ToastData
2014-08-16 10:47 - 2013-08-29 19:33 - 00000000 ____D () C:\windows\system32\MRT
2014-08-16 10:43 - 2013-03-23 12:13 - 99218768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-08-12 20:57 - 2014-08-12 20:57 - 00001794 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iPod
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-11 19:36 - 2013-03-18 18:51 - 00000000 ____D () C:\Users\Silvia Maria\AppData\Local\Packages
2014-08-07 22:34 - 2014-02-17 14:58 - 00000000 ____D () C:\Users\Silvia Maria\Documents\Mein Steuer-Sparbuch Heute

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-26 01:09

==================== End Of Log ============================

--- --- ---

schrauber · 06.09.2014, 18:55

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

KlarerFall · 06.09.2014, 21:59

Hallo Schrauber

hier die scans. Jetzt muß ich nur noch den Defender wieder zu laufen bringen. Ich bekomme nämlich die Meldung Diese App wurde deaktiviert der Computer wird nicht überwacht

Vielen Dank soweit estmal. Sagst du mir Bescheid, wenn du denkst, dass alles weg ist?

Viele Grüße
Jürgen

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ea6417a4f152dd4c9e044370766f160a
# engine=20034
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-06 08:36:45
# local_time=2014-09-06 10:36:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 5430 14426694 0 0
# scanned=210048
# found=14
# cleaned=0
# scan_time=4207
sh=CF6185A9EDFBA0217C9D36D25CA9F6ADCC9F6BC8 ft=1 fh=f90d49fcbe154eac vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=74E0177FF3F81C427969AD57186E709F86B40D87 ft=1 fh=cdf4822aa79706e4 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"
sh=A8F3D7C5BBC8347AA7D5B1AD10CBCEB6104C23D1 ft=1 fh=295e6caf528a890e vn="möglicherweise Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"
sh=3240E81C8D289E0153E62892A1A780C78E1D795E ft=1 fh=60c431af054e4a68 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"
sh=FF2F9741F38C6294FE7EB6C4B23AF5DBC5F46BBC ft=1 fh=d421524a365e435c vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"
sh=9BA475AA65F25682779E0066864C49C37BC178FA ft=1 fh=ccaa2464deb92942 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir"
sh=0A895D6ECBE189AE338869C76CA5FC59D6C9323F ft=1 fh=66a85591cccc8785 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"
sh=828435274C2EDC211E81BA13B5DE0BB52D4B887B ft=1 fh=fe55b966d0decac2 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"
sh=19E4A14C324EC5706BDD7C0BA3D1A8C9503AEEF4 ft=1 fh=b222439f7f1d3364 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir"
sh=CCAFEDA054837453469D588C04CEE33530777F2C ft=1 fh=2a4276702961c0a4 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"
sh=B5C2DB37AB6979DB8D1FC7C935075E8AC8ACE9A3 ft=1 fh=f24232d3d25a19ff vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir"
sh=7812DFAFF64BAD239859813C5654B9ED16466339 ft=1 fh=148431a8262f735d vn="Win32/Conduit.SearchProtect.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Silvia Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\38HW2ZJQ\spstub[1].exe"
sh=3DF8834DC58EA3C422FE69723F9EEDE102573DE2 ft=1 fh=ba1110ad7877fba8 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Silvia Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y584EO8Z\SPSetup[1].exe"
sh=F7260CE69E39008609AC6570C2013A39315C46F5 ft=1 fh=c8129b0266621a88 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Silvia Maria\Downloads\FreeYouTubeToMP3Converter_3.12.1.320.exe"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.87  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Google Chrome 37.0.2062.102  
 Google Chrome 37.0.2062.103  
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-08-2014 02
Ran by Silvia Maria (administrator) on SILVIA on 06-09-2014 22:52:38
Running from C:\Users\Silvia Maria\Desktop
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Audible, Inc.) C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] => C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-711957141-987489330-1238217342-1001\...\Run: [MyTomTomSA.exe] => C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [458680 2013-08-01] (TomTom)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Audible, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Silvia Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKCU - DefaultScope {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = 
SearchScopes: HKCU - {383BBC00-9EB9-4435-9C2D-9DF16E1279A2} URL = 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Silvia Maria\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.trovigo.com/?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&SSPV=
CHR StartupUrls: Default -> "hxxp://www.trovigo.com/?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP7BE59FB8-C9FA-4AED-9808-FD4369DE7550&SSPV="
CHR DefaultSearchKeyword: Default -> DFD8361BBF8643DAC1391493A3AFEF6859D25886D4550BFBACADAE54E01A6682
CHR DefaultSearchProvider: Default -> C6536FF21661B7B36838A5226A45784BEFA74951C4C23B934883B4C9B77FED19
CHR DefaultSearchURL: Default -> 533AEDE957531FC70C08A707932AFA3361A4D1952F1FFFBBF04CBF17FFEBBC78
CHR Profile: C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-28]
CHR Extension: (Adblock Plus) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-03-22]
CHR Extension: (Google Wallet) - C:\Users\Silvia Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] () [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-06 21:07 - 2014-09-06 21:06 - 00854417 _____ () C:\Users\Silvia Maria\Desktop\SecurityCheck.exe
2014-09-06 21:06 - 2014-09-06 21:06 - 00854417 _____ () C:\Users\Silvia Maria\Downloads\SecurityCheck.exe
2014-09-06 21:06 - 2014-09-06 21:05 - 02347384 _____ (ESET) C:\Users\Silvia Maria\Desktop\esetsmartinstaller_deu.exe
2014-09-06 21:05 - 2014-09-06 21:05 - 02347384 _____ (ESET) C:\Users\Silvia Maria\Downloads\esetsmartinstaller_deu.exe
2014-09-05 23:37 - 2014-09-05 23:37 - 00034230 _____ () C:\Users\Silvia Maria\Desktop\FRST_2014_09_05.txt
2014-09-05 23:25 - 2014-09-05 23:25 - 00000799 _____ () C:\Users\Silvia Maria\Desktop\JRT.txt
2014-09-05 23:22 - 2014-09-05 23:22 - 00000000 ____D () C:\windows\ERUNT
2014-09-05 23:18 - 2014-09-05 23:18 - 00002374 _____ () C:\Users\Silvia Maria\Desktop\AdwCleaner[S0].txt
2014-09-05 23:10 - 2014-09-05 23:15 - 00000000 ____D () C:\AdwCleaner
2014-09-05 22:59 - 2014-09-05 22:59 - 00075893 _____ () C:\Users\Silvia Maria\Desktop\mbam.txt
2014-09-05 22:15 - 2014-09-06 00:00 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-05 21:40 - 2014-09-05 21:40 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-05 21:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-09-05 21:40 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-09-05 21:40 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-09-05 21:37 - 2014-09-05 21:31 - 01016261 _____ (Thisisu) C:\Users\Silvia Maria\Desktop\JRT.exe
2014-09-05 21:37 - 2014-09-05 21:30 - 01370483 _____ () C:\Users\Silvia Maria\Desktop\adwcleaner_3.309.exe
2014-09-05 21:37 - 2014-09-05 21:28 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Silvia Maria\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-04 21:31 - 2014-09-04 21:21 - 00018259 _____ () C:\Users\Silvia Maria\Desktop\ComboFix.txt
2014-09-04 21:21 - 2014-09-04 21:21 - 00018259 _____ () C:\ComboFix.txt
2014-09-04 21:03 - 2014-09-04 21:21 - 00000000 ____D () C:\Qoobox
2014-09-04 21:03 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-09-04 21:03 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-09-04 21:03 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-09-04 21:03 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-09-04 21:01 - 2014-09-04 21:19 - 00000000 ____D () C:\windows\erdnt
2014-09-03 17:12 - 2014-09-03 17:12 - 00281320 _____ () C:\windows\Minidump\090314-21875-01.dmp
2014-09-03 16:59 - 2014-09-03 16:59 - 00281264 _____ () C:\windows\Minidump\090314-22265-01.dmp
2014-09-03 16:44 - 2014-09-02 21:13 - 00024365 _____ () C:\Users\Silvia Maria\Desktop\Addition.txt
2014-09-03 16:42 - 2014-09-03 16:42 - 00001275 _____ () C:\Users\Silvia Maria\Desktop\Revo Uninstaller.lnk
2014-09-03 16:42 - 2014-09-03 16:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-03 16:42 - 2014-09-03 11:00 - 05576326 ____R (Swearware) C:\Users\Silvia Maria\Desktop\ComboFix.exe
2014-09-03 16:41 - 2014-09-03 10:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Silvia Maria\Desktop\revosetup95.exe
2014-09-02 22:16 - 2014-09-02 22:16 - 00000504 _____ () C:\Users\Silvia Maria\Desktop\Gmer.txt
2014-09-02 22:05 - 2014-09-06 22:52 - 00013194 _____ () C:\Users\Silvia Maria\Desktop\FRST.txt
2014-09-02 22:03 - 2014-09-02 22:03 - 00000486 _____ () C:\Users\Silvia Maria\Desktop\defogger_disable.log
2014-09-02 22:03 - 2014-09-02 22:03 - 00000000 _____ () C:\Users\Silvia Maria\defogger_reenable
2014-09-02 21:57 - 2014-09-02 21:53 - 00380416 _____ () C:\Users\Silvia Maria\Desktop\Gmer-19357.exe
2014-09-02 21:57 - 2014-09-02 21:52 - 02104832 _____ (Farbar) C:\Users\Silvia Maria\Desktop\FRST64.exe
2014-09-02 21:57 - 2014-09-02 21:49 - 00050477 _____ () C:\Users\Silvia Maria\Desktop\Defogger.exe
2014-09-02 21:12 - 2014-09-06 22:52 - 00000000 ____D () C:\FRST
2014-08-28 09:58 - 2014-08-23 08:47 - 04036096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-08-17 20:50 - 2014-08-17 20:56 - 00000000 ____D () C:\Users\Silvia Maria\Documents\YouTubeVideo_Download
2014-08-16 20:26 - 2014-09-01 12:29 - 00307968 _____ () C:\windows\system32\FNTCACHE.DAT
2014-08-16 10:40 - 2014-07-16 00:51 - 00071168 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hdaudbus.sys
2014-08-13 17:51 - 2014-06-11 00:44 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
2014-08-13 17:51 - 2014-06-11 00:43 - 00035480 _____ (Microsoft Corporation) C:\windows\SysWOW64\TsWpfWrp.exe
2014-08-13 17:08 - 2014-07-24 14:11 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-08-13 17:08 - 2014-07-24 14:10 - 02240000 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 01407488 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-08-13 17:08 - 2014-07-24 14:10 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 19279872 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 15399936 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 02655232 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-08-13 17:08 - 2014-07-24 14:09 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00451584 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-08-13 17:08 - 2014-07-24 14:09 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 01766400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 01180672 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-08-13 17:08 - 2014-07-24 12:52 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 14371328 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 13757440 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 02861568 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 02054656 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-08-13 17:08 - 2014-07-24 12:51 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-08-13 17:08 - 2014-07-24 12:51 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-08-13 17:08 - 2014-07-24 12:33 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-08-13 17:08 - 2014-07-24 12:29 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-08-13 17:08 - 2014-07-24 10:03 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll
2014-08-13 17:08 - 2014-06-13 03:57 - 01453400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2014-08-13 17:08 - 2014-06-13 03:55 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
2014-08-13 17:07 - 2014-07-16 01:03 - 01300992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-08-13 17:07 - 2014-07-12 04:36 - 01023488 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-08-13 17:07 - 2014-06-20 01:35 - 01312768 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2014-08-13 17:07 - 2014-06-20 00:24 - 00694272 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2014-08-13 17:07 - 2014-06-05 19:56 - 00112984 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2014-08-13 17:07 - 2014-06-05 19:30 - 10116608 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
2014-08-13 17:07 - 2014-06-05 19:29 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-08-13 17:07 - 2014-06-05 19:29 - 00393216 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2014-08-13 17:07 - 2014-06-05 19:28 - 02306560 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2014-08-13 17:07 - 2014-06-05 19:28 - 02146304 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
2014-08-13 17:07 - 2014-06-05 15:12 - 08857600 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
2014-08-13 17:07 - 2014-06-05 15:11 - 02416128 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-08-13 17:07 - 2014-06-05 15:11 - 00295424 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2014-08-13 17:07 - 2014-06-05 15:10 - 02037760 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2014-08-13 17:07 - 2014-06-05 15:10 - 00754176 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
2014-08-13 17:07 - 2014-05-29 06:04 - 00094552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2014-08-13 17:07 - 2014-05-08 03:34 - 00328024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Classpnp.sys
2014-08-12 20:57 - 2014-08-12 20:57 - 00001794 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iPod
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files (x86)\iTunes

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-06 22:53 - 2014-09-02 22:05 - 00013194 _____ () C:\Users\Silvia Maria\Desktop\FRST.txt
2014-09-06 22:52 - 2014-09-02 21:12 - 00000000 ____D () C:\FRST
2014-09-06 22:52 - 2013-03-18 22:06 - 00001136 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-06 22:02 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2014-09-06 21:43 - 2013-03-18 18:50 - 01735122 _____ () C:\windows\WindowsUpdate.log
2014-09-06 21:12 - 2012-08-01 18:38 - 00753134 _____ () C:\windows\system32\perfh007.dat
2014-09-06 21:12 - 2012-08-01 18:38 - 00155826 _____ () C:\windows\system32\perfc007.dat
2014-09-06 21:12 - 2012-07-26 09:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2014-09-06 21:06 - 2014-09-06 21:07 - 00854417 _____ () C:\Users\Silvia Maria\Desktop\SecurityCheck.exe
2014-09-06 21:06 - 2014-09-06 21:06 - 00854417 _____ () C:\Users\Silvia Maria\Downloads\SecurityCheck.exe
2014-09-06 21:05 - 2014-09-06 21:06 - 02347384 _____ (ESET) C:\Users\Silvia Maria\Desktop\esetsmartinstaller_deu.exe
2014-09-06 21:05 - 2014-09-06 21:05 - 02347384 _____ (ESET) C:\Users\Silvia Maria\Downloads\esetsmartinstaller_deu.exe
2014-09-06 21:03 - 2014-02-17 14:58 - 00000000 ____D () C:\Users\Silvia Maria\Documents\Mein Steuer-Sparbuch Heute
2014-09-06 21:03 - 2013-03-18 22:06 - 00001132 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-06 21:03 - 2012-07-26 09:21 - 00042023 _____ () C:\windows\setupact.log
2014-09-06 01:11 - 2013-03-18 18:58 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-711957141-987489330-1238217342-1001
2014-09-06 00:02 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-09-06 00:00 - 2014-09-05 22:15 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-05 23:57 - 2012-07-26 07:26 - 00524288 ___SH () C:\windows\system32\config\BBI
2014-09-05 23:54 - 2013-03-18 22:19 - 00002186 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-05 23:37 - 2014-09-05 23:37 - 00034230 _____ () C:\Users\Silvia Maria\Desktop\FRST_2014_09_05.txt
2014-09-05 23:25 - 2014-09-05 23:25 - 00000799 _____ () C:\Users\Silvia Maria\Desktop\JRT.txt
2014-09-05 23:22 - 2014-09-05 23:22 - 00000000 ____D () C:\windows\ERUNT
2014-09-05 23:18 - 2014-09-05 23:18 - 00002374 _____ () C:\Users\Silvia Maria\Desktop\AdwCleaner[S0].txt
2014-09-05 23:16 - 2012-09-11 07:42 - 00018440 _____ () C:\windows\PFRO.log
2014-09-05 23:15 - 2014-09-05 23:10 - 00000000 ____D () C:\AdwCleaner
2014-09-05 23:08 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AUInstallAgent
2014-09-05 23:02 - 2012-07-26 10:12 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2014-09-05 22:59 - 2014-09-05 22:59 - 00075893 _____ () C:\Users\Silvia Maria\Desktop\mbam.txt
2014-09-05 21:40 - 2014-09-05 21:40 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-05 21:40 - 2014-09-05 21:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-09-05 21:31 - 2014-09-05 21:37 - 01016261 _____ (Thisisu) C:\Users\Silvia Maria\Desktop\JRT.exe
2014-09-05 21:30 - 2014-09-05 21:37 - 01370483 _____ () C:\Users\Silvia Maria\Desktop\adwcleaner_3.309.exe
2014-09-05 21:28 - 2014-09-05 21:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Silvia Maria\Desktop\mbam-setup-2.0.2.1012.exe
2014-09-04 21:21 - 2014-09-04 21:31 - 00018259 _____ () C:\Users\Silvia Maria\Desktop\ComboFix.txt
2014-09-04 21:21 - 2014-09-04 21:21 - 00018259 _____ () C:\ComboFix.txt
2014-09-04 21:21 - 2014-09-04 21:03 - 00000000 ____D () C:\Qoobox
2014-09-04 21:19 - 2014-09-04 21:01 - 00000000 ____D () C:\windows\erdnt
2014-09-04 21:16 - 2012-07-26 07:26 - 00000215 _____ () C:\windows\system.ini
2014-09-04 21:11 - 2012-07-26 07:26 - 74711040 _____ () C:\windows\system32\config\SOFTWARE.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 13893632 _____ () C:\windows\system32\config\SYSTEM.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 00786432 _____ () C:\windows\system32\config\DEFAULT.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 00262144 _____ () C:\windows\system32\config\SECURITY.bak
2014-09-04 21:11 - 2012-07-26 07:26 - 00262144 _____ () C:\windows\system32\config\SAM.bak
2014-09-03 17:12 - 2014-09-03 17:12 - 00281320 _____ () C:\windows\Minidump\090314-21875-01.dmp
2014-09-03 17:11 - 2013-10-14 18:25 - 373588902 _____ () C:\windows\MEMORY.DMP
2014-09-03 16:59 - 2014-09-03 16:59 - 00281264 _____ () C:\windows\Minidump\090314-22265-01.dmp
2014-09-03 16:42 - 2014-09-03 16:42 - 00001275 _____ () C:\Users\Silvia Maria\Desktop\Revo Uninstaller.lnk
2014-09-03 16:42 - 2014-09-03 16:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-03 11:00 - 2014-09-03 16:42 - 05576326 ____R (Swearware) C:\Users\Silvia Maria\Desktop\ComboFix.exe
2014-09-03 10:58 - 2014-09-03 16:41 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Silvia Maria\Desktop\revosetup95.exe
2014-09-02 22:16 - 2014-09-02 22:16 - 00000504 _____ () C:\Users\Silvia Maria\Desktop\Gmer.txt
2014-09-02 22:03 - 2014-09-02 22:03 - 00000486 _____ () C:\Users\Silvia Maria\Desktop\defogger_disable.log
2014-09-02 22:03 - 2014-09-02 22:03 - 00000000 _____ () C:\Users\Silvia Maria\defogger_reenable
2014-09-02 22:03 - 2013-03-18 18:51 - 00000000 ____D () C:\Users\Silvia Maria
2014-09-02 21:53 - 2014-09-02 21:57 - 00380416 _____ () C:\Users\Silvia Maria\Desktop\Gmer-19357.exe
2014-09-02 21:52 - 2014-09-02 21:57 - 02104832 _____ (Farbar) C:\Users\Silvia Maria\Desktop\FRST64.exe
2014-09-02 21:49 - 2014-09-02 21:57 - 00050477 _____ () C:\Users\Silvia Maria\Desktop\Defogger.exe
2014-09-02 21:13 - 2014-09-03 16:44 - 00024365 _____ () C:\Users\Silvia Maria\Desktop\Addition.txt
2014-09-01 21:49 - 2014-02-14 19:03 - 00000547 _____ () C:\windows\wiso.ini
2014-09-01 12:29 - 2014-08-16 20:26 - 00307968 _____ () C:\windows\system32\FNTCACHE.DAT
2014-08-30 15:52 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2014-08-23 08:47 - 2014-08-28 09:58 - 04036096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-08-17 21:30 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\NDF
2014-08-17 20:56 - 2014-08-17 20:50 - 00000000 ____D () C:\Users\Silvia Maria\Documents\YouTubeVideo_Download
2014-08-16 20:27 - 2012-07-26 10:12 - 00000000 ___RD () C:\windows\ToastData
2014-08-16 10:47 - 2013-08-29 19:33 - 00000000 ____D () C:\windows\system32\MRT
2014-08-16 10:43 - 2013-03-23 12:13 - 99218768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-08-12 20:57 - 2014-08-12 20:57 - 00001794 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iTunes
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files\iPod
2014-08-12 20:57 - 2014-08-12 20:57 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-11 19:36 - 2013-03-18 18:51 - 00000000 ____D () C:\Users\Silvia Maria\AppData\Local\Packages

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-06 22:37

==================== End Of Log ============================

--- --- ---

schrauber · 07.09.2014, 15:21

Defender versuchen wir jetzt mal:

Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

KlarerFall · 07.09.2014, 15:35

Hallo Schrauber

neuer Scan
ich schon vor dem Scan Defender wieder einschalten können und zwar hier : Systemsteuerung\System und Sicherheit\Wartungscenter

Ist Windows Defender ein empfehlendes Tool oder sollten wir uns etwas anderes zulegen?

Viele Grüße
Jürgen

Code:

ATTFilter

Farbar Service Scanner Version: 21-07-2014
Ran by Silvia Maria (administrator) on 07-09-2014 at 16:33:28
Running from "C:\Users\Silvia Maria\Desktop"
Microsoft Windows 8  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MsMpEng.exe => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

schrauber · 08.09.2014, 10:48

Ich empfehle immer Emsisoft.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

KlarerFall · 09.09.2014, 17:17

Hallo Schrauber

so ich glaube jetzt trennen sich wieder unsere Wege. Ich denke es soweit alles wieder ok - ich kann jedenfalls keine Probleme erkennen.

Dann bleibt mir nur noch mich ganz herzlich bei dir zu bedanken auch im Namen meiner Frau.
Also vielen vielen Dank für deine Arbeit mit mir und wenn's mich (sie) doch wieder erwischen sollte, weis ich ja wohin ich mich wenden werde.

Viele Grüße
Jürgen

# DelFix v10.8 - Datei am 09/09/2014 um 18:05:16 erstellt
# Aktualisiert am 29/07/2014 von Xplode
# Benutzer : Silvia Maria - SILVIA
# Betriebssystem : Windows 8 (64 bits)

~ Aktiviere die Benutzerkontensteuerung ... OK

~ Entferne die Bereinigungsprogramme ...

Gelöscht : C:\FRST
Gelöscht : C:\AdwCleaner
Gelöscht : C:\ComboFix.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\Addition.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\AdwCleaner[S0].txt
Gelöscht : C:\Users\Silvia Maria\Desktop\adwcleaner_3.309.exe
Gelöscht : C:\Users\Silvia Maria\Desktop\ComboFix.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\Defogger.exe
Gelöscht : C:\Users\Silvia Maria\Desktop\defogger_disable.log
Gelöscht : C:\Users\Silvia Maria\Desktop\defogger_enable.log
Gelöscht : C:\Users\Silvia Maria\Desktop\esetsmartinstaller_deu.exe
Gelöscht : C:\Users\Silvia Maria\Desktop\FRST.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\FRST64.exe
Gelöscht : C:\Users\Silvia Maria\Desktop\FRST_2014_09_05.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\FSS.exe
Gelöscht : C:\Users\Silvia Maria\Desktop\FSS.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\JRT.exe
Gelöscht : C:\Users\Silvia Maria\Desktop\JRT.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\log.txt
Gelöscht : C:\Users\Silvia Maria\Desktop\SecurityCheck.exe
Gelöscht : C:\Users\Silvia Maria\Downloads\esetsmartinstaller_deu.exe
Gelöscht : C:\Users\Silvia Maria\Downloads\SecurityCheck.exe
Gelöscht : HKLM\SOFTWARE\AdwCleaner
Gelöscht : HKLM\SOFTWARE\Swearware

~ Erstelle ein Backup der Registrierungsdatenbank ... OK

~ Lösche die Wiederherstellungspunkte ...

Gelöscht : RP #78 [ComboFix created restore point | 09/09/2014 16:03:13]

Ein neuer Wiederherstellungspunkt wurde erstellt !

~ Stelle die Systemeinstellungen wieder her ... OK

########## - EOF - ##########

schrauber · 10.09.2014, 10:44

Gern Geschehen

04.09.2014, 11:22	#4
schrauber /// the machine /// TB-Ausbilder	Schwarzer Bildschirm nach dem Einloggen auf Win8 Notebook Du hast es aber schon mit Revo versucht? Dann jetzt Combofix __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

10.09.2014, 10:44	#14
schrauber /// the machine /// TB-Ausbilder	Schwarzer Bildschirm nach dem Einloggen auf Win8 Notebook Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Schwarzer Bildschirm nach dem Einloggen auf Win8 Notebook

Plagegeister aller Art und deren Bekämpfung: Schwarzer Bildschirm nach dem Einloggen auf Win8 Notebook