Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 16.11.2014, 16:43   #1
Arni79
 
Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Hallo liebe Community.

Meiner Freundin ihr Laptop Toshiba Satellite mit Win 8 64bit I5 macht Ärger.

Laptop öffnet im Firefox gleich 3-4 Fenster.

Dann soll sich der Mauszeiger von allein bewegt haben.
Desweiteren wurde durch G-Data gemeldet das Bitte keine Online Zahlungsverkehr mehr über diesen Rechner getätigt werden sollte,da ein Virus die Tastenanschläge erkennt.

Wir haben uns Defogger , Anti-Malware ,FRST und GMER geladen.

*Defogger wurde gestartet.
Bis zu diesem Punkt.

(Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.)

Dies war bei mir nicht der Fall.
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:03 on 16/11/2014 (****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         
*Anti-Malware wurde gestartet .
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 16.11.2014
Scan Time: 13:32:48
Logfile: Malwarebytes 16.11.14 Log.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.16.02
Rootkit Database: v2014.11.12.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Carmen

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 336983
Time Elapsed: 17 min, 27 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 16
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\APPID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}, , [e88aa4980f6d4de9cc7508e9c63c8e72], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}, , [e88aa4980f6d4de9cc7508e9c63c8e72], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc.1, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\esrv.mysearchdialESrvc, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.mysearchdialESrvc, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\esrv.mysearchdialESrvc.1, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2139123807-3068208427-1789639649-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, , [85ed2a127dff6bcb1ddc9324fb077090], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, , [85ed2a127dff6bcb1ddc9324fb077090], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}, , [78fa8cb0691334026f897b756a9857a9], 
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2139123807-3068208427-1789639649-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\mysearchdial, , [e78b5fddadcf013579139fe9c63ebc44], 
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2139123807-3068208427-1789639649-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\mysearchdial.com, , [7ef477c5e39943f38d008ff9df25966a], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2139123807-3068208427-1789639649-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [383a76c67606ac8a272f1a5748bb44bc], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2139123807-3068208427-1789639649-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [77fb6ece9ede0036c0cec1c6b54fea16], 

Registry Values: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2139123807-3068208427-1789639649-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0H1L1J1L1S1R1N, , [77fb6ece9ede0036c0cec1c6b54fea16]

Registry Data: 4
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=, Good: (www.google.com), Bad: (hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=),,[264cc874adcf072fe8424cfd7e8717e9]
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|Tabs, hxxp://start.mysearchdial.com/?f=2&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=, Good: (www.google.com), Bad: (hxxp://start.mysearchdial.com/?f=2&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=),,[e58dd06c007cb2845a8580bf4cb9df21]
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=, Good: (www.google.com), Bad: (hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=),,[0a6876c6f08cf5419b8fe861aa5bbb45]
PUP.Optional.MySearchDial.A, HKU\S-1-5-21-2139123807-3068208427-1789639649-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=, Good: (www.google.com), Bad: (hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=),,[6e04ec50fe7ee3538d9c87c2f80d17e9]

Folders: 6
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\mysearchdial, , [74fe7ebec7b580b6459a31d34bb8ed13], 
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\mysearchdial\icons_2.2.14.1379, , [74fe7ebec7b580b6459a31d34bb8ed13], 
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\mysearchdial\UpdateProc, , [74fe7ebec7b580b6459a31d34bb8ed13], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\bh, , [c4ae55e75626e55177bb61a5b94afc04], 

Files: 73
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialsrv.exe, , [b7bb54e8e09c0f272f13a74a778bbe42], 
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\searchplugins\Mysearchdial.xml, , [d39fec50bdbfa09670c5660121e2827e], 
PUP.Optional.MySpeedDial.A, C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage, , [89e9fd3fed8ff73f06a1b2f16e9631cf], 
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\mysearchdial\icons_2.2.14.1379\62.ico, , [74fe7ebec7b580b6459a31d34bb8ed13], 
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\mysearchdial\icons_2.2.14.1379\80.ico, , [74fe7ebec7b580b6459a31d34bb8ed13], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\FavIcon.ico, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialApp.dll, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialEng.dll, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialTlbr.dll, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\Sqlite3.dll, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Program Files (x86)\Mysearchdial\1.8.21.0\bh\mysearchdial.dll, , [c4ae55e75626e55177bb61a5b94afc04], 
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (user_pref("extensions.mysearchdial.aflt", "dsites");), ,[5b17102c08741f1783f4f68aa75e07f9]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (rences

/* Do not edit this file.
 *
 * If you make changes to this file while th), ,[076b1d1f5e1ee056b8bfa5db21e48080]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (e.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To mak), ,[e38f49f37efe0630730478080104e61a]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (nning,
 * the changes will be overwritten when t), ,[7df5de5e5c20a492552288f8d72e22de]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (eferences

/* Do not edit this file.
 *
 * If you ), ,[c3af96a64834f4427502a5db9c6943bd]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (nces

/* Do not edit this file.
 *
 * If you ), ,[442e45f7443804325b1c85fb92733bc5]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (eferences

/* Do not edit this file.
 *
 * If yo), ,[fa7897a5ea921d191760116fe61fa759]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (rences

/* Do not edit this file.
 *
 * If you), ,[8ee4b08c502c88aee88f5d231aebb64a]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (ferences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1416141222);
user_pref("app.update.lastUpdateTime.background-update-timer", 1416137484);
user_pref("app.update.lastUpdateTime.blocklist-background-update-timer", 1416137676);
user_pref("app.update.lastUpdateTime.browser-cleanup-thumbna), ,[f47e7dbf126a46f0b3c45e2254b1619f]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: ("app.update.lastUpdateTime.browser-cleanup-thumbnail), ,[581a4af26616ef47adca503017eedf21]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (rences

/* Do not edit this file.
 *
 * If you make changes to this file whi), ,[2b47f14b304cd36395e21f617c894fb1]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (s file.
 *
 * If you make changes to this file), ,[0a68c07c374579bdd6a1ccb4bb4a33cd]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (references

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences,), ,[c6ac60dc7903a88e4334631d33d2a060]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (
 *
 * To make a manual change to preferences, you can vis), ,[a9c962daf884e74f3e399de345c0649c]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (
/* Do not edit this file.
 *
 * If you make changes), ,[9fd33dff6d0ff83e750284fcf5108878]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (ces

/* Do not edit this file.
 *
 * If you ma), ,[cfa3fe3e502ce74f92e5acd4c0458878]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (ferences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences,), ,[00722f0da4d8a690e295c5bb966f4cb4]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (s.
 *
 * To make a manual change to preferences, you can visit the), ,[b8ba47f54b31e551bbbc4937fd086997]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can visit the URL), ,[145e8ab25c200135c3b4136d9b6af60a]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: ( *
 * To make a manual change to preferences, you can visit the URL about:config
 */

user_pref("accessibility.typeaheadfind.flashBar", 0);
user_pref("app.update.lastUpdateTime.addo), ,[0a688bb12458191d62156f1133d2619f]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: ( overwritten when the application exits.
 *
 * To make a ), ,[cca6d7658eee47ef6512542c4abbbf41]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (

/* Do not edit this file.
 *
 * If you make changes to t), ,[fe742913f8842d090473add355b05ca4]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (
/* Do not edit this file.
 *
 * If you make c), ,[cea4f14b304c73c3e98e4f3100052cd4]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (references

/* Do not edit this file.
 *
 * If you make cha), ,[abc7fb416a126acce592463ab74e11ef]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (* Do not edit this file.
 *
 * If you make changes), ,[02700c30d8a45ed8c6b1562ab74ecf31]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (rences

/* Do not edit this file.
 *
 * If you make changes to this file while the application is running,
 * the changes will be overwritten when the application exits.
 *
 * To make a manual change to preferences, you can vi), ,[95dd3efe5b21330379fe3050bb4a768a]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (* To make a manual change to preferences, you can visi), ,[86ec52ead9a39c9a2255760ae520629e]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (nces

/* Do not edit this file.
 *
 * If you make c), ,[145e1428c1bb122483f4710f41c4bc44]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (ferences

/* Do not edit this file.
 *
 * If you ), ,[f77bb08cacd0043287f0225ee5200ff1]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (ences

/* Do not edit this file.
 *
 * If you make ), ,[650d7ac2fd7f7eb8d5a2235d19ecff01]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\prefs.js, Good: (), Bad: (ces

/* Do not edit this file.
 *
 * If you make changes to th), ,[adc59aa282fad3637007a5db38cd8080]
PUP.Optional.MySearch.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (user_pref("extensions.irmysearch.aflt", "dsites");), ,[de94ad8fd8a40333c2ad1b658481ba46]
PUP.Optional.MySearch.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (s.mysearchdial.hmpg", true);
user_pref("extensi), ,[c3afdc60364682b4ef80225e5fa66c94]
PUP.Optional.MySearch.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ons.mysearchdial.hmpg", true);
user_pref("extension), ,[78fac47847351026abc40d73a75e857b]
PUP.Optional.MySearch.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0), ,[8fe3ae8ee894350195da245c8c79be42]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (user_pref("extensions.mysearchdial.hmpg", true);), ,[8ae8e35996e6e84ea1d7d4acdb2a6a96]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (sions.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1), ,[98da9e9e0b715bdbbdbbc1bfe61f33cd]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czut), ,[c4aec5774c30ca6c3246235d0104dd23]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (s.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdia), ,[ef83b28a89f3ee48c6b21f6148bd35cb]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ial.hmpg", true);
user_pref("extensions.mysearchd), ,[cba747f54a328da9a1d7e19f7194a858]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ons.mysearchdial.hmpg", true);
user_pref("extensions), ,[a5cd0a3295e7191d79ffd3ad8184e020]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD), ,[e98944f8433984b2d99f146c59ac1ee2]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=");
user_pref("extensions.mysearchdial.dfltSrch", true);
user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
user_pref("extensions.mysearchdi), ,[f47e1f1d99e389ad3d3ba9d7679e867a]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (yBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=14), ,[0969ea520b717cba3d3b86faa95c30d0]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (chdial.hmpg", true);
user_pref("extensions.mysearchdia), ,[4e2436068eee1b1b5e1a364a8e7744bc]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ysearchdial.hmpg", true);
user_pref("extensions.mysea), ,[95dd8bb1d9a37cba90e840409570ca36]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (mysearchdial.hmpg", true);
user_pref("extensions.mysea), ,[2949e359f78545f194e4265a986d7090]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpg), ,[3c36a597463654e20672fd8336cf0af6]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", ), ,[452d8eae5824181e3246344c34d1a957]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (hdial.hmpg", true);
user_pref("extensions.mysearchdial.hmp), ,[3c36e65682fa9b9b83f5e997c93c2cd4]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (rchdial.hmpg", true);
user_pref("extensions.mysearc), ,[bbb7fe3e78040e28334587f9877ef50b]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (s.mysearchdial.hmpg", true);
user_pref("extensions.mys), ,[fe74b28a611bf343b5c3611fe52016ea]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ysearchdial.hmpg", true);
user_pref("extensions.mys), ,[90e266d6b1cb082ee098a4dce3222dd3]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (s.mysearchdial.hmpg", true);
user_pref("extension), ,[c1b1102cafcdd85e98e0dfa153b21fe1]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ons.mysearchdial.hmpg", true);
user_pref("extens), ,[91e168d4daa247ef27515c245da86c94]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ions.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "http:/), ,[acc697a57b01d95ded8b0080f015c040]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (r_pref("extensions.mysearchdial.hmpgUrl", "hxxp://st), ,[076b8bb16319f244ccac433d17eec040]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (ons.mysearchdial.hmpg", true);
user_pref("extensions.), ,[b2c0c775d9a31125f484166a32d3d22e]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0Fz), ,[6012c77548343ff7c2b6532dcc39e11f]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=");), ,[d2a0e953a2dae650da9f097758ad2fd1]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: ("Mysearchdial");
user_pref("extensions.mysearchdial.dnsErr", true);
user_pref("extensions.mysearchdial_i.newTab", false);
user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=dsites&cd=2XzuyEtN), ,[93df3dffe59701356e0b305013f2f907]
PUP.Optional.MySearchDial.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js, Good: (), Bad: (1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=");
user_pref("extensions.mysearchdial.dfltSrch", true);
user_pref("extensions.mysearchdial.srchPrvdr", "Mysear), ,[1a58112bd8a43cfade9bb2cea560ab55]

Physical Sectors: 0
(No malicious items detected)


(end)
         
*GMER konnte nicht gestartet werden Fehler.
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-16 16:19:55
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000043 TOSHIBA_MK6475GSX rev.GT001M 596,17GB
Running: Gmer-19357.exe; Driver: C:\Users\****\AppData\Local\Temp\kxdcafog.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\windows\System32\win32k.sys!W32pServiceTable                                                                                            fffff960000e1900 7 bytes [00, CE, 7F, 01, 00, FF, F1]
.text   C:\windows\System32\win32k.sys!W32pServiceTable + 8                                                                                        fffff960000e1908 7 bytes [01, FE, BF, FF, 00, CF, DA]

---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe[908] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306        000007fe2176177a 4 bytes [76, 21, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe[908] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314        000007fe21761782 4 bytes [76, 21, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe[908] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                  000007fe19d71532 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe[908] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                  000007fe19d7153a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe[908] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                000007fe19d7165a 4 bytes [D7, 19, FE, 07]
.text   C:\windows\system32\atiesrxx.exe[992] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                         000007fe2176177a 4 bytes [76, 21, FE, 07]
.text   C:\windows\system32\atiesrxx.exe[992] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                         000007fe21761782 4 bytes [76, 21, FE, 07]
.text   C:\windows\system32\atieclxx.exe[1060] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306                                        000007fe2176177a 4 bytes [76, 21, FE, 07]
.text   C:\windows\system32\atieclxx.exe[1060] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314                                        000007fe21761782 4 bytes [76, 21, FE, 07]
.text   C:\windows\system32\atieclxx.exe[1060] C:\windows\system32\WSOCK32.dll!recvfrom + 742                                                      000007fe1b071b32 4 bytes [07, 1B, FE, 07]
.text   C:\windows\system32\atieclxx.exe[1060] C:\windows\system32\WSOCK32.dll!recvfrom + 750                                                      000007fe1b071b3a 4 bytes [07, 1B, FE, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1260] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                    000007fe19d71532 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1260] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                    000007fe19d7153a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1260] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                  000007fe19d7165a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe[2632] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306  000007fe2176177a 4 bytes [76, 21, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe[2632] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314  000007fe21761782 4 bytes [76, 21, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe[2632] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690            000007fe19d71532 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe[2632] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698            000007fe19d7153a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe[2632] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246          000007fe19d7165a 4 bytes [D7, 19, FE, 07]
.text   C:\windows\Explorer.EXE[3080] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                                           000007fe19d71532 4 bytes [D7, 19, FE, 07]
.text   C:\windows\Explorer.EXE[3080] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                                           000007fe19d7153a 4 bytes [D7, 19, FE, 07]
.text   C:\windows\Explorer.EXE[3080] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                                         000007fe19d7165a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe[3496] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306        000007fe2176177a 4 bytes [76, 21, FE, 07]
.text   C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe[3496] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314        000007fe21761782 4 bytes [76, 21, FE, 07]
.text   C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe[4240] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                 000007fe19d71532 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe[4240] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                 000007fe19d7153a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe[4240] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                               000007fe19d7165a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1084] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690                                   000007fe19d71532 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1084] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698                                   000007fe19d7153a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1084] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246                                 000007fe19d7165a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe[1760] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690           000007fe19d71532 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe[1760] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698           000007fe19d7153a 4 bytes [D7, 19, FE, 07]
.text   C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe[1760] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246         000007fe19d7165a 4 bytes [D7, 19, FE, 07]

---- Threads - GMER 2.1 ----

Thread  C:\windows\system32\csrss.exe [568:592]                                                                                                    fffff960009205e8

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
         
*G-Data Log 2 Funde
Code:
ATTFilter
Beim Öffnen der Datei "C:\Users\****\AppData\Local\Temp\is357113909\251524263_stp\BrowseSmartSetup.exe" wurde der Virus "Adware.SwiftBrowse.CJ (Engine A)" entdeckt. Zugriff verweigert.
         
Code:
ATTFilter
*** Prozess ***
Prozess: 1064
Dateiname: erunt.exe
Pfad: c:\windows\erunt.exe

Herausgeber: Unbekannter Herausgeber
Erstelldatum: 02/22/13 15:05:21
Änderungsdatum: 02/22/13 02:04:50

Gestartet von: cmd.exe
Herausgeber: Microsoft Windows

*** Aktionen ***

Ein Packer wurde auf die Programmdatei angewandt. Möglicherweise um schädliche Inhalte zu verbergen.
Das Programm hat in Dateien oder Ordnern geschrieben die genutzt werden können um das System zu gefährden.
Das Programm hat Werte in der System-Registrierung verändert die genutzt werden können um das System zu gefährden.

*** Quarantäne ***

Folgende Dateien wurden in Quarantäne verschoben:
C:\FRST\Hives\Users\00000001\NTUSER.DAT
C:\Windows\ERUNT.exe
c:\frst\hives\users\00000001\ntuser.dat

Folgende Registry Einträge wurden gelöscht:
\REGISTRY\MACHINE\SECURITY


YGLRtuLAcnJycmJi0HJycnJiYuBycicnd2JicCp0ckInJyYGt3JycnJiYnAsJycnJyYGaHJycnJiYoArJycnJyYGmXJykCsWbSsJyXJycKdycnB4cnJycmJicJlycnJyYmJwunKxXmO2cnKxXmO2cmJicI5ycgAA
Version der Regeln: 4.6.9
OS: Windows 6.2 Service Pack 0.0 Build: 9200 - Workstation 64bit OS
Version der dll: 40166

ERUNT.exe C:\FRST\HIVES silent sysreg curuser /noconfirmdelete /noprogresswindow
MD5: 2E0323A94915FAAB10A25F3BABF82584
C:\windows\system32\cmd.exe /c ERUNT.exe C:\FRST\HIVES silent sysreg curuser /noconfirmdelete /noprogresswindow
MD5:
         
*FRST LogFile
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2014 02
Ran by **** (administrator) on ****** on 14-11-2014 13:12:13
Running from C:\Users\****\Desktop
Loaded Profile: **** (Available profiles: ****)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\USB KEYBOARD GUARD\GD2NDKBB.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.2.8516.0_x64__8wekyb3d8bbwe\glcnd.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] => C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [GDataUsbProtection] => C:\Program Files (x86)\G DATA\USB KEYBOARD GUARD\GD2NDKBB.exe [1412216 2014-09-05] (G Data Software AG)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
HKU\S-1-5-21-2139123807-3068208427-1789639649-1001\...\MountPoints2: {8d2bce18-fd61-11e1-be6c-806e6f6e6963} - "D:\autorun.exe" /autorun

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=
SearchScopes: HKLM - DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=
SearchScopes: HKLM - {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKCU - DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=
SearchScopes: HKCU - {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0D0Tzu0SyBtDyDtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=1416088406&ir=
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Mysearchdial
FF SearchEngineOrder.1: Mysearchdial
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @java.com/DTPlugin,version=10.15.2 -> C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.15.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF user.js: detected! => C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\searchplugins\Mysearchdial.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: GMX MailCheck - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\toolbar@gmx.net [2014-11-09]
FF Extension: WOT - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-12-18]
FF Extension: Disconnect - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\2.0@disconnect.me.xpi [2014-06-08]
FF Extension: Google Disconnect - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\google@disconnect.me.xpi [2014-06-08]
FF Extension: Soundcloud SUPER +2: Downloader and Recommender - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{988da70d-b78d-44a1-a9c7-ed11832a9e2e}.xpi [2013-08-11]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-08-11]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR Profile: C:\Users\****\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1900400 2014-11-05] (Electronic Arts)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-06-13] (G Data Software AG)
R3 GDKBBlocker; C:\windows\system32\drivers\GDKBBlocker64.sys [30720 2014-09-22] (G Data Software AG)
R1 GDKBFlt; C:\windows\system32\drivers\GDKBFlt64.sys [20992 2014-11-13] (G Data Software AG)
R1 GDMnIcpt; C:\windows\system32\drivers\MiniIcpt.sys [142336 2014-09-22] (G Data Software AG)
R3 GDPkIcpt; C:\windows\system32\drivers\PktIcpt.sys [64000 2014-06-13] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [68608 2014-11-13] (G Data Software AG)
R1 GRD; C:\windows\system32\drivers\GRD.sys [106272 2014-06-13] (G Data Software)
R1 HookCentre; C:\windows\system32\drivers\HookCentre.sys [61440 2014-06-13] (G Data Software AG)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [89088 2012-07-26] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-14 13:11 - 2014-11-14 13:12 - 00024414 _____ () C:\Users\****\Desktop\Addition.txt
2014-11-14 13:10 - 2014-11-14 13:12 - 00016514 _____ () C:\Users\****\Desktop\FRST.txt
2014-11-14 13:09 - 2014-11-14 13:12 - 00000000 ____D () C:\FRST
2014-11-14 13:06 - 2014-11-14 13:06 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-11-14 13:04 - 2014-11-14 13:05 - 02116608 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-11-13 23:32 - 2014-11-13 23:32 - 00000000 ____D () C:\Users\****\AppData\Local\G DATA
2014-11-13 23:27 - 2014-11-13 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY
2014-11-13 20:00 - 2014-11-13 20:00 - 00000000 ____D () C:\Users\****\AppData\Local\Adobe
2014-11-09 11:13 - 2014-11-09 11:13 - 00001162 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-09 11:11 - 2014-11-09 11:11 - 36855856 _____ () C:\Users\****\Downloads\GMX_Firefox_Setup.exe
2014-10-26 18:55 - 2014-10-26 18:55 - 00000000 __SHD () C:\Recovery
2014-10-19 18:37 - 2014-10-25 16:53 - 00003136 _____ () C:\windows\comsetup.log
2014-10-17 11:21 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-17 11:21 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-17 11:21 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-10-17 11:20 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-17 11:20 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2014-10-17 11:20 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2014-10-17 11:20 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-10-17 11:20 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-10-17 11:20 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-10-17 11:20 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2014-10-17 11:20 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-10-17 11:20 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2014-10-17 11:20 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-10-17 11:20 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2014-10-17 11:19 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-10-17 11:19 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-17 11:19 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-17 11:19 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-10-17 11:19 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-10-17 11:19 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-10-17 11:19 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-10-17 11:19 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-10-17 11:19 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-10-17 11:19 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-10-17 11:19 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-10-17 11:19 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-10-17 11:19 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-10-17 11:19 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-14 13:00 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\sru
2014-11-14 12:46 - 2013-01-10 16:04 - 01853645 _____ () C:\windows\WindowsUpdate.log
2014-11-14 12:42 - 2012-07-26 08:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-14 12:39 - 2013-06-19 01:07 - 00000000 ____D () C:\Users\****\Desktop\Bastian Handy
2014-11-14 00:19 - 2013-03-10 19:53 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-13 23:29 - 2013-05-24 20:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-13 23:29 - 2012-07-26 06:26 - 01048576 ___SH () C:\windows\system32\config\BBI
2014-11-13 23:27 - 2014-09-22 18:38 - 00001989 _____ () C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk
2014-11-13 23:27 - 2014-06-13 19:56 - 00020992 _____ (G Data Software AG) C:\windows\system32\Drivers\GDKBFlt64.sys
2014-11-13 23:27 - 2013-01-15 21:30 - 00068608 _____ (G Data Software AG) C:\windows\system32\Drivers\gdwfpcd64.sys
2014-11-13 23:22 - 2013-01-12 22:19 - 00000000 ____D () C:\ProgramData\Origin
2014-11-13 20:01 - 2013-01-12 22:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-11-13 20:00 - 2013-03-10 19:53 - 00003772 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-11-09 11:56 - 2013-05-24 20:53 - 00000000 ____D () C:\Users\****\AppData\Roaming\vlc
2014-11-09 11:13 - 2013-03-10 17:14 - 00001174 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-09 11:12 - 2014-10-14 20:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-05 13:52 - 2014-05-15 19:57 - 00000000 ____D () C:\Users\****\Documents\FIFA 14
2014-11-05 13:18 - 2013-01-12 22:39 - 00249692 _____ () C:\windows\DirectX.log
2014-11-05 12:53 - 2013-01-12 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-11-05 12:50 - 2012-08-01 17:38 - 00753134 _____ () C:\windows\system32\perfh007.dat
2014-11-05 12:50 - 2012-08-01 17:38 - 00155826 _____ () C:\windows\system32\perfc007.dat
2014-11-05 12:50 - 2012-07-26 08:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-02 21:02 - 2013-01-10 16:03 - 00000000 ____D () C:\Users\****
2014-10-26 18:17 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2014-10-26 17:56 - 2014-09-24 16:19 - 00000000 ___HD () C:\$Windows.~BT
2014-10-25 17:00 - 2014-10-12 17:47 - 00047628 _____ () C:\windows\diagwrn.xml
2014-10-25 17:00 - 2014-10-12 17:47 - 00047628 _____ () C:\windows\diagerr.xml
2014-10-25 17:00 - 2012-07-26 08:21 - 00813344 _____ () C:\windows\setupact.log
2014-10-25 16:58 - 2012-07-26 09:13 - 00004323 _____ () C:\windows\DtcInstall.log
2014-10-25 16:53 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\Registration
2014-10-19 18:44 - 2012-07-26 06:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-10-19 18:13 - 2014-09-17 17:03 - 00281784 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-19 18:10 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

Some content of TEMP:
====================
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll
C:\Users\Carmen\AppData\Local\Temp\fp_pl_pfs_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-14 12:55

==================== End Of Log ============================
         
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-11-2014 02
Ran by **** at 2014-11-14 13:11:29
Running from C:\Users\****\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G DATA INTERNET SECURITY (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: G DATA INTERNET SECURITY (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
AMD Catalyst Install Manager (HKLM\...\{95EF3DDB-27C8-CDA9-9E72-5EC3F02C1B02}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Atheros Bluetooth Filter Driver Package (HKLM\...\{026B819B-4D60-4C8B-892D-33A0D8666F60}) (Version: 2.0.0.2 - Atheros Communications)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.6 - Atheros Communications Inc.)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
EA Sports FIFA World (HKLM-x32\...\{8F9AC744-EEF6-43DB-A4B6-FA1A18F1C640}) (Version: 7.1.0.50515 - Electronic Arts, Inc.)
EA SPORTS™ FIFA 15 (HKLM-x32\...\{3D4ADA2B-F028-4307-ADF4-6F9AA44725DA}) (Version: 1.3.0.0 - Electronic Arts)
EA SPORTS™ FIFA 15 Demo (HKLM-x32\...\{108C0C19-6316-4944-A62F-C744488F8639}) (Version: 1.0.0.0 - Electronic Arts)
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.0.0.0 - Electronic Arts)
FIFA 14 (HKLM-x32\...\{AA7A2800-1E75-4240-855B-03AFF8E5171E}) (Version: 1.0.0.7 - Electronic Arts)
Free YouTube to MP3 Converter version 3.12.17.1125 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.17.1125 - DVDVideoSoft Ltd.)
Free YouTube Uploader version 4.0.16.623 (HKLM-x32\...\Free YouTube Uploader_is1) (Version: 4.0.16.623 - DVDVideoSoft Ltd.)
G DATA INTERNET SECURITY (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.2.3 - G DATA Software AG)
G DATA USB KEYBOARD GUARD (HKLM-x32\...\{D8CBD59F-B29D-4E38-9D66-DEAEAB473FA9}) (Version: 1.1.0.4 - G DATA Software AG)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 7 Update 15 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417015FF}) (Version: 7.0.150 - Oracle)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Mozilla Firefox 33.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 de)) (Version: 33.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
Need for Speed™ The Run (HKLM-x32\...\{0EDC9BA0-016E-406a-86DA-04FC1BE00C21}) (Version: 1.1.0.0 - Electronic Arts)
Nero 12 Essentials Toshiba (HKLM-x32\...\{BA8958DC-ADD7-41E5-8436-5883C7E871C7}) (Version: 12.0.00400 - Nero AG)
Origin (HKLM-x32\...\Origin) (Version: 9.0.10.69 - Electronic Arts, Inc.)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6873 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.5 - Synaptics Incorporated)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.0007.00002 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425.01 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\{B1786E63-2127-42C9-95A3-146E5F727BF1}) (Version: v1.0.0.8 - TOSHIBA Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
Toshiba Places Icon Utility (HKLM\...\{C991A8C4-307C-4FDD-8AAE-A1BF44881E95}) (Version: 2.1.1 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.5.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden
WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.37 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2139123807-3068208427-1789639649-1001_Classes\CLSID\{00000001-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll (Toshiba Corporation)

==================== Restore Points  =========================

25-10-2014 15:01:28 DirectX wurde installiert
26-10-2014 17:15:53 Windows Modules Installer
05-11-2014 12:16:03 DirectX wurde installiert

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2AE1CC12-AACE-4ABA-8E3B-E31317D0F357} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-18] (Toshiba Europe GmbH)
Task: {40327C81-48D8-4E41-BC35-4DEDE666D230} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-13] (Adobe Systems Incorporated)
Task: {53026DF3-7AF4-4B11-BE87-F5BD2CE06FAF} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install => C:\windows\system32\NotificationUI.exe [2014-08-21] (Microsoft Corporation)
Task: {56FD992B-0075-4765-B37B-CDFB869DA3F9} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-16] (Synaptics Incorporated)
Task: {F68B2A81-AF4B-4BC8-BBE9-127E99727B28} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-05-20 02:38 - 2014-05-20 02:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2014-05-16 20:21 - 2014-05-16 20:21 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 03:13 - 2012-08-14 03:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-07-25 21:44 - 2012-07-25 21:35 - 00129024 _____ () C:\windows\system32\WinMetadata\Windows.UI.winmd
2012-07-25 21:44 - 2012-07-25 21:35 - 00036864 _____ () C:\windows\system32\WinMetadata\Windows.Data.winmd
2014-11-04 20:20 - 2014-11-04 20:20 - 00295936 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\19b3a0667450d039aa3ebef43d489fe7\Windows.Foundation.ni.dll
2012-08-08 18:22 - 2012-08-08 18:22 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-09-13 06:19 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-10-14 20:12 - 2014-10-11 13:53 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "Toshiba TEMPRO"
HKLM\...\StartupApproved\Run: => "TosWaitSrv"
HKLM\...\StartupApproved\Run32: => "Intel AppUp(SM) center"
HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"

========================= Accounts: ==========================

Administrator (S-1-5-21-2139123807-3068208427-1789639649-500 - Administrator - Disabled)
Carmen (S-1-5-21-2139123807-3068208427-1789639649-1001 - Administrator - Enabled) => C:\Users\Carmen
Gast (S-1-5-21-2139123807-3068208427-1789639649-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/14/2014 00:03:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_15_0_0_223.exe, Version: 15.0.0.223, Zeitstempel: 0x544ece05
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16912, Zeitstempel: 0x53645e25
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00053b99
ID des fehlerhaften Prozesses: 0x12dc
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_15_0_0_223.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_15_0_0_223.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_15_0_0_223.exe2
Berichtskennung: FlashPlayerPlugin_15_0_0_223.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_15_0_0_223.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_15_0_0_223.exe5

Error: (11/13/2014 11:24:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.2.9200.16628 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: d5c

Startzeit: 01cfff73b9ba7ee9

Endzeit: 0

Anwendungspfad: C:\windows\Explorer.EXE

Berichts-ID: cea8cde7-6b83-11e4-beea-00266c2d52e9

Vollständiger Name des fehlerhaften Pakets: 

Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (10/15/2014 09:54:53 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_15_0_0_152.exe, Version: 15.0.0.152, Zeitstempel: 0x53fe814b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16912, Zeitstempel: 0x53645e25
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00053b99
ID des fehlerhaften Prozesses: 0x1558
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_15_0_0_152.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_15_0_0_152.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_15_0_0_152.exe2
Berichtskennung: FlashPlayerPlugin_15_0_0_152.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_15_0_0_152.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_15_0_0_152.exe5

Error: (10/06/2014 06:32:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vlc.exe, Version: 2.0.5.0, Zeitstempel: 0x50c91d8b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16912, Zeitstempel: 0x53645e25
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000daacc
ID des fehlerhaften Prozesses: 0x15b8
Startzeit der fehlerhaften Anwendung: 0xvlc.exe0
Pfad der fehlerhaften Anwendung: vlc.exe1
Pfad des fehlerhaften Moduls: vlc.exe2
Berichtskennung: vlc.exe3
Vollständiger Name des fehlerhaften Pakets: vlc.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: vlc.exe5

Error: (10/05/2014 05:01:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: SONNENKIND)
Description: Die App „Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (10/05/2014 05:01:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SONNENKIND)
Description: Bei der Aktivierung der App „Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (10/05/2014 05:01:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wwahost.exe, Version: 6.2.9200.16420, Zeitstempel: 0x505a9152
Name des fehlerhaften Moduls: EntPlat.dll, Version: 1.1.144.0, Zeitstempel: 0x50edd52d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000008ec3
ID des fehlerhaften Prozesses: 0x14cc
Startzeit der fehlerhaften Anwendung: 0xwwahost.exe0
Pfad der fehlerhaften Anwendung: wwahost.exe1
Pfad des fehlerhaften Moduls: wwahost.exe2
Berichtskennung: wwahost.exe3
Vollständiger Name des fehlerhaften Pakets: wwahost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: wwahost.exe5

Error: (10/04/2014 09:08:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: SONNENKIND)
Description: Die App „Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic“ wurde nicht innerhalb der vorgesehenen Zeit gestartet.

Error: (10/04/2014 09:08:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SONNENKIND)
Description: Bei der Aktivierung der App „Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic“ ist folgender Fehler aufgetreten: -2147023170. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.

Error: (10/04/2014 09:08:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wwahost.exe, Version: 6.2.9200.16420, Zeitstempel: 0x505a9152
Name des fehlerhaften Moduls: EntPlat.dll, Version: 1.1.144.0, Zeitstempel: 0x50edd52d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000008ec3
ID des fehlerhaften Prozesses: 0x1124
Startzeit der fehlerhaften Anwendung: 0xwwahost.exe0
Pfad der fehlerhaften Anwendung: wwahost.exe1
Pfad des fehlerhaften Moduls: wwahost.exe2
Berichtskennung: wwahost.exe3
Vollständiger Name des fehlerhaften Pakets: wwahost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: wwahost.exe5


System errors:
=============
Error: (11/14/2014 00:42:40 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎14.‎11.‎2014 um 00:21:31 unerwartet heruntergefahren.

Error: (11/13/2014 07:57:38 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (11/09/2014 11:03:52 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (11/06/2014 04:35:33 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (11/06/2014 06:50:14 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (11/05/2014 00:46:17 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (11/02/2014 09:02:57 PM) (Source: DCOM) (EventID: 10010) (User: SONNENKIND)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (11/02/2014 09:02:57 PM) (Source: DCOM) (EventID: 10010) (User: SONNENKIND)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}

Error: (11/02/2014 07:37:07 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎02.‎11.‎2014 um 19:33:14 unerwartet heruntergefahren.

Error: (10/31/2014 02:51:23 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎28.‎10.‎2014 um 19:53:01 unerwartet heruntergefahren.


Microsoft Office Sessions:
=========================
Error: (11/14/2014 00:03:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_223.exe15.0.0.223544ece05ntdll.dll6.2.9200.1691253645e25c000000500053b9912dc01cfff9610be24bcC:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_223.exeC:\windows\SYSTEM32\ntdll.dll4f45240d-6b89-11e4-beeb-00266c2d52e9

Error: (11/13/2014 11:24:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.2.9200.16628d5c01cfff73b9ba7ee90C:\windows\Explorer.EXEcea8cde7-6b83-11e4-beea-00266c2d52e9

Error: (10/15/2014 09:54:53 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_15_0_0_152.exe15.0.0.15253fe814bntdll.dll6.2.9200.1691253645e25c000000500053b99155801cfe855af75c138C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exeC:\windows\SYSTEM32\ntdll.dlled8b3603-5448-11e4-bee4-00266c2d52e9

Error: (10/06/2014 06:32:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vlc.exe2.0.5.050c91d8bntdll.dll6.2.9200.1691253645e25c0000374000daacc15b801cfe18b5dcba024C:\Program Files (x86)\VideoLAN\VLC\vlc.exeC:\windows\SYSTEM32\ntdll.dllb1a6cc9f-4d7e-11e4-bee4-00266c2d52e9

Error: (10/05/2014 05:01:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: SONNENKIND)
Description: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic

Error: (10/05/2014 05:01:11 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SONNENKIND)
Description: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic-2147023170

Error: (10/05/2014 05:01:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: wwahost.exe6.2.9200.16420505a9152EntPlat.dll1.1.144.050edd52dc00000050000000000008ec314cc01cfe0b4c8394913C:\windows\system32\wwahost.exeC:\Program Files\WindowsApps\Microsoft.ZuneMusic_1.1.144.0_x64__8wekyb3d8bbwe\EntPlat.dlld168f2e2-4ca8-11e4-bee4-00266c2d52e9Microsoft.ZuneMusic_1.1.144.0_x64__8wekyb3d8bbweMicrosoft.ZuneMusic

Error: (10/04/2014 09:08:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: SONNENKIND)
Description: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic

Error: (10/04/2014 09:08:18 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: SONNENKIND)
Description: Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic-2147023170

Error: (10/04/2014 09:08:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: wwahost.exe6.2.9200.16420505a9152EntPlat.dll1.1.144.050edd52dc00000050000000000008ec3112401cfe000400e94b7C:\windows\system32\wwahost.exeC:\Program Files\WindowsApps\Microsoft.ZuneMusic_1.1.144.0_x64__8wekyb3d8bbwe\EntPlat.dll2bcefed4-4c02-11e4-bee4-00266c2d52e9Microsoft.ZuneMusic_1.1.144.0_x64__8wekyb3d8bbweMicrosoft.ZuneMusic


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Percentage of memory in use: 20%
Total physical RAM: 8144.22 MB
Available physical RAM: 6454.23 MB
Total Pagefile: 9360.22 MB
Available Pagefile: 7176.27 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (TI30961600B) (Fixed) (Total:585.74 GB) (Free:368.76 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596.2 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         


Vielleicht kann uns jemand helfen.


Mit Freundlichen Grüße

Sebastian

Alt 16.11.2014, 17:09   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



hi,

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________

__________________

Alt 16.11.2014, 18:05   #3
Arni79
 
Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Hallo Schrauber,

vielen Dank für deine Hilfe und Zeit bei unserem Problem.

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.9 (11.15.2014:2)
OS: Windows 8 x64
Ran by Carmen on 16.11.2014 at 18:45:13,41
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Carmen\AppData\Roaming\mozilla\firefox\profiles\8ikkmaam.default\extensions\toolbar@gmx.net
Emptied folder: C:\Users\Carmen\AppData\Roaming\mozilla\firefox\profiles\8ikkmaam.default\minidumps [7 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.11.2014 at 18:49:38,04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
AdwCleaner
Code:
ATTFilter
# AdwCleaner v4.101 - Bericht erstellt am 16/11/2014 um 18:39:49
# Aktualisiert 09/11/2014 von Xplode
# Database : 2014-11-16.1 [Live]
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Carmen - *******
# Gestartet von : C:\Users\Carmen\Desktop\AdwCleaner_4.101.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Mobogenie
Ordner Gelöscht : C:\Users\Carmen\AppData\Local\CrashRpt
Ordner Gelöscht : C:\Users\Carmen\Documents\Mobogenie
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Datei Gelöscht : C:\Users\Carmen\daemonprocess.txt
Datei Gelöscht : C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\invalidprefs.js
Datei Gelöscht : C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5EF2DD34-5177-46ED-A8ED-4E91FE206385}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5EF2DD34-5177-46ED-A8ED-4E91FE206385}
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.17116


-\\ Mozilla Firefox v33.0 (x86 de)

[8ikkmaam.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[8ikkmaam.default\prefs.js] - Zeile gelöscht : user_pref("extensionons.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutByE0E0Czyzyzz0C0FzytAyDyDyCzy0CtN0CyD1B1P1R&cr=1416088406&ir=");
[8ikkmaam.default\prefs.js] - Zeile gelöscht : user_pref("extensions.mysearchdial.dfltSrch", true);

-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [2551 octets] - [16/11/2014 18:34:01]
AdwCleaner[R1].txt - [2611 octets] - [16/11/2014 18:37:02]
AdwCleaner[S0].txt - [2387 octets] - [16/11/2014 18:39:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2447 octets] ##########
         
FRST

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2014 02
Ran by Carmen (administrator) on **** on 16-11-2014 18:51:46
Running from C:\Users\Carmen\Desktop\FRST&$ Log file
Loaded Profile: Carmen (Available profiles: Carmen)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\USB KEYBOARD GUARD\GD2NDKBB.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] => C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [GDataUsbProtection] => C:\Program Files (x86)\G DATA\USB KEYBOARD GUARD\GD2NDKBB.exe [1412216 2014-09-05] (G Data Software AG)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
HKU\S-1-5-21-2139123807-3068208427-1789639649-1001\...\MountPoints2: {8d2bce18-fd61-11e1-be6c-806e6f6e6963} - "D:\autorun.exe" /autorun

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM - DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = 
SearchScopes: HKLM-x32 - DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKCU - DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @java.com/DTPlugin,version=10.15.2 -> C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.15.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-12-18]
FF Extension: Disconnect - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\2.0@disconnect.me.xpi [2014-06-08]
FF Extension: Cliqz Beta - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\cliqz@cliqz.com.xpi [2014-11-16]
FF Extension: Google Disconnect - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\google@disconnect.me.xpi [2014-06-08]
FF Extension: Soundcloud SUPER +2: Downloader and Recommender - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{988da70d-b78d-44a1-a9c7-ed11832a9e2e}.xpi [2013-08-11]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-08-11]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: No Name - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\extensions\toolbar@gmx.net [Not Found]
FF Extension: No Name - toolbar@gmx.net [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-26] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-26] (Microsoft Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1900400 2014-11-05] (Electronic Arts)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-26] (Microsoft Corporation)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-06-13] (G Data Software AG)
R3 GDKBBlocker; C:\windows\system32\drivers\GDKBBlocker64.sys [30720 2014-09-22] (G Data Software AG)
R1 GDKBFlt; C:\windows\system32\drivers\GDKBFlt64.sys [20992 2014-11-13] (G Data Software AG)
R1 GDMnIcpt; C:\windows\system32\drivers\MiniIcpt.sys [142336 2014-09-22] (G Data Software AG)
R3 GDPkIcpt; C:\windows\system32\drivers\PktIcpt.sys [64000 2014-06-13] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [68608 2014-11-13] (G Data Software AG)
R1 GRD; C:\windows\system32\drivers\GRD.sys [106272 2014-06-13] (G Data Software)
R1 HookCentre; C:\windows\system32\drivers\HookCentre.sys [61440 2014-06-13] (G Data Software AG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [89088 2012-07-26] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-16 18:49 - 2014-11-16 18:49 - 00000878 _____ () C:\Users\Carmen\Desktop\JRT.txt
2014-11-16 18:44 - 2014-11-16 18:44 - 00000000 ____D () C:\windows\ERUNT
2014-11-16 18:43 - 2014-11-16 18:43 - 00002528 _____ () C:\Users\Carmen\Desktop\AdwCleaner[S0].txt
2014-11-16 18:33 - 2014-11-16 18:39 - 00000000 ____D () C:\AdwCleaner
2014-11-16 18:32 - 2014-11-16 18:32 - 01707532 _____ (Thisisu) C:\Users\Carmen\Desktop\JRT.exe
2014-11-16 18:31 - 2014-11-16 18:31 - 02140160 _____ () C:\Users\Carmen\Desktop\AdwCleaner_4.101.exe
2014-11-16 16:19 - 2014-11-16 17:31 - 00007454 _____ () C:\Users\Carmen\Desktop\gmer.log
2014-11-16 16:00 - 2014-11-16 16:00 - 00380416 _____ () C:\Users\Carmen\Desktop\Gmer-19357.exe
2014-11-16 14:03 - 2014-11-16 15:58 - 00000472 _____ () C:\Users\Carmen\Desktop\defogger_disable.log
2014-11-16 14:03 - 2014-11-16 14:03 - 00000000 _____ () C:\Users\Carmen\defogger_reenable
2014-11-16 13:31 - 2014-11-16 18:42 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-16 13:31 - 2014-11-16 13:31 - 00001117 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-16 13:31 - 2014-11-16 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-16 13:31 - 2014-11-16 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-16 13:31 - 2014-11-16 13:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-11-16 13:31 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-11-16 13:31 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-11-16 13:31 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-11-16 13:19 - 2014-11-16 13:19 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Carmen\Desktop\mbam-setup-2.0.3.1025.exe
2014-11-16 12:44 - 2014-11-16 12:44 - 00050477 _____ () C:\Users\Carmen\Desktop\Defogger.exe
2014-11-16 11:19 - 2014-11-16 18:51 - 00000000 ____D () C:\Users\Carmen\Desktop\FRST&$ Log file
2014-11-14 13:37 - 2014-11-14 13:37 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Cliqz
2014-11-14 13:37 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\SysWOW64\dhRichClient3.dll
2014-11-14 13:37 - 2011-03-25 19:42 - 00338432 _____ () C:\windows\SysWOW64\sqlite36_engine.dll
2014-11-14 13:34 - 2014-11-14 13:34 - 01125200 _____ () C:\Users\Carmen\Downloads\Gmer-19357 - CHIP-Installer.exe
2014-11-14 13:21 - 2014-11-14 13:21 - 00380416 _____ () C:\Users\Carmen\Downloads\f81puu3t.exe
2014-11-14 13:09 - 2014-11-16 18:51 - 00000000 ____D () C:\FRST
2014-11-13 23:32 - 2014-11-13 23:32 - 00000000 ____D () C:\Users\Carmen\AppData\Local\G DATA
2014-11-13 23:27 - 2014-11-13 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY
2014-11-13 20:00 - 2014-11-13 20:00 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Adobe
2014-11-09 11:13 - 2014-11-09 11:13 - 00001162 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-09 11:11 - 2014-11-09 11:11 - 36855856 _____ () C:\Users\Carmen\Downloads\GMX_Firefox_Setup.exe
2014-10-26 18:55 - 2014-10-26 18:55 - 00000000 __SHD () C:\Recovery
2014-10-19 18:37 - 2014-10-25 16:53 - 00003136 _____ () C:\windows\comsetup.log
2014-10-17 11:21 - 2014-09-13 06:29 - 00079360 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-17 11:21 - 2014-09-13 05:02 - 00068096 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-17 11:21 - 2014-07-07 06:51 - 05982208 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-10-17 11:20 - 2014-09-28 05:18 - 04068352 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-17 11:20 - 2014-09-03 03:48 - 00510464 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2014-10-17 11:20 - 2014-09-03 03:21 - 00585728 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2014-10-17 11:20 - 2014-07-07 06:53 - 01125376 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-10-17 11:20 - 2014-07-07 06:52 - 03248128 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-10-17 11:20 - 2014-07-07 06:52 - 00724992 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-10-17 11:20 - 2014-07-07 06:52 - 00300544 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2014-10-17 11:20 - 2014-07-07 05:01 - 01049600 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-10-17 11:20 - 2014-07-07 05:01 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2014-10-17 11:20 - 2014-07-07 05:00 - 05095424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-10-17 11:20 - 2014-07-07 04:59 - 00269312 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2014-10-17 11:19 - 2014-09-20 06:18 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-10-17 11:19 - 2014-09-20 06:17 - 02236928 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-17 11:19 - 2014-09-20 06:17 - 01407488 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-17 11:19 - 2014-09-20 06:17 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2014-10-17 11:19 - 2014-09-20 06:17 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 19280896 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 15399424 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 02655232 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00255488 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00097280 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-10-17 11:19 - 2014-09-20 06:16 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-10-17 11:19 - 2014-09-20 06:15 - 01508864 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-10-17 11:19 - 2014-09-20 06:15 - 00451584 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-10-17 11:19 - 2014-09-20 06:15 - 00281600 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 14368768 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 13757952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 02861568 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 02055168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 01762816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 01180672 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00080384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00039936 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-10-17 11:19 - 2014-09-20 04:57 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-10-17 11:19 - 2014-09-20 04:56 - 01440768 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-10-17 11:19 - 2014-09-20 04:56 - 00357888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-10-17 11:19 - 2014-09-20 04:56 - 00226816 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-10-17 11:19 - 2014-09-20 04:38 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-10-17 11:19 - 2014-09-20 04:33 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-10-17 11:19 - 2014-09-20 02:06 - 00534528 _____ (Microsoft Corporation) C:\windows\SysWOW64\uxtheme.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-16 18:41 - 2012-08-27 09:23 - 00292358 _____ () C:\windows\PFRO.log
2014-11-16 18:41 - 2012-07-26 08:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-16 18:40 - 2013-01-10 16:04 - 01960142 _____ () C:\windows\WindowsUpdate.log
2014-11-16 18:39 - 2013-01-10 16:03 - 00000000 ____D () C:\Users\Carmen
2014-11-16 18:19 - 2013-03-10 19:53 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-16 18:12 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\rescache
2014-11-16 18:02 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\sru
2014-11-16 16:27 - 2014-03-01 17:51 - 00000000 ____D () C:\Users\Carmen\Documents\Handyrechnung
2014-11-16 16:05 - 2013-01-12 22:19 - 00000000 ____D () C:\ProgramData\Origin
2014-11-16 13:55 - 2012-07-26 06:26 - 01048576 ___SH () C:\windows\system32\config\BBI
2014-11-16 13:54 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\System
2014-11-16 12:24 - 2013-07-08 17:16 - 00000000 ____D () C:\Users\Carmen\Desktop\Schmidt Schneider Sallmann
2014-11-16 12:24 - 2013-06-19 01:07 - 00000000 ____D () C:\Users\Carmen\Desktop\Bastian Handy
2014-11-16 12:22 - 2014-07-27 14:58 - 00000000 ____D () C:\Users\Carmen\Desktop\urlaub 12.07-26.07.14
2014-11-16 12:21 - 2013-12-26 16:25 - 00000000 ____D () C:\Users\Carmen\Desktop\WM 2014 7.1
2014-11-16 12:18 - 2013-05-24 20:53 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\vlc
2014-11-16 12:04 - 2014-07-27 14:35 - 00000000 ____D () C:\Users\Carmen\Desktop\Autos usw
2014-11-16 11:51 - 2013-06-22 14:39 - 00000000 ____D () C:\Users\Carmen\Desktop\usa 2013
2014-11-16 11:24 - 2014-10-04 14:17 - 00000000 ____D () C:\Users\Carmen\Desktop\USA 2011
2014-11-14 14:47 - 2013-01-12 22:39 - 00267243 _____ () C:\windows\DirectX.log
2014-11-14 14:40 - 2013-01-12 22:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-11-13 23:29 - 2013-05-24 20:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-13 23:27 - 2014-09-22 18:38 - 00001989 _____ () C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk
2014-11-13 23:27 - 2014-06-13 19:56 - 00020992 _____ (G Data Software AG) C:\windows\system32\Drivers\GDKBFlt64.sys
2014-11-13 23:27 - 2013-01-15 21:30 - 00068608 _____ (G Data Software AG) C:\windows\system32\Drivers\gdwfpcd64.sys
2014-11-13 20:00 - 2013-03-10 19:53 - 00003772 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-11-09 11:13 - 2013-03-10 17:14 - 00001174 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-09 11:12 - 2014-10-14 20:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-05 13:52 - 2014-05-15 19:57 - 00000000 ____D () C:\Users\Carmen\Documents\FIFA 14
2014-11-05 12:53 - 2013-01-12 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-11-05 12:50 - 2012-08-01 17:38 - 00753134 _____ () C:\windows\system32\perfh007.dat
2014-11-05 12:50 - 2012-08-01 17:38 - 00155826 _____ () C:\windows\system32\perfc007.dat
2014-11-05 12:50 - 2012-07-26 08:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-26 18:17 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2014-10-26 17:56 - 2014-09-24 16:19 - 00000000 ___HD () C:\$Windows.~BT
2014-10-25 17:00 - 2014-10-12 17:47 - 00047628 _____ () C:\windows\diagwrn.xml
2014-10-25 17:00 - 2014-10-12 17:47 - 00047628 _____ () C:\windows\diagerr.xml
2014-10-25 17:00 - 2012-07-26 08:21 - 00813344 _____ () C:\windows\setupact.log
2014-10-25 16:58 - 2012-07-26 09:13 - 00004323 _____ () C:\windows\DtcInstall.log
2014-10-25 16:53 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\Registration
2014-10-19 18:44 - 2012-07-26 06:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-10-19 18:13 - 2014-09-17 17:03 - 00281784 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-19 18:10 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

Some content of TEMP:
====================
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll
C:\Users\Carmen\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Carmen\AppData\Local\Temp\Quarantine.exe
C:\Users\Carmen\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-14 12:55

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Ich habe wieder ein Hinweis von G-Data bekommen beim JRT lauf.

Code:
ATTFilter
*** Prozess ***

Prozess: 5376
Dateiname: erunt.exe
Pfad: c:\users\carmen\appdata\local\temp\jrt\erunt\erunt.exe

Herausgeber: Unbekannter Herausgeber
Erstelldatum: 11/16/14 17:43:54
Änderungsdatum: 12/08/12 07:27:02

Gestartet von: cmd.exe
Herausgeber: Microsoft Windows


*** Aktionen ***

Ein Packer wurde auf die Programmdatei angewandt. Möglicherweise um schädliche Inhalte zu verbergen.
Das Programm hat in Dateien oder Ordnern geschrieben die genutzt werden können um das System zu gefährden.
Das Programm hat Werte in der System-Registrierung verändert die genutzt werden können um das System zu gefährden.
Das Programm hat Dateien im Systemordner gespeichert.


*** Quarantäne ***

Folgende Dateien wurden in Quarantäne verschoben:
C:\Users\Carmen\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Windows\ERUNT\JRT\BCD
C:\Windows\ERUNT\JRT\DEFAULT
C:\Windows\ERUNT\JRT\SAM
C:\Windows\ERUNT\JRT\SECURITY
C:\Windows\ERUNT\JRT\SOFTWARE
C:\Windows\ERUNT\JRT\SYSTEM
C:\Windows\ERUNT\JRT\Users\00000001\NTUSER.DAT
c:\windows\erunt\jrt\bcd
c:\windows\erunt\jrt\default
c:\windows\erunt\jrt\sam
c:\windows\erunt\jrt\security
c:\windows\erunt\jrt\software
c:\windows\erunt\jrt\system
c:\windows\erunt\jrt\users\00000001\ntuser.dat

Folgende Registry Einträge wurden gelöscht:
\REGISTRY\MACHINE\SECURITY


YGLRttLAcnJycmJi0HLSctJiYuBycicnd2JicCp0ckInJyYGt3JycnJiYnAsJycnJyYGyHJycnJiYpApJwe5YtG2kpAsJwfsctJy0mJicKdycnB4cnJycmJicLhy0nLSYmJwmXJycnJiYnC6crFeY7ZycrFeY7ZyYmJwjnJyAAA
Version der Regeln: 4.6.9
OS: Windows 6.2 Service Pack 0.0 Build: 9200 - Workstation 64bit OS
Version der dll: 40166

"C:\Users\Carmen\AppData\Local\Temp\jrt\erunt\ERUNT.EXE" C:\windows\ERUNT\JRT /noconfirmdelete
MD5: 2E0323A94915FAAB10A25F3BABF82584
C:\windows\system32\cmd.exe /c ""C:\Users\Carmen\AppData\Local\Temp\jrt\get.bat" "
MD5:
         

MFG

Sebastian
__________________

Alt 17.11.2014, 10:19   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



GDATA ist doof.....



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 17.11.2014, 17:52   #5
Arni79
 
Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Guten Abend Schrauber,

habe nach deiner Anleitung alles gemacht .

Der Security Check alles perfekt gelaufen.

Beim ESET online Prüfung hat alles bis 30% geklappt. Dann Fehlermeldung von Laptop dieser muss neu gestartet werden.

Konnte noch ein Foto vom Fehler machen.

Es wurde auch eine Bedrohung bei 5 % schon gefunden.

Soll ich den Online Scanner noch einmal durch führen.

Hoffe Du erkennst etwas.

MFG Sebastian

Miniaturansicht angehängter Grafiken
-20141117_184001.jpg  

Alt 17.11.2014, 20:01   #6
Arni79
 
Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Icon17

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Hallo Schrauber ,

hier die Logs.



FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2014
Ran by Carmen (administrator) on SONNENKIND on 17-11-2014 20:45:59
Running from C:\Users\Carmen\Desktop
Loaded Profile: Carmen (Available profiles: Carmen)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AvkBap64.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\USB KEYBOARD GUARD\GD2NDKBB.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM-x32\...\Run: [ToshibaDynamicIconUtility] => C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [GDataUsbProtection] => C:\Program Files (x86)\G DATA\USB KEYBOARD GUARD\GD2NDKBB.exe [1412216 2014-09-05] (G Data Software AG)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,
HKU\S-1-5-21-2139123807-3068208427-1789639649-1001\...\MountPoints2: {8d2bce18-fd61-11e1-be6c-806e6f6e6963} - "D:\autorun.exe" /autorun

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2139123807-3068208427-1789639649-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2139123807-3068208427-1789639649-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM -> DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 -> {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKU\S-1-5-21-2139123807-3068208427-1789639649-1001 -> DefaultScope {5EF2DD34-5177-46ED-A8ED-4E91FE206385} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @java.com/DTPlugin,version=10.15.2 -> C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.15.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\searchplugins\google-maps.xml
FF Extension: WOT - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-12-18]
FF Extension: Disconnect - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\2.0@disconnect.me.xpi [2014-06-08]
FF Extension: Cliqz Beta - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\cliqz@cliqz.com.xpi [2014-11-16]
FF Extension: Google Disconnect - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\google@disconnect.me.xpi [2014-06-08]
FF Extension: Soundcloud SUPER +2: Downloader and Recommender - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{988da70d-b78d-44a1-a9c7-ed11832a9e2e}.xpi [2013-08-11]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-08-11]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome: 
=======
CHR Profile: C:\Users\Carmen\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2683760 2014-05-20] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1900400 2014-11-05] (Electronic Arts)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-06-13] (G Data Software AG)
R3 GDKBBlocker; C:\windows\system32\drivers\GDKBBlocker64.sys [30720 2014-09-22] (G Data Software AG)
R1 GDKBFlt; C:\windows\system32\drivers\GDKBFlt64.sys [20992 2014-11-13] (G Data Software AG)
R1 GDMnIcpt; C:\windows\system32\drivers\MiniIcpt.sys [142336 2014-09-22] (G Data Software AG)
R3 GDPkIcpt; C:\windows\system32\drivers\PktIcpt.sys [64000 2014-06-13] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [68608 2014-11-13] (G Data Software AG)
R1 GRD; C:\windows\system32\drivers\GRD.sys [106272 2014-06-13] (G Data Software)
R1 HookCentre; C:\windows\system32\drivers\HookCentre.sys [61440 2014-06-13] (G Data Software AG)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [89088 2012-07-26] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-17 20:45 - 2014-11-17 20:46 - 00014221 _____ () C:\Users\Carmen\Desktop\FRST.txt
2014-11-17 20:45 - 2014-11-17 20:45 - 00000000 ____D () C:\Users\Carmen\Desktop\FRST-OlderVersion
2014-11-17 18:51 - 2014-11-17 18:51 - 00280240 _____ () C:\windows\Minidump\111714-17500-01.dmp
2014-11-17 18:38 - 2014-11-17 18:38 - 00280240 _____ () C:\windows\Minidump\111714-21062-01.dmp
2014-11-17 17:49 - 2014-11-17 17:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-11-17 17:46 - 2014-11-17 17:46 - 00000814 _____ () C:\Users\Carmen\Desktop\checkup 17.11.14.txt
2014-11-17 17:34 - 2014-11-17 17:34 - 00854448 _____ () C:\Users\Carmen\Desktop\SecurityCheck.exe
2014-11-17 17:32 - 2014-11-17 17:33 - 02347384 _____ (ESET) C:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe
2014-11-16 18:49 - 2014-11-16 18:49 - 00000878 _____ () C:\Users\Carmen\Desktop\JRT.txt
2014-11-16 18:44 - 2014-11-16 18:44 - 00000000 ____D () C:\windows\ERUNT
2014-11-16 18:43 - 2014-11-16 18:43 - 00002528 _____ () C:\Users\Carmen\Desktop\AdwCleaner[S0].txt
2014-11-16 18:33 - 2014-11-16 18:39 - 00000000 ____D () C:\AdwCleaner
2014-11-16 18:32 - 2014-11-16 18:32 - 01707532 _____ (Thisisu) C:\Users\Carmen\Desktop\JRT.exe
2014-11-16 18:31 - 2014-11-16 18:31 - 02140160 _____ () C:\Users\Carmen\Desktop\AdwCleaner_4.101.exe
2014-11-16 16:19 - 2014-11-16 17:31 - 00007454 _____ () C:\Users\Carmen\Desktop\gmer.log
2014-11-16 16:00 - 2014-11-16 16:00 - 00380416 _____ () C:\Users\Carmen\Desktop\Gmer-19357.exe
2014-11-16 14:03 - 2014-11-16 15:58 - 00000472 _____ () C:\Users\Carmen\Desktop\defogger_disable.log
2014-11-16 14:03 - 2014-11-16 14:03 - 00000000 _____ () C:\Users\Carmen\defogger_reenable
2014-11-16 13:31 - 2014-11-17 18:54 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-16 13:31 - 2014-11-16 13:31 - 00001117 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-16 13:31 - 2014-11-16 13:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-11-16 13:31 - 2014-11-16 13:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-16 13:31 - 2014-11-16 13:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-11-16 13:31 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-11-16 13:31 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-11-16 13:31 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-11-16 13:19 - 2014-11-16 13:19 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Carmen\Desktop\mbam-setup-2.0.3.1025.exe
2014-11-16 12:44 - 2014-11-16 12:44 - 00050477 _____ () C:\Users\Carmen\Desktop\Defogger.exe
2014-11-16 11:19 - 2014-11-17 20:45 - 00000000 ____D () C:\Users\Carmen\Desktop\FRST&$ Log file
2014-11-14 13:37 - 2014-11-14 13:37 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\Cliqz
2014-11-14 13:37 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\windows\SysWOW64\dhRichClient3.dll
2014-11-14 13:37 - 2011-03-25 19:42 - 00338432 _____ () C:\windows\SysWOW64\sqlite36_engine.dll
2014-11-14 13:34 - 2014-11-14 13:34 - 01125200 _____ () C:\Users\Carmen\Downloads\Gmer-19357 - CHIP-Installer.exe
2014-11-14 13:21 - 2014-11-14 13:21 - 00380416 _____ () C:\Users\Carmen\Downloads\f81puu3t.exe
2014-11-14 13:09 - 2014-11-17 20:46 - 00000000 ____D () C:\FRST
2014-11-14 13:04 - 2014-11-17 20:45 - 02117120 _____ (Farbar) C:\Users\Carmen\Desktop\FRST64.exe
2014-11-13 23:32 - 2014-11-13 23:32 - 00000000 ____D () C:\Users\Carmen\AppData\Local\G DATA
2014-11-13 23:27 - 2014-11-13 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA INTERNET SECURITY
2014-11-13 20:00 - 2014-11-13 20:00 - 00000000 ____D () C:\Users\Carmen\AppData\Local\Adobe
2014-11-09 11:13 - 2014-11-09 11:13 - 00001162 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-11-09 11:11 - 2014-11-09 11:11 - 36855856 _____ () C:\Users\Carmen\Downloads\GMX_Firefox_Setup.exe
2014-10-26 18:55 - 2014-10-26 18:55 - 00000000 __SHD () C:\Recovery
2014-10-19 18:37 - 2014-10-25 16:53 - 00003136 _____ () C:\windows\comsetup.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-17 20:19 - 2013-03-10 19:53 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-17 20:02 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\sru
2014-11-17 19:19 - 2013-01-10 16:04 - 01999377 _____ () C:\windows\WindowsUpdate.log
2014-11-17 18:51 - 2013-01-21 13:13 - 00000000 ____D () C:\windows\Minidump
2014-11-17 18:51 - 2013-01-21 13:12 - 486710834 _____ () C:\windows\MEMORY.DMP
2014-11-17 18:51 - 2012-07-26 08:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-17 17:40 - 2012-08-01 17:38 - 00753134 _____ () C:\windows\system32\perfh007.dat
2014-11-17 17:40 - 2012-08-01 17:38 - 00155826 _____ () C:\windows\system32\perfc007.dat
2014-11-17 17:40 - 2012-07-26 08:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-16 21:03 - 2013-01-12 22:19 - 00000000 ____D () C:\ProgramData\Origin
2014-11-16 19:43 - 2013-01-12 22:19 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-11-16 18:41 - 2012-08-27 09:23 - 00292358 _____ () C:\windows\PFRO.log
2014-11-16 18:39 - 2013-01-10 16:03 - 00000000 ____D () C:\Users\Carmen
2014-11-16 18:12 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\rescache
2014-11-16 16:27 - 2014-03-01 17:51 - 00000000 ____D () C:\Users\Carmen\Documents\Handyrechnung
2014-11-16 13:55 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\System
2014-11-16 13:55 - 2012-07-26 06:26 - 01048576 ___SH () C:\windows\system32\config\BBI
2014-11-16 12:24 - 2013-07-08 17:16 - 00000000 ____D () C:\Users\Carmen\Desktop\Schmidt Schneider Sallmann
2014-11-16 12:24 - 2013-06-19 01:07 - 00000000 ____D () C:\Users\Carmen\Desktop\Bastian Handy
2014-11-16 12:22 - 2014-07-27 14:58 - 00000000 ____D () C:\Users\Carmen\Desktop\urlaub 12.07-26.07.14
2014-11-16 12:21 - 2013-12-26 16:25 - 00000000 ____D () C:\Users\Carmen\Desktop\WM 2014 7.1
2014-11-16 12:18 - 2013-05-24 20:53 - 00000000 ____D () C:\Users\Carmen\AppData\Roaming\vlc
2014-11-16 12:04 - 2014-07-27 14:35 - 00000000 ____D () C:\Users\Carmen\Desktop\Autos usw
2014-11-16 11:51 - 2013-06-22 14:39 - 00000000 ____D () C:\Users\Carmen\Desktop\usa 2013
2014-11-16 11:24 - 2014-10-04 14:17 - 00000000 ____D () C:\Users\Carmen\Desktop\USA 2011
2014-11-14 14:47 - 2013-01-12 22:39 - 00267243 _____ () C:\windows\DirectX.log
2014-11-13 23:29 - 2013-05-24 20:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-13 23:27 - 2014-09-22 18:38 - 00001989 _____ () C:\Users\Public\Desktop\G DATA INTERNET SECURITY.lnk
2014-11-13 23:27 - 2014-06-13 19:56 - 00020992 _____ (G Data Software AG) C:\windows\system32\Drivers\GDKBFlt64.sys
2014-11-13 23:27 - 2013-01-15 21:30 - 00068608 _____ (G Data Software AG) C:\windows\system32\Drivers\gdwfpcd64.sys
2014-11-13 20:00 - 2013-03-10 19:53 - 00003772 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-11-09 11:13 - 2013-03-10 17:14 - 00001174 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-09 11:12 - 2014-10-14 20:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-05 13:52 - 2014-05-15 19:57 - 00000000 ____D () C:\Users\Carmen\Documents\FIFA 14
2014-11-05 12:53 - 2013-01-12 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2014-10-26 18:17 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2014-10-26 17:56 - 2014-09-24 16:19 - 00000000 ___HD () C:\$Windows.~BT
2014-10-25 17:00 - 2014-10-12 17:47 - 00047628 _____ () C:\windows\diagwrn.xml
2014-10-25 17:00 - 2014-10-12 17:47 - 00047628 _____ () C:\windows\diagerr.xml
2014-10-25 17:00 - 2012-07-26 08:21 - 00813344 _____ () C:\windows\setupact.log
2014-10-25 16:58 - 2012-07-26 09:13 - 00004323 _____ () C:\windows\DtcInstall.log
2014-10-25 16:53 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\Registration
2014-10-19 18:44 - 2012-07-26 06:26 - 00262144 ___SH () C:\windows\system32\config\ELAM
2014-10-19 18:13 - 2014-09-17 17:03 - 00281784 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-19 18:10 - 2012-07-26 09:12 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

Some content of TEMP:
====================
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll
C:\Users\Carmen\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Carmen\AppData\Local\Temp\Quarantine.exe
C:\Users\Carmen\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-14 12:55

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2014
Ran by Carmen at 2014-11-17 20:46:47
Running from C:\Users\Carmen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G DATA INTERNET SECURITY (Disabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: G DATA INTERNET SECURITY (Disabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G DATA Personal Firewall (Disabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
AMD Catalyst Install Manager (HKLM\...\{95EF3DDB-27C8-CDA9-9E72-5EC3F02C1B02}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Atheros Bluetooth Filter Driver Package (HKLM\...\{026B819B-4D60-4C8B-892D-33A0D8666F60}) (Version: 2.0.0.2 - Atheros Communications)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.6 - Atheros Communications Inc.)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
EA Sports FIFA World (HKLM-x32\...\{8F9AC744-EEF6-43DB-A4B6-FA1A18F1C640}) (Version: 7.1.0.50515 - Electronic Arts, Inc.)
EA SPORTS™ FIFA 15 (HKLM-x32\...\{3D4ADA2B-F028-4307-ADF4-6F9AA44725DA}) (Version: 1.3.0.0 - Electronic Arts)
EA SPORTS™ FIFA 15 Demo (HKLM-x32\...\{108C0C19-6316-4944-A62F-C744488F8639}) (Version: 1.0.0.0 - Electronic Arts)
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.0.0.0 - Electronic Arts)
FIFA 14 (HKLM-x32\...\{AA7A2800-1E75-4240-855B-03AFF8E5171E}) (Version: 1.0.0.7 - Electronic Arts)
Free YouTube to MP3 Converter version 3.12.17.1125 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.17.1125 - DVDVideoSoft Ltd.)
Free YouTube Uploader version 4.0.16.623 (HKLM-x32\...\Free YouTube Uploader_is1) (Version: 4.0.16.623 - DVDVideoSoft Ltd.)
G DATA INTERNET SECURITY (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.2.3 - G DATA Software AG)
G DATA USB KEYBOARD GUARD (HKLM-x32\...\{D8CBD59F-B29D-4E38-9D66-DEAEAB473FA9}) (Version: 1.1.0.4 - G DATA Software AG)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 7 Update 15 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417015FF}) (Version: 7.0.150 - Oracle)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Mozilla Firefox 33.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 de)) (Version: 33.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
Need for Speed™ The Run (HKLM-x32\...\{0EDC9BA0-016E-406a-86DA-04FC1BE00C21}) (Version: 1.1.0.0 - Electronic Arts)
Nero 12 Essentials Toshiba (HKLM-x32\...\{BA8958DC-ADD7-41E5-8436-5883C7E871C7}) (Version: 12.0.00400 - Nero AG)
Origin (HKLM-x32\...\Origin) (Version: 9.0.10.69 - Electronic Arts, Inc.)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6873 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.5 - Synaptics Incorporated)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.0007.00002 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425.01 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\{B1786E63-2127-42C9-95A3-146E5F727BF1}) (Version: v1.0.0.8 - TOSHIBA Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
Toshiba Places Icon Utility (HKLM\...\{C991A8C4-307C-4FDD-8AAE-A1BF44881E95}) (Version: 2.1.1 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.5.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden
WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.37 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2139123807-3068208427-1789639649-1001_Classes\CLSID\{00000001-0E3A-4123-8B32-4B68A91E104A}\InprocServer32 -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIBasePlace.dll (Toshiba Corporation)

==================== Restore Points  =========================

26-10-2014 17:15:53 Windows Modules Installer
05-11-2014 12:16:03 DirectX wurde installiert
14-11-2014 13:45:11 DirectX wurde installiert

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2AE1CC12-AACE-4ABA-8E3B-E31317D0F357} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-18] (Toshiba Europe GmbH)
Task: {40327C81-48D8-4E41-BC35-4DEDE666D230} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-13] (Adobe Systems Incorporated)
Task: {53026DF3-7AF4-4B11-BE87-F5BD2CE06FAF} - System32\Tasks\Microsoft\Windows\Setup\8.1 auto install => C:\windows\system32\NotificationUI.exe [2014-08-21] (Microsoft Corporation)
Task: {56FD992B-0075-4765-B37B-CDFB869DA3F9} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-16] (Synaptics Incorporated)
Task: {F68B2A81-AF4B-4BC8-BBE9-127E99727B28} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-05-20 02:38 - 2014-05-20 02:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 02:38 - 2012-07-19 02:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 03:13 - 2012-08-14 03:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2014-11-16 16:11 - 2014-11-16 16:11 - 01179136 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.UI\2d56f4ed6abbf10d0fca06ab4fbfecc4\Windows.UI.ni.dll
2014-11-16 16:12 - 2014-11-16 16:12 - 00351232 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Data\5302e6ae12e0961cb58608b91c09e016\Windows.Data.ni.dll
2014-11-04 20:20 - 2014-11-04 20:20 - 00295936 _____ () C:\windows\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\19b3a0667450d039aa3ebef43d489fe7\Windows.Foundation.ni.dll
2012-08-08 18:22 - 2012-08-08 18:22 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-09-13 06:19 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "Toshiba TEMPRO"
HKLM\...\StartupApproved\Run: => "TosWaitSrv"
HKLM\...\StartupApproved\Run32: => "Intel AppUp(SM) center"
HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"

========================= Accounts: ==========================

Administrator (S-1-5-21-2139123807-3068208427-1789639649-500 - Administrator - Disabled)
Carmen (S-1-5-21-2139123807-3068208427-1789639649-1001 - Administrator - Enabled) => C:\Users\Carmen
Gast (S-1-5-21-2139123807-3068208427-1789639649-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/17/2014 07:01:01 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 07:00:58 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 06:54:36 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 06:41:32 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 05:49:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 05:49:09 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 05:49:03 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 05:49:03 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.

Error: (11/17/2014 05:33:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.


System errors:
=============
Error: (11/17/2014 06:51:43 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x000000d1 (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xfffff88005715d7c)C:\windows\MEMORY.DMP111714-17500-01

Error: (11/17/2014 06:51:37 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎17.‎11.‎2014 um 18:38:34 unerwartet heruntergefahren.

Error: (11/17/2014 06:38:39 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x000000d1 (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xfffff880049bed7c)C:\windows\MEMORY.DMP111714-21062-01

Error: (11/17/2014 06:38:34 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎17.‎11.‎2014 um 18:35:23 unerwartet heruntergefahren.


Microsoft Office Sessions:
=========================
Error: (11/17/2014 07:01:01 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 07:00:58 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 06:54:36 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 06:41:32 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 05:49:12 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 05:49:09 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 05:49:03 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 05:49:03 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe

Error: (11/17/2014 05:33:29 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifestC:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Percentage of memory in use: 17%
Total physical RAM: 8144.22 MB
Available physical RAM: 6749.71 MB
Total Pagefile: 16336.22 MB
Available Pagefile: 14394.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (TI30961600B) (Fixed) (Total:585.74 GB) (Free:369.05 GB) NTFS
Drive e: (HDDRIVE2GO) (Fixed) (Total:1863.01 GB) (Free:1617.77 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596.2 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 54071036)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.89  
   x64 (UAC is enabled)  
 Internet Explorer 10 Out of date! 
``````````````Antivirus/Firewall Check:`````````````` 
G DATA INTERNET SECURITY   
Windows Defender           
 Antivirus out of date!  
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 	15.0.0.223  
 Mozilla Firefox (33.0) 
````````Process Check: objlist.exe by Laurent````````  
 G Data InternetSecurity Firewall GDFwSvcx64.exe 
 G Data InternetSecurity Firewall GDFirewallTray.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=421191481272a94985e4ac395d87b55a
# engine=21131
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-11-17 07:40:51
# local_time=2014-11-17 08:40:51 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 15808859 75759362 0 0
# scanned=267457
# found=6
# cleaned=0
# scan_time=5772
sh=67D59D15A734F2B41373F1CAF8347D199215D42C ft=1 fh=86e026dc2bf78850 vn="Variante von Win32/Mobogenie.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mobogenie\New_UpdateMoboGenie.exe.vir"
sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carmen\AppData\Local\Temp\252712421.Uninstall\uninstaller.exe"
sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carmen\AppData\Local\Temp\252793125.Uninstall\uninstaller.exe"
sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carmen\AppData\Local\Temp\252817781.Uninstall\uninstaller.exe"
sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carmen\AppData\Local\Temp\252890500.Uninstall\uninstaller.exe"
sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Carmen\AppData\Local\Temp\is357113909\251524365_stp\uninstaller.exe"
         


Ich hoffe das ich alles jetzt habe.

Mit Freundlichen Grüßen

Sebastian

Alt 18.11.2014, 11:41   #7
schrauber
/// the machine
/// TB-Ausbilder
 

Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
FF Extension: Disconnect - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\2.0@disconnect.me.xpi [2014-06-08]
FF Extension: Cliqz Beta - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\cliqz@cliqz.com.xpi [2014-11-16]
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.





Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 18.11.2014, 18:34   #8
Arni79
 
Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Hallo und guten Abend lieber Schrauber,

erst einmal vielen vielen Dank für dein Ausführliche Erklärung und vor allem für deine Zeit.����

Ich werde den Leptop von Carmen gleich an mich reißen und mit dem von Dir gestellten Aufgaben beginnen.

Meine Freundin fragt ob es wirklich was gefährliches war auf dem Rechner. ?

Die Programme wie Skript , AdBlock Plus und Wot hab ich im Firefox installiert. Auch am großen Gamer PC laufen diese Programme schon seit 3 Jahren.

Ich melde mich sobald alles erledigt wurde.

Bis dahin. Liebe Grüße aus Thüringen.

Hi Schrauber ,

hier die Benötigte File

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-11-2014
Ran by Carmen at 2014-11-18 19:11:14 Run:1
Running from C:\Users\Carmen\Desktop
Loaded Profile: Carmen (Available profiles: Carmen)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF Extension: Disconnect - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\2.0@disconnect.me.xpi [2014-06-08]
FF Extension: Cliqz Beta - C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\cliqz@cliqz.com.xpi [2014-11-16]
Emptytemp:
         
*****************

C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\2.0@disconnect.me.xpi => Moved successfully.
C:\Users\Carmen\AppData\Roaming\Mozilla\Firefox\Profiles\8ikkmaam.default\Extensions\cliqz@cliqz.com.xpi => Moved successfully.
EmptyTemp: => Removed 2.7 GB temporary data.


The system needed a reboot. 

==== End of Fixlog ====
         
alle Wech?



MFG

Sebastian

Alt 19.11.2014, 16:26   #9
schrauber
/// the machine
/// TB-Ausbilder
 

Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Alles gut, da war überwiegend nur Adware
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 19.11.2014, 19:16   #10
Arni79
 
Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Guten Abend Schrauber.


Habe die Löschung heute erletigt.

Das DelFix hab ich laufen lassen.

Code:
ATTFilter
# DelFix v10.8 - Datei am 19/11/2014 um 19:53:26 erstellt
# Aktualisiert am 29/07/2014 von Xplode
# Benutzer : Carmen - SONNENKIND
# Betriebssystem : Windows 8  (64 bits)

~ Aktiviere die Benutzerkontensteuerung ... OK

~ Entferne die Bereinigungsprogramme ...

Gelöscht : C:\FRST
Gelöscht : C:\AdwCleaner
Gelöscht : C:\Users\Carmen\Desktop\FRST-OlderVersion
Gelöscht : C:\TDSSKiller.2.8.16.0_14.08.2013_16.22.26_log.txt
Gelöscht : C:\TDSSKiller.3.0.0.19_05.12.2013_16.44.58_log.txt
Gelöscht : C:\Users\Carmen\Desktop\Addition.txt
Gelöscht : C:\Users\Carmen\Desktop\AdwCleaner[S0].txt
Gelöscht : C:\Users\Carmen\Desktop\AdwCleaner_4.101.exe
Gelöscht : C:\Users\Carmen\Desktop\Defogger.exe
Gelöscht : C:\Users\Carmen\Desktop\defogger_disable.log
Gelöscht : C:\Users\Carmen\Desktop\defogger_enable.log
Gelöscht : C:\Users\Carmen\Desktop\esetsmartinstaller_deu.exe
Gelöscht : C:\Users\Carmen\Desktop\Fixlog.txt
Gelöscht : C:\Users\Carmen\Desktop\FRST.txt
Gelöscht : C:\Users\Carmen\Desktop\FRST64.exe
Gelöscht : C:\Users\Carmen\Desktop\JRT.exe
Gelöscht : C:\Users\Carmen\Desktop\JRT.txt
Gelöscht : C:\Users\Carmen\Desktop\SecurityCheck.exe
Gelöscht : C:\Users\Carmen\Desktop\TFC.exe
Gelöscht : C:\Users\Carmen\Downloads\aswMBR.exe
Gelöscht : C:\Users\Carmen\Downloads\tdsskiller.exe
Gelöscht : HKLM\SOFTWARE\OldTimer Tools
Gelöscht : HKLM\SOFTWARE\AdwCleaner

~ Erstelle ein Backup der Registrierungsdatenbank ... OK

~ Lösche die Wiederherstellungspunkte ...

Gelöscht : RP #81 [Windows Modules Installer | 10/26/2014 17:15:53]
Gelöscht : RP #82 [DirectX wurde installiert | 11/05/2014 12:16:03]
Gelöscht : RP #83 [DirectX wurde installiert | 11/14/2014 13:45:11]
Gelöscht : RP #84 [Windows Update | 11/18/2014 17:13:43]

Ein neuer Wiederherstellungspunkt wurde erstellt !

~ Stelle die Systemeinstellungen wieder her ... OK

########## - EOF - ##########
         
der Laptop funzt jetzt gefühlt schneller.
Keine Probleme mehr .

Vielen Dank für deine Hilfe von uns Beiden.

Vielen Dannnnnnnnnnnnk

Der Thread kann geschlossen werden:

Geändert von Arni79 (19.11.2014 um 19:34 Uhr)

Alt 20.11.2014, 15:36   #11
schrauber
/// the machine
/// TB-Ausbilder
 

Win 8 64bit  Laptop öffnet  3-4 Fenster im FireFox und der Mauszeiger  bewegt sich von allein. - Standard

Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.
bluescreen 0x000000d1, device driver, downloader, dvdvideosoft ltd., fehlercode 0xc0000005, fehlercode 0xc0000374, fehlercode windows, firefox, flash player, gmx.net, homepage, installation, internet explorer, mobogenie, mobogenie entfernen, prozess, pup.optional.installcore.a, pup.optional.mysearch.a, pup.optional.mysearchdial.a, pup.optional.myspeeddial.a, services.exe, super, svchost.exe, system, usb, win32/installcore.az, win32/mobogenie.a



Ähnliche Themen: Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein.


  1. [Windows 7 64Bit] Maus bleibt hängen und bewegt sich dann nur noch stockend
    Plagegeister aller Art und deren Bekämpfung - 27.06.2015 (8)
  2. Mauszeiger bewegt sich selbstständig, Sound "knistert"
    Log-Analyse und Auswertung - 10.01.2015 (16)
  3. Mauszeiger bewegt sich von alleine und betätigt Lautstärkenregler
    Log-Analyse und Auswertung - 22.09.2014 (13)
  4. windows 7 Firefox: My search öffnet sich als Fenster
    Log-Analyse und Auswertung - 09.09.2014 (7)
  5. zusätzliche Browser-Fenster öffnen sich von allein (Chrome/Firefox)
    Plagegeister aller Art und deren Bekämpfung - 10.03.2014 (3)
  6. Zweites Fenster öffnet sich bei Firefox -appround.biz-Was ist das?
    Plagegeister aller Art und deren Bekämpfung - 29.03.2013 (7)
  7. Ein Neues Fenster öffnet sich bei Firefox
    Log-Analyse und Auswertung - 21.02.2013 (17)
  8. In Firefox öffnet sich neues Fenster ( mit Wikipedia )
    Log-Analyse und Auswertung - 08.02.2013 (13)
  9. Maus Bewegt sich von allein,Game einfach gelöscht vom Rechner, Remote war Aktiv
    Plagegeister aller Art und deren Bekämpfung - 04.12.2012 (5)
  10. Laptop-Maus bewegt sich und klickt Wild um sich. Bildschirm dreht sich um 90 Grad.
    Plagegeister aller Art und deren Bekämpfung - 26.11.2012 (14)
  11. Mauszeiger bewegt sich Online
    Plagegeister aller Art und deren Bekämpfung - 03.11.2012 (1)
  12. Firefox bewegt sich& spielt Musik
    Plagegeister aller Art und deren Bekämpfung - 25.09.2011 (1)
  13. Internet Explorer öffnet sich von allein, ebenso Fenster mit Werbung
    Log-Analyse und Auswertung - 04.05.2010 (4)
  14. Editor Fenster öffnet sich aller 2 min von allein!
    Plagegeister aller Art und deren Bekämpfung - 01.11.2009 (9)
  15. Mauszeiger bewegt sich alleine und stratet Programme, fährt Rechner runter usw
    Plagegeister aller Art und deren Bekämpfung - 16.10.2007 (3)
  16. Mein Mauszeiger bewegt sich selbstständig
    Log-Analyse und Auswertung - 15.02.2007 (7)
  17. Mein Mauszeiger bewegt sich selbstständig und klickt programme an.
    Mülltonne - 25.02.2006 (1)

Zum Thema Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein. - Hallo liebe Community. Meiner Freundin ihr Laptop Toshiba Satellite mit Win 8 64bit I5 macht Ärger. Laptop öffnet im Firefox gleich 3-4 Fenster. Dann soll sich der Mauszeiger von allein - Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein....
Archiv
Du betrachtest: Win 8 64bit Laptop öffnet 3-4 Fenster im FireFox und der Mauszeiger bewegt sich von allein. auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.