Mozilla Firefox Rechner arbeitet und Popups gehen auf

andi65 · 01.12.2014, 18:23

Hallo,

ich bemerke seit Tagen, immer wenn ich Mozilla Firefox öffne,
dass der Rechner ohne ende arbeitet und es gehen ständig Werbefenster auf.

Das Programm Malwarebyte hat was gefunden hat aber nicht gebracht.
Den Adwcleaner hat meine Firewall zum schluss blockiert, angeblich ist es ein
Gefährliches Schadprogramm

Wehm soll ich jetzt glauben ?
Hätte ich es zulassen können?

Auf jedenfall hab ich dann noch AD Adware Antivirus schauen lassen, auch der hat etwas gefunden und entfernt.

Es hat alles nicht gebracht, Popups trotz installierte Blocker immer noch auf und der Rechner
arbeitet immer solange, bis ich Firefox wieder schließe.

Was soll ich noch machen ?
Bitte um Hilfe.

Danke Gruß Andi

schrauber · 01.12.2014, 18:26

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

andi65 · 01.12.2014, 19:46

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-12-2014
Ran by keiner (administrator) on KEINER-PC on 01-12-2014 19:41:16
Running from C:\Users\keiner\Downloads
Loaded Profile: keiner (Available profiles: keiner)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files\G Data\TotalProtection\AVK\AVKWCtl.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(G Data Software AG) C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files\G Data\TotalProtection\AVK\AVKService.exe
(G Data Software AG) C:\Program Files\G Data\TotalProtection\AVKBackup\AVKBackupService.exe
(Hewlett-Packard Company) C:\Program Files\HP\Common\HPSupportSolutionsFrameworkService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(G Data Software AG) C:\Program Files\G Data\TotalProtection\Firewall\GDFwSvc.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(G Data Software AG) C:\Program Files\G Data\TotalProtection\AVKTray\AVKTray.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(G Data Software AG) C:\Program Files\G Data\TotalProtection\Firewall\GDFirewallTray.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 276dw MFP\Bin\ScanToPCActivationApp.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 276dw MFP\Bin\HPNetworkCommunicatorCom.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.3.124.0\SeaPort.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTray.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-12] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [NWEReboot] => [X]
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [G Data AntiVirus Tray] => C:\Program Files\G Data\TotalProtection\AVKTray\AVKTray.exe [1444472 2013-08-21] (G Data Software AG)
HKLM\...\Run: [GDFirewallTray] => C:\Program Files\G Data\TotalProtection\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTray.exe [7670592 2014-10-15] ()
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files\g data\totalprotection\avkkid\avkcks.exe,
HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\...\Run: [HP Officejet Pro 276dw MFP (NET)] => C:\Program Files\HP\HP Officejet Pro 276dw MFP\Bin\ScanToPCActivationApp.exe [2427400 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\...\MountPoints2: {8c1d28e3-1973-11e4-a5c4-806e6f6e6963} - "D:\Install Navigator.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x0D474CC617EDCE01
HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = 
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @google.com/sewebplugin -> C:\Windows\system32\npsewebplugin.dll ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\searchplugins\google-maps.xml
FF Extension: Adblock Plus Pop-up Addon - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-12-01]
FF Extension: Cliqz Beta - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\Extensions\cliqz@cliqz.com.xpi [2014-10-08]
FF Extension: Web-to-Save - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\Extensions\info@webtosave.com.xpi [2014-11-28]
FF Extension: Newtab for Firefox - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\Extensions\{be6c0165-cfa5-4864-adec-0e4fcad222a6}.xpi [2014-11-27]
FF Extension: Adblock Plus - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-12-01]
FF Extension: Search Tool - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\Extensions\{de1be284-67f6-4b2b-90e0-b38fb4af2ae1}.xpi [2014-11-24]
FF Extension: Suche SD - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\Extensions\{fa2d6af7-0818-4168-aab2-41ca9ed02a61}.xpi [2014-08-19]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-07-27]
FF HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-1307861164-1411102128-3161447057-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\keiner\AppData\Roaming\Mozilla\Firefox\Profiles\chpb8xwh.default\extensions\cliqz@cliqz.com

Chrome: 
=======
CHR Profile: C:\Users\keiner\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\keiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-06]
CHR Extension: (Google Drive) - C:\Users\keiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-06]
CHR Extension: (YouTube) - C:\Users\keiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-06]
CHR Extension: (Google Search) - C:\Users\keiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-06]
CHR Extension: (Google Wallet) - C:\Users\keiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-06]
CHR Extension: (Google Mail) - C:\Users\keiner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe [1970296 2013-08-26] (G Data Software AG)
R2 AVKService; C:\Program Files\G Data\TotalProtection\AVK\AVKService.exe [635000 2013-08-21] (G Data Software AG)
R2 AVKWCtl; C:\Program Files\G Data\TotalProtection\AVK\AVKWCtl.exe [2095600 2013-08-21] (G Data Software AG)
R2 GDBackupSvc; C:\Program Files\G Data\TotalProtection\AVKBackup\AVKBackupService.exe [1947768 2013-08-21] (G Data Software AG)
R3 GDFwSvc; C:\Program Files\G Data\TotalProtection\Firewall\GDFwSvc.exe [2369616 2013-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files\Common Files\G Data\GDScan\GDScan.exe [695416 2013-08-22] (G Data Software AG)
S3 GDTunerSvc; C:\Program Files\G Data\TotalProtection\AVKTuner\AVKTunerService.exe [1711568 2013-02-25] (G Data Software AG)
R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hp\Common\HPSupportSolutionsFrameworkService.exe [72992 2014-07-07] (Hewlett-Packard Company)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe [656376 2014-10-15] ()
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [45568 2013-05-16] (Hewlett-Packard) [File not signed]
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1335344 2014-01-23] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [856112 2014-01-23] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [55808 2013-05-16] (Hewlett-Packard) [File not signed]
S3 TSNxGService; C:\Program Files\G Data\TotalProtection\TSNxG\TSNxGService.exe [257512 2013-02-25] (G Data Software)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [45912 2013-12-06] (G Data Software AG)
R3 gddcd; C:\Windows\system32\drivers\gddcd32.sys [70488 2013-12-06] (G Data Software AG)
R1 gddcv; C:\Windows\system32\drivers\gddcv32.sys [53208 2013-12-06] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [96600 2013-12-06] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [52056 2013-12-06] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd32.sys [54104 2013-12-06] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [30040 2013-12-06] (G Data Software)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [676864 2004-07-14] (Aladdin Knowledge Systems)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [51032 2013-12-06] (G Data Software AG)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [14848 2010-06-19] (Siliten)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [360376 2014-07-10] (BitDefender S.R.L.)
R0 TS4NT; C:\Windows\System32\Drivers\TS4nt.sys [103928 2013-12-06] (G Data Software)
R3 vpcbus; C:\Windows\System32\DRIVERS\vpchbus.sys [172416 2010-11-20] (Microsoft Corporation)
R1 vpcnfltr; C:\Windows\System32\DRIVERS\vpcnfltr.sys [48128 2010-11-20] (Microsoft Corporation)
R3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [78336 2010-11-20] (Microsoft Corporation)
R1 vpcvmm; C:\Windows\System32\drivers\vpcvmm.sys [296064 2010-11-20] (Microsoft Corporation)
S0 jbdvxm; No ImagePath

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-01 19:41 - 2014-12-01 19:42 - 00014191 _____ () C:\Users\keiner\Downloads\FRST.txt
2014-12-01 19:39 - 2014-12-01 19:41 - 00000000 ____D () C:\FRST
2014-12-01 19:37 - 2014-12-01 19:37 - 01109504 _____ (Farbar) C:\Users\keiner\Downloads\FRST.exe
2014-12-01 15:37 - 2014-12-01 15:37 - 00000000 ____D () C:\Users\keiner\AppData\Roaming\LavasoftStatistics
2014-12-01 15:36 - 2014-12-01 15:37 - 00002305 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-12-01 15:36 - 2014-12-01 15:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2014-12-01 15:36 - 2014-12-01 15:36 - 00000000 ____D () C:\Program Files\Lavasoft
2014-12-01 15:35 - 2014-12-01 15:35 - 00000000 ____D () C:\Users\keiner\AppData\Roaming\Lavasoft
2014-12-01 15:34 - 2014-12-01 15:34 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-12-01 15:34 - 2014-12-01 15:34 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-12-01 14:52 - 2014-12-01 15:13 - 00000000 ____D () C:\AdwCleaner
2014-12-01 13:14 - 2014-12-01 15:08 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-01 13:14 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-01 13:14 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-01 13:14 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-01 13:13 - 2014-12-01 13:13 - 01174352 _____ () C:\Users\keiner\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-12-01 13:10 - 2014-12-01 13:10 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-12-01 13:10 - 2014-12-01 13:10 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-12-01 13:06 - 2014-12-01 13:06 - 00106914 _____ () C:\bookmarks.html
2014-12-01 13:06 - 2014-12-01 13:06 - 00057578 _____ () C:\bookmarks-2014-12-01.json
2014-12-01 10:06 - 2014-12-01 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-01 10:06 - 2014-12-01 15:08 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-12-01 10:00 - 2014-12-01 10:00 - 00880784 _____ (Google Inc.) C:\Users\keiner\Downloads\ChromeSetup(1).exe
2014-12-01 09:56 - 2014-12-01 09:58 - 42183760 _____ (Google Inc.) C:\Users\keiner\Downloads\ChromeStandaloneSetup.exe
2014-12-01 09:51 - 2014-12-01 09:51 - 00825264 _____ ( ) C:\Users\keiner\Downloads\google-chrome_setup.exe
2014-12-01 09:51 - 2014-12-01 09:51 - 00784840 _____ (Google Inc.) C:\Users\keiner\Downloads\google-chrome.exe
2014-11-28 15:28 - 2014-11-28 15:29 - 00000000 ____D () C:\Program Files\phase5
2014-11-28 15:28 - 2014-11-28 15:28 - 00000955 _____ () C:\Users\keiner\Desktop\HTML Editor.lnk
2014-11-28 15:28 - 2014-11-28 15:28 - 00000000 ____D () C:\Users\keiner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Phase 5 HTML-Editor
2014-11-28 15:25 - 2014-11-28 15:25 - 01174352 _____ () C:\Users\keiner\Downloads\HTML Editor Phase - CHIP-Installer.exe
2014-11-27 09:27 - 2014-11-28 15:19 - 00000000 ____D () C:\Users\keiner\Downloads\INSTAR_HD_Video_in_Website
2014-11-27 09:27 - 2014-11-28 14:57 - 01169773 _____ () C:\Users\keiner\Downloads\INSTAR_HD_Video_in_Website.zip
2014-11-27 09:15 - 2014-11-27 14:33 - 00000031 _____ () C:\Windows\WebConfig.ini
2014-11-27 09:15 - 2014-11-27 09:15 - 00716789 _____ () C:\Windows\system32\unins000.exe
2014-11-27 09:15 - 2014-11-27 09:15 - 00001384 _____ () C:\Windows\system32\unins000.dat
2014-11-27 09:15 - 2013-07-12 16:15 - 00188416 _____ () C:\Windows\system32\SEWebClientPlus.ocx
2014-11-27 09:15 - 2013-07-10 17:23 - 00217600 _____ () C:\Windows\system32\npsewebplugin.dll
2014-11-27 09:15 - 2013-07-02 15:02 - 00053248 _____ () C:\Windows\system32\SESDKPlus.dll
2014-11-27 09:15 - 2013-06-27 11:02 - 00323584 _____ () C:\Windows\system32\SEPlayerPlus.exe
2014-11-27 09:15 - 2013-06-27 10:58 - 00442368 _____ () C:\Windows\system32\SEPlayerPlus.dll
2014-11-27 09:15 - 2013-06-27 10:57 - 00212992 _____ () C:\Windows\system32\SENetLibPlus.dll
2014-11-27 09:15 - 2012-12-01 17:22 - 00057344 _____ (微软中国) C:\Windows\system32\SESearchLib.dll
2014-11-27 09:15 - 2012-09-25 21:39 - 02555406 _____ () C:\Windows\system32\avcodec-54.dll
2014-11-27 09:15 - 2012-09-25 21:39 - 00157198 _____ () C:\Windows\system32\avutil-51.dll
2014-11-27 09:15 - 2010-08-23 20:07 - 00562220 _____ () C:\Windows\system32\SEAlarmSound.wav
2014-11-27 09:05 - 2014-11-27 09:05 - 04972848 _____ (TeamViewer) C:\Users\keiner\Downloads\TeamViewerQS_de-idcyq3xf45(1).exe
2014-11-27 09:05 - 2014-11-27 09:05 - 00000000 ____D () C:\Users\keiner\AppData\Roaming\TeamViewer
2014-11-27 09:03 - 2014-11-27 09:03 - 04972848 _____ (TeamViewer) C:\Users\keiner\Downloads\TeamViewerQS_de-idcyq3xf45.exe
2014-11-26 19:00 - 2014-11-26 19:00 - 00003022 _____ () C:\Windows\avmadd32.log
2014-11-26 19:00 - 2014-11-26 19:00 - 00002538 _____ () C:\Windows\avmadd321.log
2014-11-26 19:00 - 2014-11-26 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Box
2014-11-26 19:00 - 2014-11-26 19:00 - 00000000 ____D () C:\Program Files\FRITZ!BoxPrint
2014-11-26 19:00 - 2014-11-26 19:00 - 00000000 ____D () C:\Program Files\FRITZ!Box
2014-11-26 19:00 - 2006-12-14 13:42 - 00069120 ____R (AVM Berlin) C:\Windows\system32\avmadd32.dll
2014-11-26 19:00 - 2006-05-29 02:00 - 00016384 ____R (AVM Berlin GmbH) C:\Windows\system32\avmprmon.dll
2014-11-26 15:21 - 2014-11-26 15:21 - 00000000 ____D () C:\Users\keiner\AppData\Roaming\Apple Computer
2014-11-26 14:34 - 2014-11-26 14:34 - 00000000 ____D () C:\Users\keiner\AppData\Local\Apple Computer
2014-11-26 14:17 - 2014-11-26 14:17 - 00001815 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-11-26 14:16 - 2014-11-26 14:19 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-11-26 14:16 - 2014-11-26 14:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-11-26 14:16 - 2014-11-26 14:17 - 00000000 ____D () C:\Program Files\QuickTime
2014-11-26 14:16 - 2014-11-26 14:16 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-11-26 14:15 - 2014-11-26 14:15 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-11-26 14:15 - 2014-11-26 14:15 - 00000000 ____D () C:\Users\keiner\AppData\Local\Apple
2014-11-26 14:15 - 2014-11-26 14:15 - 00000000 ____D () C:\ProgramData\Apple
2014-11-26 14:15 - 2014-11-26 14:15 - 00000000 ____D () C:\Program Files\Apple Software Update
2014-11-26 14:14 - 2014-11-26 14:15 - 42096984 _____ (Apple Inc.) C:\Users\keiner\Downloads\QuickTimeInstaller.exe
2014-11-26 13:52 - 2014-11-26 13:52 - 00002573 _____ () C:\Users\Public\Desktop\INSTAR Camera Tool.lnk
2014-11-26 13:52 - 2014-11-26 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\INSTAR
2014-11-26 13:52 - 2014-11-26 13:52 - 00000000 ____D () C:\Program Files\INSTAR
2014-11-26 13:41 - 2014-11-26 13:41 - 00000000 ____D () C:\Users\keiner\AppData\Roaming\Cliqz
2014-11-26 13:41 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\system32\dhRichClient3.dll
2014-11-26 13:41 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\system32\sqlite36_engine.dll
2014-11-26 13:40 - 2014-11-26 13:40 - 01169232 _____ () C:\Users\keiner\Downloads\Microsoft NET Framework 4 5 2 - CHIP-Installer.exe
2014-11-26 13:38 - 2014-11-26 13:38 - 00000000 ____D () C:\Users\keiner\AppData\Local\Downloaded Installations
2014-11-26 13:37 - 2014-11-26 13:37 - 01848125 _____ () C:\Users\keiner\Downloads\INSTAR_Camera_Tool_2.0.2_DE.exe
2014-11-25 13:04 - 2014-11-25 13:06 - 237965560 _____ (G Data Software AG) C:\Users\keiner\Downloads\INT_R_BASE_2015_TP.exe
2014-11-25 11:39 - 2014-11-25 11:39 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\keiner\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-10 16:30 - 2014-12-01 13:10 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-01 19:16 - 2009-07-14 05:34 - 00020864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-01 19:16 - 2009-07-14 05:34 - 00020864 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-01 19:13 - 2013-11-29 15:59 - 02080026 _____ () C:\Windows\WindowsUpdate.log
2014-12-01 19:08 - 2013-12-05 17:56 - 00000000 ____D () C:\WSB-Finanzdienste
2014-12-01 15:16 - 2010-11-20 22:48 - 00140746 _____ () C:\Windows\PFRO.log
2014-12-01 15:16 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-01 15:16 - 2009-07-14 05:39 - 00050379 _____ () C:\Windows\setupact.log
2014-12-01 15:08 - 2013-12-06 15:28 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-01 13:32 - 2013-11-29 16:37 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-01 13:32 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Cursors
2014-12-01 13:07 - 2013-12-06 13:31 - 00000000 ____D () C:\Program Files\Google
2014-12-01 10:07 - 2013-12-06 15:29 - 00000000 ____D () C:\Users\keiner\AppData\Roaming\Malwarebytes
2014-12-01 10:06 - 2013-12-06 15:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-30 19:12 - 2013-12-05 17:41 - 00000000 ____D () C:\Bilder
2014-11-28 15:20 - 2013-11-29 16:04 - 00000000 ____D () C:\Users\keiner
2014-11-28 15:20 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp
2014-11-28 15:19 - 2013-12-11 16:32 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-11-28 15:19 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2014-11-27 17:27 - 2010-11-20 22:01 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-26 14:54 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-23 10:11 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-20 20:31 - 2013-12-05 17:49 - 00000000 ____D () C:\ebay
2014-11-20 11:42 - 2013-12-05 10:44 - 00174001 _____ () C:\Windows\system32\AdobeFnt.lst
2014-11-19 16:08 - 2013-12-05 13:20 - 00000000 ____D () C:\Users\keiner\AppData\Local\HP
2014-11-19 13:21 - 2013-12-07 11:15 - 00000000 ____D () C:\Users\keiner\AppData\Local\G DATA
2014-11-11 15:07 - 2013-12-05 11:33 - 00000000 ____D () C:\TEMP

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-25 15:13

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 01-12-2014
Ran by keiner at 2014-12-01 19:42:22
Running from C:\Users\keiner\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: G Data TotalProtection 2014 (Enabled - Out of date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: G Data TotalProtection 2014 (Enabled - Out of date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 15.1.1 - Hewlett-Packard) Hidden
Ad-Aware Antivirus (HKLM\...\{8EEFB640-A25D-448E-9F84-3CADF173CAE4}_AdAwareUpdater) (Version: 11.4.6792.0 - Lavasoft)
AdAwareInstaller (Version: 11.4.6792.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.4.6792.0 - Lavasoft) Hidden
Adobe Acrobat Reader 3.01 (HKLM\...\Adobe Acrobat Reader 3.01) (Version:  - )
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{A9E81771-1A5D-484B-A982-B92F60D3CFBF}) (Version: 3.0.847.0 - Advanced Micro Devices, Inc.)
AntimalwareEngine (Version: 3.0.0.56 - Lavasoft) Hidden
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
AVM FRITZ!Box Dokumentation (HKLM\...\AVMFBox) (Version:  - AVM Berlin)
AVM FRITZ!Box Druckeranschluss (HKLM\...\AVMFBoxPrinter) (Version:  - AVM Berlin)
Bing Bar (HKLM\...\{FF6DD716-7B10-4269-9F19-FFB07AC4CD95}) (Version: 7.3.124.0 - Microsoft Corporation)
Cliqz (HKLM\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
DRI Tool 2.0 (HKLM\...\DRI Tool 2.0_is1) (Version: 2.0 - Traumflieger)
EuroCUT Professional 6 (HKLM\...\{AD51AC49-2166-11D6-B7C9-0010B5404CC2}) (Version: 6 - EUROSYSTEMS S.a.r.l.)
FileZilla Client 3.7.0.2 (HKLM\...\FileZilla Client) (Version: 3.7.0.2 - FileZilla Project)
G Data TotalProtection 2014 (HKLM\...\{63DEADD1-C032-4F1F-AF76-26B166D6AC30}) (Version: 24.0.3.2 - G Data Software AG)
HKGELD-2000 Version 1.14 (HKLM\...\HKGELD-2000_is1) (Version:  - Holger Krinke Softwareentwicklung)
HP Officejet Pro 276dw MFP - Grundlegende Software für das Gerät (HKLM\...\{67D662F7-42C5-4FD8-AA24-5C82BF0E768B}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Officejet Pro 276dw MFP Hilfe (HKLM\...\{C57FD65E-430E-4922-92F7-A8B529769A55}) (Version: 29.0.0 - Hewlett Packard)
HP Support Solutions Framework (HKLM\...\{C43602FE-988C-47BA-9F9F-B95FDDAFB624}) (Version: 11.50.0031 - Hewlett-Packard Company)
HP Update (HKLM\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HydraVision (Version: 4.2.216.0 - Advanced Micro Devices, Inc.) Hidden
I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
INSTAR Camera Tool (HKLM\...\{630473B5-3AA9-4477-B6DD-F9EA5BEEDD42}) (Version: 2.0.2.0 - INSTAR)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Micrografx Photo Magic (HKLM\...\PhotoMagic) (Version:  - )
Micrografx Windows Draw (HKLM\...\WindowsDraw) (Version:  - )
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2000 Premium (HKLM\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 33.1.1 (x86 de) (HKLM\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
NetObjects Fusion 7 (HKLM\...\NetObjects Fusion 7) (Version:  - )
PDF Architect (HKLM\...\{86D8A96B-1911-4C3F-AA16-0B47E053E492}) (Version: 1.2.97.14551 - pdfforge GmbH)
PDF24 Creator 6.5.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.0 - pdfforge)
Phase 5 HTML-Editor (HKLM\...\{20B1B020-DEAE-48D1-9960-D4C3185D758B}) (Version: 5.6.2.3 - Systemberatung Schommer)
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Studie zur Verbesserung von HP Officejet Pro 276dw MFP (HKLM\...\{6822A850-AEA0-4567-9FEC-5802C72A1DED}) (Version: 29.1.973.39397 - Hewlett-Packard Co.)
web control version 3.0.2.3 (HKLM\...\{20779EFD-5A24-45F7-A133-132975478C4E}_is1) (Version: 3.0.2.3 - )
Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16422 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

01-12-2014 14:34:16 AA11

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {86F6640C-0227-49D9-A952-13DAEC7F4B5D} - System32\Tasks\HP AR Program Upload - 8a541322ccf74681a31236c6b9f72d848c43924f048a45c1a39582159a530bef => C:\Program Files\HP\HP Officejet Pro 276dw MFP\bin\HPRewards.exe [2014-03-06] (TODO: <Company name>)
Task: {BB1EEB77-F6DC-42E0-89C4-FA6D2EF6A1BA} - System32\Tasks\HPCustParticipation HP Officejet Pro 276dw MFP => C:\Program Files\HP\HP Officejet Pro 276dw MFP\Bin\HPCustPartic.exe [2012-10-30] (Hewlett-Packard Co.)
Task: {DABB7041-68C8-48AE-ADF1-3984EDF505A7} - System32\Tasks\SuperEasyDriverUpdaterRunAtStartup => C:\Program Files\SuperEasy Software\Driver Updater\supereasydu.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Loaded Modules (whitelisted) =============

2013-08-14 09:30 - 2013-08-14 09:30 - 00279504 ____N () C:\Program Files\Common Files\G Data\AVKProxy\PktIcpt2.dll
2013-05-26 16:53 - 2013-05-26 16:53 - 00093696 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2011-10-12 16:23 - 2011-10-12 16:23 - 00369152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 07670592 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTray.exe
2014-10-15 14:06 - 2014-10-15 14:06 - 02423600 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\RCF.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00107872 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_filesystem-vc100-mt-1_55.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00022360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_system-vc100-mt-1_55.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00048480 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_date_time-vc100-mt-1_55.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00087896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_thread-vc100-mt-1_55.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00030040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_chrono-vc100-mt-1_55.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00405848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_locale-vc100-mt-1_55.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 01626432 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\HtmlFramework.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00056632 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\DllStorage.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00870224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTrayDefaultSkin.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00641344 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\Localization.dll
2014-10-15 13:56 - 2014-10-15 13:56 - 00656376 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe
2014-10-15 14:06 - 2014-10-15 14:06 - 10343760 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareServiceKernel.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00638296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_regex-vc100-mt-1_55.dll
2014-10-15 14:05 - 2014-10-15 14:05 - 00580424 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareActivation.dll
2014-10-15 14:05 - 2014-10-15 14:05 - 01658200 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareApplicationUpdater.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00642376 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareGamingMode.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00087360 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareReset.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00105280 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareTime.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00754520 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareDefinitionsUpdater.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00693096 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00868680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareIgnoreList.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00209224 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareQuarantine.dll
2014-10-15 14:05 - 2014-10-15 14:05 - 00780120 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiMalwareEngine.dll
2014-10-15 14:05 - 2014-10-15 14:05 - 00174936 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiRootkitEngine.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00870736 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareScannerHistory.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 01003328 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareScanner.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00030552 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\boost_timer-vc100-mt-1_55.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00769368 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareScannerScheduler.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00856408 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareRealTimeProtection.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00190800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareIncompatibles.dll
2014-10-15 14:05 - 2014-10-15 14:05 - 00705352 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiSpam.dll
2014-10-15 14:05 - 2014-10-15 14:05 - 00669008 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAntiPhishing.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 02363216 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareParentalControl.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 02613584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareWebProtection.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00834896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareEmailProtection.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00999256 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareNetworkProtection.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00796992 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwarePromo.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00286536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareFeedback.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 02124120 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareThreatWorkAlliance.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00998720 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwarePinCode.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00796992 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareNotice.dll
2014-10-15 14:05 - 2014-10-15 14:05 - 00760136 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareAvcEngine.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00926568 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareRealTimeProtectionHistory.dll
2014-10-15 14:06 - 2014-10-15 14:06 - 00123712 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\SecurityCenter.dll
2014-12-01 13:10 - 2014-11-14 03:42 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1307861164-1411102128-3161447057-500 - Administrator - Disabled)
Gast (S-1-5-21-1307861164-1411102128-3161447057-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1307861164-1411102128-3161447057-1002 - Limited - Enabled)
keiner (S-1-5-21-1307861164-1411102128-3161447057-1001 - Administrator - Enabled) => C:\Users\keiner

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/01/2014 07:26:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (12/01/2014 03:17:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 03:01:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 01:34:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 00:55:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 10:23:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 09:26:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/30/2014 07:10:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/29/2014 00:32:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/28/2014 03:21:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (12/01/2014 05:02:06 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 05:02:06 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 05:00:30 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 05:00:30 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 04:49:46 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 04:44:03 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 04:21:08 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 04:20:31 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 04:10:25 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (12/01/2014 03:49:21 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "KEINER-PC      :0" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20
registriert werden. Der Computer mit IP-Adresse 192.168.178.23 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.


Microsoft Office Sessions:
=========================
Error: (12/01/2014 07:26:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\HP\HP Officejet Pro 276dw MFP\DriverStore\Evo\amd64\hpinkins6212.exe

Error: (12/01/2014 03:17:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 03:01:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 01:34:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 00:55:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 10:23:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/01/2014 09:26:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/30/2014 07:10:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/29/2014 00:32:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/28/2014 03:21:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
Percentage of memory in use: 65%
Total physical RAM: 2046.49 MB
Available physical RAM: 700.63 MB
Total Pagefile: 4092.98 MB
Available Pagefile: 1732.43 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.66 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:372.51 GB) (Free:298.51 GB) NTFS
Drive d: () (Fixed) (Total:232.88 GB) (Free:119.74 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 372.6 GB) (Disk ID: A5457434)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=372.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 1F681F67)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 02.12.2014, 17:38

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

andi65 · 02.12.2014, 20:34

Hallo,
ich habe 3x Combofix ausgeführt. 3x hängengeblieben an unterschiedlichen stellen.
Trotz abstellen der Gdata Software habe ich mehrmals Bösartige Virenwarungen bekommen
wärend Combofix installiert und gescannt hat.
Jetzt reichts mir, ich mach ihn jetzt Platt.

Danke Schrauber trotzdem für Deine Hilfe, Du bist hier sehr fleißig :-)

Grüße Andi

schrauber · 03.12.2014, 11:59

GDATA ist absoluter Müll was das angeht.

03.12.2014, 11:59	#6
schrauber /// the machine /// TB-Ausbilder	Mozilla Firefox Rechner arbeitet und Popups gehen auf GDATA ist absoluter Müll was das angeht. __________________ --> Mozilla Firefox Rechner arbeitet und Popups gehen auf

Mozilla Firefox Rechner arbeitet und Popups gehen auf

Plagegeister aller Art und deren Bekämpfung: Mozilla Firefox Rechner arbeitet und Popups gehen auf