Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Ungewünschte Werbebanner Firefox

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 01.03.2015, 14:52   #1
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Hallo,

ich fürchte ich habe mir Malware eingefangen. Ich bekomme neuerdings Schmuddel-Werbung eingeblendet (Abnehmen in 2 Tagen..., Muskeln, Software-Download-hier...), die es vorher in der Form nicht gab.


Hier das Ergebnis der letzten Malwarbytes-Suche, für die ich mir extra Premium gekauft habe:
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 28.02.2015
Suchlauf-Zeit: 17:33:50
Logdatei: logfile-28.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.02.28.03
Rootkit Datenbank: v2015.02.25.01
Lizenz: Premium
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Anette-NB

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 346883
Verstrichene Zeit: 31 Min, 0 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

Das scheint ohne Befund. Was kann ich tun?

Vielen Dank vorab für die Hilfe.

Gruß,

Annoo

Alt 01.03.2015, 15:05   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________

Alt 01.03.2015, 16:08   #3
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Hallo,

hier

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-02-2015
Ran by xxx (administrator) on xxx-HP on 01-03-2015 16:41:37
Running from C:\Users\xxx\Downloads
Loaded Profiles: xxx (Available profiles: xxx)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Softland) C:\Program Files (x86)\Softland\FBackup 5\bTray.exe
(Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(Dropbox, Inc.) C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Softland) C:\Program Files (x86)\Softland\FBackup 5\bService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IAMTEDE.EXE


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [NeroCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466144 2014-11-27] (Sony)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [EPSON SX100 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEDE.EXE [221696 2008-02-05] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Copernic Desktop Search - Home] => C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe [1692200 2013-01-28] (Copernic Inc.)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [FBackup 5 Tray Agent] => C:\Program Files (x86)\Softland\FBackup 5\bTray.exe [7862840 2014-09-30] (Softland)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1467200 2014-11-27] (Lavasoft)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\MountPoints2: {6d057867-0d7f-11e4-8c71-2c768ae69a2d} - G:\Startme.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQNOT/4
URLSearchHook: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 - (No Name) - {5786d022-540e-4699-b350-b4be0ae94b79} - No File
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {70DDF8F1-81D4-4DFA-B8E3-6E3A6E6EA9EF} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = https://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Winsock: Catalog9 01 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 02 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 03 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 04 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9 15 C:\Windows\SysWOW64\LavasoftTcpService.dll [312424] (Lavasoft Limited)
Winsock: Catalog9-x64 01 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Winsock: Catalog9-x64 15 C:\Windows\system32\LavasoftTcpService64.dll [358736] (Lavasoft Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default
FF NewTab: hxxp://www.google.de/
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1588870830-359060440-1081868607-1001: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF SearchPlugin: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-maps.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-11-17]
FF Extension: Avira Browser Safety - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\abs@avira.com [2015-02-27]
FF Extension: Adblock Plus - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-11]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-01-18]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-18]
FF HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Firefox\Extensions: [{57319509-7821-41B0-9FDF-3B58F146AE33}] - c:\program files (x86)\copernic desktop search - home\firefoxconnector
FF Extension: Copernic Desktop Search - Search Firefox content - c:\program files (x86)\copernic desktop search - home\firefoxconnector [2013-07-31]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-03]
CHR Extension: (Google Drive) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-03]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-21]
CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-03]
CHR Extension: (Google Search) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-03]
CHR Extension: (Avira Browser Safety) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-21]
CHR Extension: (Skype Click to Call) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-02-21]
CHR Extension: (Google Wallet) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-03]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-07-18] (Adobe Systems) [File not signed]
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 FBackup5Srv; C:\Program Files (x86)\Softland\FBackup 5\bService.exe [4642360 2014-09-30] (Softland)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-03-12] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed]
R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [1351512 2014-11-27] (Lavasoft Limited)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [15208 2014-11-27] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-17] (Sony Mobile Communications)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-01] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-11-12] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 16:41 - 2015-03-01 16:43 - 00027825 _____ () C:\Users\xxx\Downloads\FRST.txt
2015-03-01 16:41 - 2015-03-01 16:42 - 00000000 ____D () C:\FRST
2015-03-01 16:38 - 2015-03-01 16:38 - 02092544 _____ (Farbar) C:\Users\xxx\Downloads\FRST64.exe
2015-02-28 19:39 - 2015-02-28 19:39 - 00001203 _____ () C:\Users\xxx\Desktop\vorher.txt
2015-02-28 18:42 - 2015-02-28 18:42 - 00000000 _____ () C:\Users\xxx\defogger_reenable
2015-02-28 18:41 - 2015-02-28 18:44 - 00000480 _____ () C:\Users\xxx\Downloads\defogger_disable.log
2015-02-28 18:41 - 2015-02-28 18:41 - 00000252 _____ () C:\Users\xxx\Downloads\defogger_enable.log
2015-02-28 18:39 - 2015-02-28 18:39 - 00050477 _____ () C:\Users\xxx\Downloads\Defogger.exe
2015-02-28 16:57 - 2015-03-01 09:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\10777241.sys
2015-02-28 16:44 - 2015-02-28 16:44 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-28 16:43 - 2015-02-28 16:43 - 20447120 _____ (Malwarebytes Corporation ) C:\Users\xxx\Downloads\mbam_premium.exe
2015-02-28 14:58 - 2015-02-28 16:48 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForxxx.job
2015-02-28 14:58 - 2015-02-28 14:58 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForxxx
2015-02-28 14:47 - 2015-02-28 14:44 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-02-27 23:04 - 2015-02-27 23:04 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Avira
2015-02-27 22:58 - 2015-02-27 22:58 - 00000000 ____D () C:\Users\xxx\Documents\Updater
2015-02-27 22:58 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-02-27 22:58 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-02-27 22:58 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-02-27 22:54 - 2015-02-27 23:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-27 22:51 - 2015-02-27 22:51 - 04582672 _____ (Avira Operations & Co. KG) C:\Users\xxx\Downloads\avira_de_av_5876132996__ws.exe
2015-02-27 21:07 - 2015-02-27 22:36 - 00000000 ____D () C:\AdwCleaner
2015-02-27 21:07 - 2015-02-27 21:07 - 02126848 _____ () C:\Users\xxx\Downloads\AdwCleaner_4.111.exe
2015-02-26 20:02 - 2015-03-01 08:56 - 00000392 _____ () C:\Windows\setupact.log
2015-02-26 20:02 - 2015-02-28 14:35 - 00135182 _____ () C:\Windows\PFRO.log
2015-02-26 20:02 - 2015-02-26 20:02 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-26 18:18 - 2015-03-01 16:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-26 18:18 - 2014-11-21 07:08 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-26 18:18 - 2014-11-21 07:07 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-26 18:18 - 2014-11-21 07:07 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-26 18:14 - 2015-02-26 18:17 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-25 23:19 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 23:19 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 20:10 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 20:10 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 20:10 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 20:10 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-25 18:22 - 2015-02-25 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-02-15 11:50 - 2015-01-23 05:07 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-15 11:50 - 2015-01-23 04:59 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-15 11:50 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-15 11:50 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-14 14:18 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-14 14:18 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-14 14:18 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-14 14:18 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-14 14:18 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-14 14:18 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-14 14:18 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-14 14:18 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-14 14:18 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-14 14:18 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-14 14:18 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-14 14:18 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-02-14 14:18 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-14 14:18 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-14 14:18 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-02-14 14:18 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-14 14:18 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-14 14:18 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-14 14:18 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-14 14:18 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-14 14:18 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-02-14 14:18 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-02-14 13:12 - 2015-02-14 13:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2015-02-14 13:12 - 2015-02-14 13:12 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-02-14 13:11 - 2015-02-14 13:11 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-02-14 13:11 - 2015-02-14 13:11 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-02-14 13:11 - 2015-02-14 13:11 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2015-02-13 11:03 - 2015-02-26 18:27 - 00000000 ____D () C:\Users\xxx\AppData\Local\PDFCreator
2015-02-11 22:09 - 2015-02-11 22:09 - 00010495 _____ () C:\Users\xxx\Downloads\anette_elster_11.02.2015.pfx
2015-02-11 16:33 - 2015-02-14 13:54 - 00001405 _____ () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-02-11 08:03 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 08:03 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 08:03 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 08:01 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 08:01 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 08:01 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 08:01 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 08:01 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 08:01 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 08:01 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 08:01 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 08:01 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 08:01 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 08:01 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 08:01 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 08:01 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 08:01 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 08:01 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 08:01 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 08:01 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 08:00 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 08:00 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 08:00 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 08:00 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 08:00 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 08:00 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 07:59 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 07:59 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 07:59 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 07:59 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 07:59 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-02-11 07:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 07:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 07:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 07:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 07:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 07:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 07:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 07:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 07:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 07:53 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-10 23:01 - 2015-02-10 23:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2015-02-10 23:00 - 2015-02-26 17:47 - 00000000 ____D () C:\Program Files\PDFCreator
2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Opera Software
2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx\AppData\Local\Opera Software
2015-02-10 23:00 - 2015-01-22 16:14 - 00114872 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2015-02-10 22:58 - 2015-02-11 15:59 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-10 22:49 - 2015-02-10 22:49 - 27721680 _____ (pdfforge ) C:\Users\xxx\Downloads\PDFCreator-2_0_2-setup(1).exe
2015-02-10 16:50 - 2015-02-10 16:50 - 00001464 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk
2015-02-10 16:50 - 2015-02-10 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
2015-02-10 16:48 - 2015-02-10 16:48 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-02-10 16:45 - 2015-02-10 16:46 - 215975048 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113k.exe
2015-02-05 11:21 - 2015-02-05 11:21 - 115978680 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113p.exe
2015-02-05 11:13 - 2015-02-05 11:14 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113u(1).exe
2015-02-05 09:14 - 2015-02-05 09:14 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-02-04 21:24 - 2015-02-10 10:49 - 00000000 ____D () C:\Users\xxx\Desktop\steuerformulare
2015-02-04 21:22 - 2015-02-10 16:51 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\elsterformular
2015-02-04 20:52 - 2015-02-05 11:23 - 00000000 ____D () C:\ProgramData\elsterformular
2015-02-04 20:43 - 2015-02-04 20:45 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx\Downloads\ElsterFormular-16.0.20150113u.exe
2015-02-01 13:13 - 2015-02-01 13:13 - 00000000 ____D () C:\Users\xxx\Documents\Steuer-Sparbuch
2015-02-01 12:58 - 2015-02-01 13:16 - 27721680 _____ (pdfforge ) C:\Users\xxx\Downloads\PDFCreator-2_0_2-setup.exe
2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Buhl Data Service
2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx\AppData\Local\Buhl Data Service
2015-02-01 12:10 - 2015-02-01 12:17 - 00000000 ____D () C:\Users\xxx\AppData\Local\Buhl
2015-02-01 12:10 - 2015-02-01 12:14 - 00000103 _____ () C:\Windows\wiso.ini
2015-02-01 11:50 - 2015-02-01 11:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2015
2015-02-01 11:46 - 2015-02-01 11:46 - 00000000 ____D () C:\Program Files (x86)\WISO
2015-02-01 11:44 - 2015-02-01 12:10 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-01 16:45 - 2012-01-28 21:58 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Skype
2015-03-01 16:34 - 2011-11-07 10:37 - 01225638 _____ () C:\Windows\WindowsUpdate.log
2015-03-01 16:14 - 2015-01-22 12:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-01 09:13 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-01 09:13 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-01 09:09 - 2012-01-26 15:23 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA7BE238-D6AB-4111-8246-3DC85ACF4280}
2015-03-01 09:05 - 2011-08-09 21:16 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2015-03-01 09:05 - 2011-08-09 21:16 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2015-03-01 09:05 - 2009-07-14 06:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-01 09:02 - 2014-09-22 17:53 - 00000000 ___RD () C:\Users\xxx\Dropbox
2015-03-01 09:01 - 2014-04-08 08:19 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Dropbox
2015-03-01 08:56 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-28 18:42 - 2012-01-26 15:18 - 00000000 ____D () C:\Users\xxx
2015-02-28 17:01 - 2013-02-08 18:09 - 00053248 _____ () C:\Users\xxx\Documents\laggie.xls
2015-02-28 14:56 - 2012-02-07 10:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\ProgramData\Avira
2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-27 22:53 - 2014-08-05 09:35 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-27 22:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-27 20:59 - 2013-11-12 11:45 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2015-02-27 20:57 - 2014-06-18 15:26 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\SoftGrid Client
2015-02-26 20:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\TAPI
2015-02-26 17:42 - 2012-03-03 18:11 - 00000000 ____D () C:\Users\xxx\AppData\Local\CrashDumps
2015-02-26 17:42 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther
2015-02-26 12:03 - 2014-07-22 13:57 - 00000000 ____D () C:\Users\xxx\Documents\privat
2015-02-26 07:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-25 18:21 - 2015-01-18 14:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-25 18:21 - 2012-05-09 22:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-23 08:27 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-02-21 18:16 - 2014-05-03 18:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-14 13:54 - 2012-01-26 15:23 - 00001439 _____ () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-14 13:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-12 06:45 - 2009-07-14 05:45 - 00329504 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 06:43 - 2014-12-10 16:39 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 06:43 - 2014-05-14 13:26 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 23:54 - 2014-06-18 13:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 23:49 - 2013-08-19 10:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 23:36 - 2012-01-31 13:14 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 16:40 - 2012-01-26 15:21 - 00079648 _____ () C:\Users\xxx\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-11 07:25 - 2014-09-22 12:34 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-10 22:51 - 2013-08-02 09:33 - 00000000 ____D () C:\Users\xxx\Documents\steuern
2015-02-06 13:44 - 2014-07-21 13:36 - 00000000 ____D () C:\Users\xxx\Documents\Uni
2015-02-05 09:14 - 2015-01-22 12:57 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 09:14 - 2015-01-22 12:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 09:14 - 2015-01-22 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-01 11:46 - 2011-08-09 12:26 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-01-31 16:17 - 2012-02-18 16:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

==================== Files in the root of some directories =======

2014-12-01 13:18 - 2014-12-01 16:47 - 2929335 _____ () C:\Program Files (x86)\MysticThumbs.zip
2014-09-19 19:28 - 2014-09-19 19:28 - 0000000 _____ () C:\Users\xxx\AppData\Roaming\downloads.m3u

Files to move or delete:
====================
C:\Users\xxx\ccsetup412.exe


Some content of TEMP:
====================
C:\Users\xxx\AppData\Local\Temp\avgnt.exe
C:\Users\xxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqofgcj.dll
C:\Users\xxx\AppData\Local\Temp\Quarantine.exe
C:\Users\xxx\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-27 21:37

==================== End Of Log ============================
         
--- --- ---

--- --- ---


und hier
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-02-2015
Ran by xxx at 2015-03-01 17:03:19
Running from C:\Users\xxx\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Ad-Aware Web Companion (x32 Version: 1.0.813.1538 - Lavasoft) Hidden
Adobe Connect 9 Add-in (HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Adobe Connect 9 Add-in) (Version: 11,9,966,0 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.6.156 - Adobe Systems, Inc.)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
ATI Catalyst Install Manager (HKLM\...\{6153098B-60DB-6A9F-EA0F-B006A96B57D5}) (Version: 3.0.829.0 - ATI Technologies, Inc.)
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
Copernic Desktop Search - Home (HKLM-x32\...\CopernicDesktopSearch2) (Version:  - Copernic Inc.)
Corel Graphics Suite 11 (HKLM-x32\...\InstallShield_{07A540AB-D785-11D5-8E89-0090275862A0}) (Version: 11 - Corel Corporation)
Corel Graphics Suite 11 (x32 Version: 11 - Corel Corporation) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DATA BECKER capella studio & scan 2.0 (HKLM-x32\...\capella studio & scan 2.0_is1) (Version: 6.0.17.0 - DATA BECKER GmbH & Co. KG)
DolbyFiles (x32 Version: 0.1 - Nero AG) Hidden
Dropbox (HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
Druckerdeinstallation für EPSON SX100 Series (HKLM\...\EPSON SX100 Series) (Version:  - SEIKO EPSON Corporation)
DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version:  - DVD Shrink)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150113 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - )
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
FBackup 5 (x32 Version: 5.1.596 - Softland) Hidden
FBackup 5.1 (HKLM-x32\...\{9cf473bc-b88f-4803-b486-c57e0541c8ec}) (Version: 5.1.596.0 - Softland)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Documentation (HKLM-x32\...\{68A55875-B6DD-41E8-8CF6-F193D9C47051}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Launch Box (HKLM\...\{9CAB2212-0732-4827-8EC4-61D8EF0AA65B}) (Version: 1.0.11 - Hewlett-Packard Company)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{872B1C80-38EC-4A31-A25C-980820593900}) (Version: 1.2.3 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{8B52057C-15DB-433E-957C-E279BC7D07E3}) (Version: 3.1.0.9742 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kodu Game Lab (HKLM-x32\...\{7DE737B3-B287-4107-8D41-B10E039991CC}) (Version: 1.2.88 - Microsoft Research)
LavasoftTcpService (x32 Version: 2.2.9.5 - Lavasoft) Hidden
Lexware kundenmanager 2011 (HKLM-x32\...\{B2EFA385-09C9-4E52-B4B3-AD15A6D3773B}) (Version: 13.4.4100 - Lexware GmbH & Co. KG)
Lexware kundenmanager 2011 System (HKLM-x32\...\{1846A764-A6C1-46D2-B245-DAEDB2FDF5C9}) (Version: 8.00.0000 - Haufe-Lexware GmbH & Co. KG)
Lexware Outlook AddIn 2011 (HKLM-x32\...\{31D94784-FBE0-49F3-A1A5-F6F0AEDD8A93}) (Version: 13.4.4002 - Lexware GmbH & Co. KG)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Go (HKLM-x32\...\{F66C4A41-C3A8-4523-AB6C-BAA1DB38305C}) (Version: 2.7.357 - Sony)
Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.4.103.12040 (HKLM-x32\...\{7C5AEEE1-6D7C-8922-4548-7BF9096077EC}) (Version: 2.4.103.12040 - Sony)
Menu Templates - Starter Kit (x32 Version: 9.4.2.0 - Nero AG) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access Runtime 2010 (HKLM-x32\...\Office14.AccessRT) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office 2000 Premium (HKLM-x32\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5128.5002 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Reader (HKLM-x32\...\{B6F7DBE7-2FE2-458F-A738-B10832746036}) (Version:  - )
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 (x86) de (HKLM-x32\...\{DC39A078-4D4C-4EF2-9CAF-69D342D74125}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 (x86) de (HKLM-x32\...\{E8D33431-67EA-4DC1-B443-EE989DE532BC}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Movie Templates - Starter Kit (x32 Version: 9.4.2.0 - Nero AG) Hidden
Mozilla Firefox 36.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 de)) (Version: 36.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
Mozilla Thunderbird 31.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.5.0 (x86 de)) (Version: 31.5.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\MyFreeCodec) (Version:  - )
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
MysticThumbs (HKLM\...\{ED321628-843E-4319-8C6D-CB3C919323AC}) (Version: 1.9.8 - MysticCoder)
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
Nero 9 Essentials (HKLM-x32\...\{cd57ddf3-08b3-4ceb-affd-0032c2adebb4}) (Version:  - Nero AG)
Nvu 1.0 (HKLM-x32\...\Nvu_is1) (Version: 1.0 - Thorsten Fritz)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.2 - pdfforge)
pdfforge Toolbar v9.2 (HKLM-x32\...\{65775F96-910D-4A8F-9695-5BA891879603}) (Version: 9.2 - Spigot, Inc.) <==== ATTENTION
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PL-2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version:  - )
PL-2303 Vista Driver Installer (HKLM-x32\...\{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}) (Version: 3.0.1.0 - Prolific)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.12.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6287 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.2.14014_6 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.33.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-001C-0000-0000-0000000FF1CE}_Office14.AccessRT_{54846D1D-E5D5-4A28-AA6D-7208259007EA}) (Version:  - Microsoft)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.14.9.201406230908 - Sony Mobile Communications AB)
Sony PC Companion 2.10.245 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.245 - Sony)
Spyware Terminator 2012 (HKLM-x32\...\{56736259-613E-4A3B-B428-6235F2E76F44}_is1) (Version: 3.0.0.82 - Crawler.com)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics TouchPad Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
The Matrix Trilogy 3D Code Screen Saver v3.4 (HKLM-x32\...\Matrix3D) (Version:  - )
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VBA (2627.01) (x32 Version: 6.03.00.9188 - Microsoft Corporation) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
VLC media player 2.0.0 (HKLM-x32\...\VLC media player) (Version: 2.0.0 - VideoLAN)
Web Companion (HKLM-x32\...\{89C9F6E5-50D4-400C-AB96-5A947584D4D6}_WebCompanion) (Version: 1.0.813.1538 - Lavasoft)
WildTangent Games App für HP (x32 Version: 4.0.11.7 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WISO Steuer-Sparbuch 2015 (HKLM-x32\...\{64688129-C2AF-42FE-B153-E74529FCDE34}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1588870830-359060440-1081868607-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\xxx\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

14-02-2015 20:43:34 Windows Update
15-02-2015 19:00:23 Windows-Sicherung
16-02-2015 06:55:23 Windows Update
19-02-2015 07:53:39 Windows Update
23-02-2015 16:42:35 Windows-Sicherung
24-02-2015 07:23:24 Windows Update
25-02-2015 23:17:35 Windows Update
27-02-2015 22:50:28 Removed Avira Savings Advisor

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0222CE49-FC2F-42D4-9A6D-66203BB811B9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {0886729C-A494-4BDC-B872-AC975CC58F16} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {309C5C92-B46A-4099-BB7A-F8803EC41046} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {48B2D921-B795-4CF1-BE2C-30D38EA8F7B3} - System32\Tasks\{9CEC0B83-F181-4C71-85BB-DEF3163407F5} => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe
Task: {513FCC22-2490-4C77-B0B1-07D0F299AF79} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-01-21] (Hewlett-Packard)
Task: {58A4A4A7-8771-46AE-ABBB-9C35427D3741} - System32\Tasks\HPCeeScheduleForxxx => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {69E92A86-9C2D-4C79-ACB6-9E16AFAA1DA7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {709EE61F-CC9C-4A49-AF4D-357C10484D82} - System32\Tasks\CCleanerSkipUAC => C:\PROGRAM FILES\CCLEANER\CCLEANER.EXE [2014-03-18] (Piriform Ltd)
Task: {8C59E1F1-B3A2-439B-92F8-B4CD9DFE8E18} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {A6A52D45-E225-4AA9-8BD9-2AEF78960E65} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A6F48233-8F29-4B90-822A-BC33CEED12E1} - System32\Tasks\{CEC61C62-A15F-4F5C-8692-5D5C157D2D00} => Firefox.exe hxxp://ui.skype.com/ui/0/6.14.59.104/de/abandoninstall?page=tsMain
Task: {AEB83D01-CC94-4057-B77E-07F4A6EB9555} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F8826F1B-0E3B-459A-8F17-DFB654F0AA5E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-01-21] (Hewlett-Packard)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\HPCeeScheduleForxxx.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) ==============

2011-07-05 11:27 - 2011-07-05 11:27 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2011-06-27 15:18 - 2011-06-27 15:18 - 00107320 _____ () C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
2014-07-17 13:34 - 2014-06-23 08:07 - 00113376 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
2011-07-05 11:27 - 2011-07-05 11:27 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-07-05 11:13 - 2011-07-05 11:13 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-07-17 13:34 - 2012-04-30 10:57 - 00039936 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
2014-07-17 13:34 - 2014-12-04 14:18 - 00241152 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 13:54 - 2011-07-07 13:54 - 00233984 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
2014-07-17 13:34 - 2013-05-20 11:58 - 00620718 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
2014-07-17 13:34 - 2010-01-11 15:44 - 00053248 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll
2014-06-12 09:19 - 2014-06-12 09:19 - 00643584 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
2014-09-30 09:50 - 2014-09-30 09:50 - 00472064 ____R () C:\Program Files (x86)\Softland\FBackup 5\bResourceStrings.bpl
2014-09-30 09:35 - 2014-09-30 09:35 - 00642016 ____R () C:\Program Files (x86)\Softland\FBackup 5\sqlite3.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00067392 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00169320 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00088392 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00033136 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00015696 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
2014-11-27 10:43 - 2014-11-27 10:43 - 00041304 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.PUP.Management.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00235336 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Filtering.dll
2014-11-27 10:42 - 2014-11-27 10:42 - 00039256 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00750080 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-01 09:00 - 2015-03-01 09:00 - 00043008 _____ () c:\Users\xxx\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqofgcj.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00047616 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00865280 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-02-10 22:00 - 2015-02-10 22:00 - 00200704 _____ () C:\Users\xxx\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-02-25 18:23 - 2015-02-25 18:23 - 03348080 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-02-25 18:23 - 2015-02-25 18:23 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-02-25 18:23 - 2015-02-25 18:23 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FBackup5Srv => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FBackup5Srv => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk => C:\Windows\pss\Adobe Gamma Loader.exe.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: Copernic Desktop Search - Home => "C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: NeroFilterCheck => C:\Windows\system32\NeroCheck.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe

==================== Accounts: =============================

Administrator (S-1-5-21-1588870830-359060440-1081868607-500 - Administrator - Disabled)
xxx (S-1-5-21-1588870830-359060440-1081868607-1001 - Administrator - Enabled) => C:\Users\xxx
Gast (S-1-5-21-1588870830-359060440-1081868607-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1588870830-359060440-1081868607-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/01/2015 09:08:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmpnetwk.exe, Version: 12.0.7601.17514, Zeitstempel: 0x4ce7ae7f
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000e0b546
ID des fehlerhaften Prozesses: 0x1908
Startzeit der fehlerhaften Anwendung: 0xwmpnetwk.exe0
Pfad der fehlerhaften Anwendung: wmpnetwk.exe1
Pfad des fehlerhaften Moduls: wmpnetwk.exe2
Berichtskennung: wmpnetwk.exe3

Error: (03/01/2015 09:00:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/28/2015 04:54:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DATA BECKER Update Service.exe, Version: 0.0.4.1, Zeitstempel: 0x4d89246b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0x880
Startzeit der fehlerhaften Anwendung: 0xDATA BECKER Update Service.exe0
Pfad der fehlerhaften Anwendung: DATA BECKER Update Service.exe1
Pfad des fehlerhaften Moduls: DATA BECKER Update Service.exe2
Berichtskennung: DATA BECKER Update Service.exe3

Error: (02/28/2015 04:52:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/28/2015 02:41:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DATA BECKER Update Service.exe, Version: 0.0.4.1, Zeitstempel: 0x4d89246b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0x7a4
Startzeit der fehlerhaften Anwendung: 0xDATA BECKER Update Service.exe0
Pfad der fehlerhaften Anwendung: DATA BECKER Update Service.exe1
Pfad des fehlerhaften Moduls: DATA BECKER Update Service.exe2
Berichtskennung: DATA BECKER Update Service.exe3

Error: (02/28/2015 02:37:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/27/2015 10:38:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/27/2015 09:50:29 PM) (Source: SideBySide) (EventID: 9) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Das Stammelement der Manifestdatei muss assembliert sein.

Error: (02/27/2015 09:04:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: DATA BECKER Update Service.exe, Version: 0.0.4.1, Zeitstempel: 0x4d89246b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0xeb8
Startzeit der fehlerhaften Anwendung: 0xDATA BECKER Update Service.exe0
Pfad der fehlerhaften Anwendung: DATA BECKER Update Service.exe1
Pfad des fehlerhaften Moduls: DATA BECKER Update Service.exe2
Berichtskennung: DATA BECKER Update Service.exe3

Error: (02/27/2015 09:00:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (03/01/2015 09:09:23 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/01/2015 09:07:16 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X64 erreicht.

Error: (03/01/2015 09:06:46 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.

Error: (03/01/2015 09:06:07 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "LavasoftTcpService" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/01/2015 09:02:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (03/01/2015 09:02:15 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (03/01/2015 09:01:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "LavasoftTcpService" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (03/01/2015 08:58:22 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst HPWMISVC erreicht.

Error: (03/01/2015 08:58:15 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst IE Search Set erreicht.

Error: (02/28/2015 07:46:31 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}


Microsoft Office Sessions:
=========================
Error: (03/01/2015 09:08:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: wmpnetwk.exe12.0.7601.175144ce7ae7funknown0.0.0.000000000c00000050000000000e0b546190801d053f6d4d84b98C:\Program Files\Windows Media Player\wmpnetwk.exeunknown309f7c69-bfea-11e4-86e4-2c768ae69a2d

Error: (03/01/2015 09:00:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/28/2015 04:54:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: DATA BECKER Update Service.exe0.0.4.14d89246bntdll.dll6.1.7601.18247521ea8e7c0000374000ce75388001d0536ebcbba10fC:\Program Files (x86)\Common Files\DATA BECKER Shared\DATA BECKER Update Service.exeC:\Windows\SysWOW64\ntdll.dll0e12170d-bf62-11e4-9144-2c768ae69a2d

Error: (02/28/2015 04:52:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/28/2015 02:41:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: DATA BECKER Update Service.exe0.0.4.14d89246bntdll.dll6.1.7601.18247521ea8e7c0000374000ce7537a401d0535c3c9cab72C:\Program Files (x86)\Common Files\DATA BECKER Shared\DATA BECKER Update Service.exeC:\Windows\SysWOW64\ntdll.dll83c0f728-bf4f-11e4-8509-2c768ae69a2d

Error: (02/28/2015 02:37:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/27/2015 10:38:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/27/2015 09:50:29 PM) (Source: SideBySide) (EventID: 9) (User: )
Description: C:\Program Files (x86)\Lexware\kundenmanager8\Programm\Module\adxloader.dll.ManifestC:\Program Files (x86)\Lexware\kundenmanager8\Programm\Module\adxloader.dll.Manifest2

Error: (02/27/2015 09:04:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: DATA BECKER Update Service.exe0.0.4.14d89246bntdll.dll6.1.7601.18247521ea8e7c0000374000ce753eb801d052c893e7fde3C:\Program Files (x86)\Common Files\DATA BECKER Shared\DATA BECKER Update Service.exeC:\Windows\SysWOW64\ntdll.dlld862ca7e-bebb-11e4-888e-2c768ae69a2d

Error: (02/27/2015 09:00:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: AMD E-450 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 57%
Total physical RAM: 3690.91 MB
Available physical RAM: 1554.36 MB
Total Pagefile: 7380 MB
Available Pagefile: 4047.12 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:446.19 GB) (Free:367.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.41 GB) (Free:1.68 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.01 GB) FAT32
Drive g: (INTENSO) (Fixed) (Total:232.83 GB) (Free:149.6 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F2DC90A7)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=446.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
Attempted reading MBR returned 0 bytes.
 Could not read MBR for disk 1.

==================== End Of Log ============================
         
__________________

Alt 02.03.2015, 05:59   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    pdfforge Toolbar v9.2


  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 





Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.03.2015, 16:20   #5
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Hallo,

pdfforge ist gelöscht (schade, gibt es andere unproblematische kostenlose oder günstige PDF-Maker?).

Hier das gewünschte Combofix-File:

Code:
ATTFilter
ComboFix 15-03-01.01 - xxx-NB 02.03.2015  15:40:41.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3691.1715 [GMT 1:00]
ausgeführt von:: c:\users\xxx-NB\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\xxx-NB\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\xxx-NB\AppData\Roaming\Microsoft\Windows\Recent\12-kleine-Weihnachtstueten-Weihnachtstaschen-Geschenktueten-Weihnachten-2200-B2 Zum Heranzoomen mit der Maus über das Bild f.URL
c:\users\xxx~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\IsUn0407.exe
c:\windows\SysWow64\SET615F.tmp
c:\windows\SysWow64\SET6BCD.tmp
c:\windows\SysWow64\SET954E.tmp
c:\windows\SysWow64\SETA71C.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-02-02 bis 2015-03-02  ))))))))))))))))))))))))))))))
.
.
2015-03-02 15:45 . 2015-03-02 15:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-03-02 11:34 . 2015-03-02 11:34	--------	d-----w-	c:\program files (x86)\VS Revo Group
2015-03-01 15:41 . 2015-03-01 16:18	--------	d-----w-	C:\FRST
2015-02-28 15:57 . 2015-03-01 08:06	129752	----a-w-	c:\windows\system32\drivers\10777241.sys
2015-02-28 13:47 . 2015-02-28 13:44	43064	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2015-02-27 22:04 . 2015-02-27 22:04	--------	d-----w-	c:\users\xxx-NB\AppData\Roaming\Avira
2015-02-27 21:58 . 2014-11-24 09:23	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2015-02-27 21:58 . 2014-11-24 09:23	131608	----a-w-	c:\windows\system32\drivers\avipbb.sys
2015-02-27 21:58 . 2014-11-24 09:23	119272	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2015-02-27 20:07 . 2015-02-27 21:36	--------	d-----w-	C:\AdwCleaner
2015-02-27 07:08 . 2015-01-29 09:07	11910896	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{9016A56E-A7E3-4FEE-AA1A-38F07A9F16D6}\mpengine.dll
2015-02-26 17:18 . 2015-03-02 15:53	129752	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-02-26 17:18 . 2014-11-21 06:08	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2015-02-26 17:18 . 2014-11-21 06:07	93400	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-02-26 17:18 . 2014-11-21 06:07	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2015-02-26 17:18 . 2015-02-28 15:44	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2015-02-25 19:10 . 2015-01-09 03:14	91136	----a-w-	c:\windows\system32\wdi.dll
2015-02-25 19:10 . 2015-01-09 03:14	950272	----a-w-	c:\windows\system32\perftrack.dll
2015-02-25 19:10 . 2015-01-09 03:14	29696	----a-w-	c:\windows\system32\powertracker.dll
2015-02-25 19:10 . 2015-01-09 02:48	76800	----a-w-	c:\windows\SysWow64\wdi.dll
2015-02-25 17:22 . 2015-02-25 18:00	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2015-02-25 17:21 . 2015-02-25 17:21	3466856	----a-w-	c:\program files (x86)\Mozilla Firefox\d3dcompiler_47.dll
2015-02-25 17:21 . 2015-02-25 17:21	970912	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr120.dll
2015-02-25 17:21 . 2015-02-25 17:21	455328	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp120.dll
2015-02-25 17:21 . 2015-02-25 17:21	169584	----a-w-	c:\program files (x86)\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll
2015-02-15 10:50 . 2015-01-23 03:00	1810944	----a-w-	c:\windows\SysWow64\jscript9.dll
2015-02-15 10:50 . 2015-01-23 04:07	2339840	----a-w-	c:\windows\system32\jscript9.dll
2015-02-15 10:50 . 2015-01-23 03:59	816640	----a-w-	c:\windows\system32\jscript.dll
2015-02-14 12:49 . 2015-02-14 12:49	--------	d-----w-	c:\windows\SysWow64\wbem\en-US
2015-02-14 12:49 . 2015-02-14 12:49	--------	d-----w-	c:\windows\system32\wbem\en-US
2015-02-14 12:12 . 2015-02-14 12:12	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2015-02-14 12:12 . 2015-02-14 12:12	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2015-02-13 10:03 . 2015-02-26 17:27	--------	d-----w-	c:\users\xxx-NB\AppData\Local\PDFCreator
2015-02-11 07:03 . 2015-02-04 03:16	609280	----a-w-	c:\windows\system32\generaltel.dll
2015-02-11 07:03 . 2015-02-04 03:16	894976	----a-w-	c:\windows\system32\appraiser.dll
2015-02-11 07:03 . 2015-02-04 03:13	1098752	----a-w-	c:\windows\system32\aeinv.dll
2015-02-11 07:03 . 2015-02-04 03:16	762368	----a-w-	c:\windows\system32\invagent.dll
2015-02-11 07:03 . 2015-02-04 03:16	414720	----a-w-	c:\windows\system32\devinv.dll
2015-02-11 07:03 . 2015-01-27 23:36	1239720	----a-w-	c:\windows\system32\aitstatic.exe
2015-02-11 07:03 . 2015-02-04 03:16	227328	----a-w-	c:\windows\system32\aepdu.dll
2015-02-11 07:03 . 2015-02-04 03:16	192000	----a-w-	c:\windows\system32\aepic.dll
2015-02-11 07:00 . 2014-12-12 05:31	1480192	----a-w-	c:\windows\system32\crypt32.dll
2015-02-11 07:00 . 2014-12-12 05:07	1174528	----a-w-	c:\windows\SysWow64\crypt32.dll
2015-02-11 07:00 . 2014-07-07 02:07	229376	----a-w-	c:\windows\system32\wintrust.dll
2015-02-11 07:00 . 2014-07-07 02:06	187904	----a-w-	c:\windows\system32\cryptsvc.dll
2015-02-11 07:00 . 2014-07-07 01:40	179200	----a-w-	c:\windows\SysWow64\wintrust.dll
2015-02-11 07:00 . 2014-07-07 01:40	143872	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2015-02-11 06:59 . 2014-11-26 03:53	861696	----a-w-	c:\windows\system32\oleaut32.dll
2015-02-11 06:59 . 2014-11-26 03:32	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2015-02-11 06:59 . 2014-10-04 02:10	3722752	----a-w-	c:\windows\system32\mstscax.dll
2015-02-11 06:59 . 2014-10-04 01:42	3221504	----a-w-	c:\windows\SysWow64\mstscax.dll
2015-02-11 06:59 . 2014-10-04 01:42	131584	----a-w-	c:\windows\SysWow64\aaclient.dll
2015-02-11 06:56 . 2014-12-08 03:09	406528	----a-w-	c:\windows\system32\scesrv.dll
2015-02-11 06:56 . 2014-12-08 02:46	308224	----a-w-	c:\windows\SysWow64\scesrv.dll
2015-02-11 06:56 . 2015-01-14 06:09	5554112	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-02-11 06:56 . 2015-01-14 05:44	3972544	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2015-02-11 06:56 . 2015-01-14 05:44	3917760	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2015-02-11 06:56 . 2015-01-14 06:05	503808	----a-w-	c:\windows\system32\srcore.dll
2015-02-11 06:56 . 2015-01-14 06:04	296960	----a-w-	c:\windows\system32\rstrui.exe
2015-02-11 06:56 . 2015-01-14 06:05	50176	----a-w-	c:\windows\system32\srclient.dll
2015-02-11 06:56 . 2015-01-14 05:41	43008	----a-w-	c:\windows\SysWow64\srclient.dll
2015-02-11 06:53 . 2015-01-09 02:03	3201536	----a-w-	c:\windows\system32\win32k.sys
2015-02-10 22:00 . 2015-01-22 15:14	114872	----a-w-	c:\windows\system32\pdfcmon.dll
2015-02-10 22:00 . 2015-02-26 16:47	--------	d-----w-	c:\program files\PDFCreator
2015-02-10 22:00 . 2015-02-10 22:00	--------	d-----w-	c:\users\xxx-NB\AppData\Local\Opera Software
2015-02-10 22:00 . 2015-02-10 22:00	--------	d-----w-	c:\users\xxx-NB\AppData\Roaming\Opera Software
2015-02-10 21:58 . 2015-02-11 14:59	--------	d-----w-	c:\program files (x86)\Opera
2015-02-10 15:48 . 2015-02-10 15:48	--------	d-----w-	c:\program files (x86)\ElsterFormular
2015-02-05 08:14 . 2015-02-05 08:14	5070512	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2015-02-04 20:22 . 2015-02-10 15:51	--------	d-----w-	c:\users\xxx-NB\AppData\Roaming\elsterformular
2015-02-04 19:52 . 2015-02-05 10:23	--------	d-----w-	c:\programdata\elsterformular
2015-02-01 11:14 . 2015-02-01 11:14	--------	d-----w-	c:\users\xxx-NB\AppData\Roaming\Buhl Data Service
2015-02-01 11:14 . 2015-02-01 11:14	--------	d-----w-	c:\users\xxx-NB\AppData\Local\Buhl Data Service
2015-02-01 11:10 . 2015-02-01 11:17	--------	d-----w-	c:\users\xxx-NB\AppData\Local\Buhl
2015-02-01 10:46 . 2015-02-01 10:46	--------	d-----w-	c:\program files (x86)\WISO
2015-02-01 10:44 . 2015-02-01 11:10	--------	d-----w-	c:\programdata\Buhl Data Service GmbH
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-11 22:36 . 2012-01-31 12:14	116773704	----a-w-	c:\windows\system32\MRT.exe
2015-02-05 08:14 . 2015-01-22 11:57	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-05 08:14 . 2015-01-22 11:57	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-12-22 23:41 . 2010-11-21 03:27	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-12-19 03:06 . 2015-01-15 07:45	210432	----a-w-	c:\windows\system32\profsvc.dll
2014-12-19 01:46 . 2015-01-14 06:35	141312	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2014-12-11 17:47 . 2015-01-14 06:36	52736	----a-w-	c:\windows\system32\TSWbPrxy.exe
2014-12-06 04:17 . 2015-01-14 06:35	303616	----a-w-	c:\windows\system32\nlasvc.dll
2014-12-06 03:50 . 2015-01-14 06:35	52224	----a-w-	c:\windows\SysWow64\nlaapi.dll
2014-12-06 03:50 . 2015-01-14 06:35	156672	----a-w-	c:\windows\SysWow64\ncsi.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony PC Companion"="c:\program files (x86)\Sony\Sony PC Companion\PCCompanion.exe" [2014-11-27 466144]
"Copernic Desktop Search - Home"="c:\program files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" [2013-01-28 1692200]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2014-06-05 248176]
"FBackup 5 Tray Agent"="c:\program files (x86)\Softland\FBackup 5\bTray.exe" [2014-09-30 7862840]
"Web Companion"="c:\program files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" [2014-11-27 1467200]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-12-11 30877280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-05 336384]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-28 168504]
"NeroCheck"="c:\windows\SysWOW64\NeroCheck.exe" [2001-07-09 155648]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-02-12 127792]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-11-24 702768]
.
c:\users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Dropbox.lnk - c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-2-11 42555824]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office\OSA9.EXE -b -l [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FBackup5Srv]
@="Service"
.
R2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 ggflt;SOMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 ggsomc;SOMC USB Flash Driver;c:\windows\system32\DRIVERS\ggsomc.sys;c:\windows\SYSNATIVE\DRIVERS\ggsomc.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 DBService;DATA BECKER Update Service;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 FBackup5Srv;FBackup 5 Service;c:\program files (x86)\Softland\FBackup 5\bService.exe;c:\program files (x86)\Softland\FBackup 5\bService.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 LavasoftTcpService;LavasoftTcpService;c:\program files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe;c:\program files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
S2 SearchProtectionService;IE Search Set;c:\program files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe;c:\program files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-22 08:14]
.
2015-02-28 c:\windows\Tasks\HPCeeScheduleForxxx-NB.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12	185824	----a-w-	c:\users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-27 42808]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-04-03 2777736]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{5786d022-540e-4699-b350-b4be0ae94b79} - (no file)
Wow6432Node-HKLM-Run-Easybits Recovery - c:\program files (x86)\EasyBits For Kids\ezRecover.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\ezSharedSvcHost.exe
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files (x86)\ Malwarebytes Anti-Malware \mbam.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Adobe\Reader 11.0\Reader\Reader_sl.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-03-02  17:05:01 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-03-02 16:04
.
Vor Suchlauf: 16 Verzeichnis(se), 394.045.059.072 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 393.972.158.464 Bytes frei
.
- - End Of File - - 8EAF2071F82A04B3F672F36D9C7B25EB
A36C5E4F47E84449FF07ED3517B43A31
         
Gruß,

Annoo


Alt 03.03.2015, 06:08   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
--> Ungewünschte Werbebanner Firefox

Alt 03.03.2015, 08:41   #7
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Logfiles divers



Hallo Schrauber,

hier nun die Logfiles:

Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 03.03.2015
Suchlauf-Zeit: 07:35:56
Logdatei: malwarbytes-logfile.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.03.01
Rootkit Datenbank: v2015.02.25.01
Lizenz: Premium
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: xxx-NB

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 361630
Verstrichene Zeit: 49 Min, 35 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         
Code:
ATTFilter
# AdwCleaner v4.111 - Bericht erstellt 03/03/2015 um 08:49:56
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-03-02.3 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : xxx-NB - xxx-NB-HP
# Gestarted von : C:\Users\xxx-NB\Downloads\AdwCleaner_4.111(1).exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\xxx-NB\Documents\Updater

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v9.0.8112.16609


-\\ Mozilla Firefox v36.0 (x86 de)


-\\ Google Chrome v


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [8586 Bytes] - [27/02/2015 21:07:30]
AdwCleaner[R1].txt - [1027 Bytes] - [03/03/2015 08:28:51]
AdwCleaner[S0].txt - [8388 Bytes] - [27/02/2015 22:36:10]
AdwCleaner[S1].txt - [951 Bytes] - [03/03/2015 08:49:56]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1009  Bytes] ##########
         
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.3 (03.01.2015:1)
OS: Windows 7 Home Premium x64
Ran by xxx-NB on 03.03.2015 at  9:00:43,93
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"



~~~ FireFox

Successfully deleted the following from C:\Users\xxx-NB\AppData\Roaming\mozilla\firefox\profiles\4c8imuhi.default\prefs.js

user_pref("CT2481020_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1360769101122,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}
Emptied folder: C:\Users\xxx-NB\AppData\Roaming\mozilla\firefox\profiles\4c8imuhi.default\minidumps [186 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.03.2015 at  9:11:51,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-03-2015
Ran by xxx-NB (administrator) on xxx-NB-HP on 03-03-2015 09:28:23
Running from C:\Users\xxx-NB\Downloads
Loaded Profiles: xxx-NB (Available profiles: xxx-NB)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe
(Softland) C:\Program Files (x86)\Softland\FBackup 5\bTray.exe
(Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(Dropbox, Inc.) C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearch.exe
(Farbar) C:\Users\xxx-NB\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [NeroCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466144 2014-11-27] (Sony)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Copernic Desktop Search - Home] => C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe [1692200 2013-01-28] (Copernic Inc.)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [FBackup 5 Tray Agent] => C:\Program Files (x86)\Softland\FBackup 5\bTray.exe [7862840 2014-09-30] (Softland)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1467200 2014-11-27] (Lavasoft)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {70DDF8F1-81D4-4DFA-B8E3-6E3A6E6EA9EF} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default
FF NewTab: hxxp://www.google.de/
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1588870830-359060440-1081868607-1001: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-maps.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-11-17]
FF Extension: Avira Browser Safety - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\abs@avira.com [2015-02-27]
FF Extension: Adblock Plus - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-11]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-01-18]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-18]
FF HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Firefox\Extensions: [{57319509-7821-41B0-9FDF-3B58F146AE33}] - c:\program files (x86)\copernic desktop search - home\firefoxconnector
FF Extension: Copernic Desktop Search - Search Firefox content - c:\program files (x86)\copernic desktop search - home\firefoxconnector [2013-07-31]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-03]
CHR Extension: (Google Drive) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-03]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-21]
CHR Extension: (YouTube) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-03]
CHR Extension: (Google Search) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-03]
CHR Extension: (Avira Browser Safety) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-21]
CHR Extension: (Skype Click to Call) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-02-21]
CHR Extension: (Google Wallet) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Gmail) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-03]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-07-18] (Adobe Systems) [File not signed]
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
S2 FBackup5Srv; C:\Program Files (x86)\Softland\FBackup 5\bService.exe [4642360 2014-09-30] (Softland)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-03-12] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed]
R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [1351512 2014-11-27] (Lavasoft Limited)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [15208 2014-11-27] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-17] (Sony Mobile Communications)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-11-12] (Windows (R) Win 7 DDK provider)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 09:27 - 2015-03-03 09:27 - 02092544 _____ (Farbar) C:\Users\xxx-NB\Downloads\FRST64(1).exe
2015-03-03 09:11 - 2015-03-03 09:11 - 00001437 _____ () C:\Users\xxx-NB\Desktop\JRT.txt
2015-03-03 09:00 - 2015-03-03 09:00 - 01388333 _____ (Thisisu) C:\Users\xxx-NB\Downloads\JRT.exe
2015-03-03 08:27 - 2015-03-03 08:27 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111(1).exe
2015-03-02 17:21 - 2015-03-02 17:21 - 00026096 _____ () C:\Users\xxx-NB\Documents\ComboFix-AN.txt
2015-03-02 17:05 - 2015-03-02 17:05 - 00026171 _____ () C:\ComboFix.txt
2015-03-02 15:35 - 2015-03-02 17:05 - 00000000 ____D () C:\Qoobox
2015-03-02 15:35 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-02 15:35 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-02 15:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-02 15:34 - 2015-03-02 17:00 - 00000000 ____D () C:\Windows\erdnt
2015-03-02 15:33 - 2015-03-02 15:33 - 05612482 ____R (Swearware) C:\Users\xxx-NB\Downloads\ComboFix.exe
2015-03-02 12:34 - 2015-03-02 12:34 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xxx-NB\Downloads\revosetup95.exe
2015-03-02 12:34 - 2015-03-02 12:34 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-02 11:26 - 2015-03-02 11:27 - 00103576 _____ () C:\Users\xxx-NB\Downloads\abasan2.ttf
2015-03-01 16:45 - 2015-03-01 17:16 - 00040115 _____ () C:\Users\xxx-NB\Downloads\Addition.txt
2015-03-01 16:41 - 2015-03-03 09:28 - 00026655 _____ () C:\Users\xxx-NB\Downloads\FRST.txt
2015-03-01 16:41 - 2015-03-03 09:28 - 00000000 ____D () C:\FRST
2015-03-01 16:38 - 2015-03-01 16:38 - 02092544 _____ (Farbar) C:\Users\xxx-NB\Downloads\FRST64.exe
2015-02-28 18:42 - 2015-02-28 18:42 - 00000000 _____ () C:\Users\xxx-NB\defogger_reenable
2015-02-28 18:41 - 2015-02-28 18:44 - 00000480 _____ () C:\Users\xxx-NB\Downloads\defogger_disable.log
2015-02-28 18:41 - 2015-02-28 18:41 - 00000252 _____ () C:\Users\xxx-NB\Downloads\defogger_enable.log
2015-02-28 18:39 - 2015-02-28 18:39 - 00050477 _____ () C:\Users\xxx-NB\Downloads\Defogger.exe
2015-02-28 16:57 - 2015-03-01 09:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\10777241.sys
2015-02-28 16:44 - 2015-02-28 16:44 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-28 16:43 - 2015-02-28 16:43 - 20447120 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam_premium.exe
2015-02-28 14:58 - 2015-02-28 16:48 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForxxx-NB.job
2015-02-28 14:58 - 2015-02-28 14:58 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForxxx-NB
2015-02-28 14:47 - 2015-02-28 14:44 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-02-27 23:04 - 2015-02-27 23:04 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Avira
2015-02-27 22:58 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-02-27 22:58 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-02-27 22:58 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-02-27 22:54 - 2015-02-27 23:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-27 22:51 - 2015-02-27 22:51 - 04582672 _____ (Avira Operations & Co. KG) C:\Users\xxx-NB\Downloads\avira_de_av_5876132996__ws.exe
2015-02-27 21:07 - 2015-03-03 08:49 - 00000000 ____D () C:\AdwCleaner
2015-02-27 21:07 - 2015-02-27 21:07 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111.exe
2015-02-26 20:02 - 2015-03-03 08:52 - 00000672 _____ () C:\Windows\setupact.log
2015-02-26 20:02 - 2015-03-02 16:48 - 00135728 _____ () C:\Windows\PFRO.log
2015-02-26 20:02 - 2015-02-26 20:02 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-26 18:18 - 2015-03-03 08:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-26 18:18 - 2014-11-21 07:08 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-26 18:18 - 2014-11-21 07:07 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-26 18:18 - 2014-11-21 07:07 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-26 18:14 - 2015-02-26 18:17 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-25 23:19 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 23:19 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 20:10 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 20:10 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 20:10 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 20:10 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-25 18:22 - 2015-02-25 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-02-15 11:50 - 2015-01-23 05:07 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-15 11:50 - 2015-01-23 04:59 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-15 11:50 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-15 11:50 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-14 14:18 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-14 14:18 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-14 14:18 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-14 14:18 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-14 14:18 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-14 14:18 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-14 14:18 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-14 14:18 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-14 14:18 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-14 14:18 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-14 14:18 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-14 14:18 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-02-14 14:18 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-14 14:18 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-14 14:18 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-02-14 14:18 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-14 14:18 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-14 14:18 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-14 14:18 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-14 14:18 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-14 14:18 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-02-14 14:18 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-02-14 13:12 - 2015-02-14 13:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2015-02-14 13:12 - 2015-02-14 13:12 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-02-14 13:11 - 2015-02-14 13:11 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-02-14 13:11 - 2015-02-14 13:11 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-02-14 13:11 - 2015-02-14 13:11 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2015-02-13 11:03 - 2015-02-26 18:27 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\PDFCreator
2015-02-11 22:09 - 2015-02-11 22:09 - 00010495 _____ () C:\Users\xxx-NB\Downloads\xxx_elster_11.02.2015.pfx
2015-02-11 16:33 - 2015-02-14 13:54 - 00001405 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-02-11 08:03 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 08:03 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 08:03 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 08:01 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 08:01 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 08:01 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 08:01 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 08:01 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 08:01 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 08:01 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 08:01 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 08:01 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 08:01 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 08:01 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 08:01 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 08:01 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 08:01 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 08:01 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 08:01 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 08:01 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 08:00 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 08:00 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 08:00 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 08:00 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 08:00 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 08:00 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 07:59 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 07:59 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 07:59 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 07:59 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 07:59 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-02-11 07:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 07:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 07:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 07:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 07:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 07:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 07:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 07:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 07:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 07:53 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-10 23:01 - 2015-02-10 23:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2015-02-10 23:00 - 2015-02-26 17:47 - 00000000 ____D () C:\Program Files\PDFCreator
2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Opera Software
2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Opera Software
2015-02-10 23:00 - 2015-01-22 16:14 - 00114872 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2015-02-10 22:58 - 2015-02-11 15:59 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-10 22:49 - 2015-02-10 22:49 - 27721680 _____ (pdfforge ) C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup(1).exe
2015-02-10 16:50 - 2015-02-10 16:50 - 00001464 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk
2015-02-10 16:50 - 2015-02-10 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
2015-02-10 16:48 - 2015-02-10 16:48 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-02-10 16:45 - 2015-02-10 16:46 - 215975048 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113k.exe
2015-02-05 11:21 - 2015-02-05 11:21 - 115978680 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113p.exe
2015-02-05 11:13 - 2015-02-05 11:14 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u(1).exe
2015-02-05 09:14 - 2015-02-05 09:14 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-02-04 21:24 - 2015-02-10 10:49 - 00000000 ____D () C:\Users\xxx-NB\Desktop\steuerformulare
2015-02-04 21:22 - 2015-02-10 16:51 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\elsterformular
2015-02-04 20:52 - 2015-02-05 11:23 - 00000000 ____D () C:\ProgramData\elsterformular
2015-02-04 20:43 - 2015-02-04 20:45 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u.exe
2015-02-01 13:13 - 2015-02-01 13:13 - 00000000 ____D () C:\Users\xxx-NB\Documents\Steuer-Sparbuch
2015-02-01 12:58 - 2015-02-01 13:16 - 27721680 _____ (pdfforge ) C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup.exe
2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Buhl Data Service
2015-02-01 12:14 - 2015-02-01 12:14 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Buhl Data Service
2015-02-01 12:10 - 2015-02-01 12:17 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Buhl
2015-02-01 12:10 - 2015-02-01 12:14 - 00000103 _____ () C:\Windows\wiso.ini
2015-02-01 11:50 - 2015-02-01 11:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WISO Steuer-Sparbuch 2015
2015-02-01 11:46 - 2015-02-01 11:46 - 00000000 ____D () C:\Program Files (x86)\WISO
2015-02-01 11:44 - 2015-02-01 12:10 - 00000000 ____D () C:\ProgramData\Buhl Data Service GmbH

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 09:28 - 2012-01-28 21:58 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Skype
2015-03-03 09:14 - 2015-01-22 12:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-03 09:04 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-03 09:04 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-03 08:55 - 2014-09-22 17:53 - 00000000 ___RD () C:\Users\xxx-NB\Dropbox
2015-03-03 08:55 - 2014-04-08 08:19 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Dropbox
2015-03-03 08:52 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-03 08:50 - 2011-11-07 10:37 - 01340383 _____ () C:\Windows\WindowsUpdate.log
2015-03-02 17:16 - 2012-01-26 15:21 - 00080040 _____ () C:\Users\xxx-NB\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-02 17:05 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-03-02 16:54 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-02 16:50 - 2009-07-14 05:45 - 00330216 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-02 09:50 - 2012-01-26 15:23 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA7BE238-D6AB-4111-8246-3DC85ACF4280}
2015-03-01 09:05 - 2011-08-09 21:16 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2015-03-01 09:05 - 2011-08-09 21:16 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2015-03-01 09:05 - 2009-07-14 06:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-28 18:42 - 2012-01-26 15:18 - 00000000 ____D () C:\Users\xxx-NB
2015-02-28 17:01 - 2013-02-08 18:09 - 00053248 _____ () C:\Users\xxx-NB\Documents\laggie.xls
2015-02-28 14:56 - 2012-02-07 10:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\ProgramData\Avira
2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-27 22:53 - 2014-08-05 09:35 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-27 22:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-27 20:59 - 2013-11-12 11:45 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2015-02-27 20:57 - 2014-06-18 15:26 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\SoftGrid Client
2015-02-26 20:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\TAPI
2015-02-26 17:42 - 2012-03-03 18:11 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\CrashDumps
2015-02-26 17:42 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther
2015-02-26 12:03 - 2014-07-22 13:57 - 00000000 ____D () C:\Users\xxx-NB\Documents\privat
2015-02-26 07:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-25 18:21 - 2015-01-18 14:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-25 18:21 - 2012-05-09 22:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-23 08:27 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-02-21 18:16 - 2014-05-03 18:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-14 13:54 - 2012-01-26 15:23 - 00001439 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-14 13:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-12 06:43 - 2014-12-10 16:39 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 06:43 - 2014-05-14 13:26 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 23:54 - 2014-06-18 13:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 23:49 - 2013-08-19 10:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 23:36 - 2012-01-31 13:14 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 07:25 - 2014-09-22 12:34 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-10 22:51 - 2013-08-02 09:33 - 00000000 ____D () C:\Users\xxx-NB\Documents\steuern
2015-02-06 13:44 - 2014-07-21 13:36 - 00000000 ____D () C:\Users\xxx-NB\Documents\Uni
2015-02-05 09:14 - 2015-01-22 12:57 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 09:14 - 2015-01-22 12:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 09:14 - 2015-01-22 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-01 11:46 - 2011-08-09 12:26 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

==================== Files in the root of some directories =======

2014-12-01 13:18 - 2014-12-01 16:47 - 2929335 _____ () C:\Program Files (x86)\MysticThumbs.zip
2014-09-19 19:28 - 2014-09-19 19:28 - 0000000 _____ () C:\Users\xxx-NB\AppData\Roaming\downloads.m3u

Files to move or delete:
====================
C:\Users\xxx-NB\ccsetup412.exe


Some content of TEMP:
====================
C:\Users\xxx-NB\AppData\Local\Temp\avgnt.exe
C:\Users\xxx-NB\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplxg1wn.dll
C:\Users\xxx-NB\AppData\Local\Temp\Quarantine.exe
C:\Users\xxx-NB\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-27 21:37

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Gruss, Annoo

Alt 03.03.2015, 08:47   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.03.2015, 09:00   #9
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Installationsproblem



Hallo,

bei der Installation von ESET erscheint folgende Fehlermeldung:
"Updates funktionieren nicht. Ist ein Proxy eingerichtet?"

Was tun?

Gruß,

Annoo

Alt 03.03.2015, 14:57   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Lass ESET weg.

Lade Dir bitte von hier Emsisoft Emergency Kit Download Emsisoft Emergency Kit herunter.
  • Bitte installiere das Programm in den vorgegebenen Pfad.
  • Starte das Programm durch Doppelklick der Desktopverknüpfung.
  • Das EEK ist nach dem Laden der Malwaresignaturen für den Scan bereit.
  • Folge nun bitte der bebilderten Bildanleitung zu Emergency Kit, entferne alle Funde und poste am Ende des Scans bzw. der Bereinigung das Log.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.03.2015, 16:36   #11
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Hallo,

soll ich das Emsisoft Emergency Kit herunter laden nachdem ich den SecurityCheck gemacht habe oder soll ich den SecurityCheck auch auslassen?

Gruß

Annoo

Ach und ich kann seit heute mein Corel Draw nicht mehr öffnen, ich bekomme die Fehlermeldung Microsoft Visual C++ Runtime error, "abnormal programm termination". Hängt das damit zusammen und was kann ich dagegen tun?

Gruß und Danke vorab

Annoo

Alt 04.03.2015, 07:40   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Microsoft Visual C++ Runtime deinstallieren, über Windows Update neu laden. Reihenfolge von EEK und Securitycheck is egal
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 04.03.2015, 15:07   #13
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Hallo,

hier die Datan bzw. Funde:

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.96  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Ad-Aware 
 Spyware Terminator 2012   
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Adobe Reader XI  
 Mozilla Firefox (36.0) 
 Mozilla Thunderbird (31.5.0) 
````````Process Check: objlist.exe by Laurent````````  
 Ad-Aware AAWService.exe is disabled! 
 Ad-Aware AAWTray.exe is disabled! 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         
Code:
ATTFilter
Emsisoft Emergency Kit - Version 9.0
Letztes Update: 04.03.2015 11:04:18
Benutzerkonto: xxx-NB-HP\xxx-NB

Scan-Einstellungen:

Scan Methode: Detail-Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\, G:\, Q:\

PUPs-Erkennung: An
Archiv-Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan-Beginn:	04.03.2015 11:05:57
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR 	gefunden: Setting.DisableTaskMgr (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS 	gefunden: Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS 	gefunden: Setting.DisableRegistryTools (A)
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir 	gefunden: Application.Win32.WebToolbar (A)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 417) -> [Subject: ᅢテᅤモberprᅢテᅡᄐfen Sie die Richtigkeit der Z][Date: Sat, 9 Nov 2013 17:10:20 +0300] -> (MIME part) -> Transaction09112013.rar -> Transaction09112013.scr 	gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 418) -> [Subject: Neuer Beitrag Zahlung][Date: Sun, 10 Nov 2013 11:42:51 +0300] -> (MIME part) -> payment_10112013.rar -> payment_10112013.scr 	gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 455) -> [Subject: =?UTF-8?B?RGF0ZW4=?=][Date: Wed, 27 Nov 2013 18:15:25 +0400] -> (MIME part) -> =?UTF-8?B?RENJTV9KUEVHMjAxMzI2MTEuc2NyX -> DCIM_JPEG20132611.scr.exe 	gefunden: Gen:Variant.Zusy.73571 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash -> (message 417) -> [Subject: ᅢテᅤモberprᅢテᅡᄐfen Sie die Richtigkeit der Z][Date: Sat, 9 Nov 2013 17:10:20 +0300] -> (MIME part) -> Transaction09112013.rar -> Transaction09112013.scr 	gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash -> (message 418) -> [Subject: Neuer Beitrag Zahlung][Date: Sun, 10 Nov 2013 11:42:51 +0300] -> (MIME part) -> payment_10112013.rar -> payment_10112013.scr 	gefunden: Gen:Heur.FKP.21 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash -> (message 455) -> [Subject: =?UTF-8?B?RGF0ZW4=?=][Date: Wed, 27 Nov 2013 18:15:25 +0400] -> (MIME part) -> =?UTF-8?B?RENJTV9KUEVHMjAxMzI2MTEuc2NyX -> DCIM_JPEG20132611.scr.exe 	gefunden: Gen:Variant.Zusy.73571 (B)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup(1).exe 	gefunden: Application.Win32.InstallMon (A)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup.exe 	gefunden: Application.Win32.InstallMon (A)
G:\xxx-NB-HP\Backup Set 2015-01-15 182435\Backup Files 2015-02-09 091537\Backup files 1.zip -> C\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\Local Folders\Trash -> (message 119) -> [Subject: Unterlagen][Date: Sun, 1 Feb 2015 21:25:50 +0300] -> (MIME part) -> Zahlungsbeleg.zip -> Zahlungsbeleg.scr 	gefunden: Trojan.Agent.BHNJ (B)
G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 417) -> [Subject: ᅢテᅤモberprᅢテᅡᄐfen Sie die Richtigkeit der Z][Date: Sat, 9 Nov 2013 17:10:20 +0300] -> (MIME part) -> Transaction09112013.rar -> Transaction09112013.scr 	gefunden: Gen:Heur.FKP.21 (B)
G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 418) -> [Subject: Neuer Beitrag Zahlung][Date: Sun, 10 Nov 2013 11:42:51 +0300] -> (MIME part) -> payment_10112013.rar -> payment_10112013.scr 	gefunden: Gen:Heur.FKP.21 (B)
G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash -> (message 455) -> [Subject: =?UTF-8?B?RGF0ZW4=?=][Date: Wed, 27 Nov 2013 18:15:25 +0400] -> (MIME part) -> =?UTF-8?B?RENJTV9KUEVHMjAxMzI2MTEuc2NyX -> DCIM_JPEG20132611.scr.exe 	gefunden: Gen:Variant.Zusy.73571 (B)

Gescannt	255912
Gefunden	16

Scan-Ende:	04.03.2015 16:00:41
Scan-Zeit:	4:54:44

G:\Daten-17-07-14\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash	Quarantäne Gen:Variant.Zusy.73571 (B)
G:\xxx-NB-HP\Backup Set 2015-01-15 182435\Backup Files 2015-02-09 091537\Backup files 1.zip	Quarantäne Trojan.Agent.BHNJ (B)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup.exe	Quarantäne Application.Win32.InstallMon (A)
C:\Users\xxx-NB\Downloads\PDFCreator-2_0_2-setup(1).exe	Quarantäne Application.Win32.InstallMon (A)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\kwrs5619.default\Mail\mx.freenet.de\Trash	Quarantäne Gen:Variant.Zusy.73571 (B)
C:\Users\xxx-NB\AppData\Roaming\Thunderbird\Profiles\evzxm2sl.default\Mail\mx.freenet.de\Trash	Quarantäne Gen:Variant.Zusy.73571 (B)
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir	Quarantäne Application.Win32.WebToolbar (A)
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS	Quarantäne Setting.DisableRegistryTools (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS	Quarantäne Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR	Quarantäne Setting.DisableTaskMgr (A)

Quarantäne	10
         
Oje, ich hoffe, die Funde sind nicht tragisch...

Gruß,

Annoo

Alt 04.03.2015, 16:27   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox





Frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 04.03.2015, 17:16   #15
11annoo
 
Ungewünschte Werbebanner Firefox - Standard

Ungewünschte Werbebanner Firefox



Hallo,

hier FRST-txt

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015
Ran by xxx-NB (administrator) on xxx-NB-HP on 04-03-2015 17:36:39
Running from C:\Users\xxx-NB\Downloads
Loaded Profiles: xxx-NB (Available profiles: xxx-NB)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(DATA BECKER GmbH & Co KG) C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Softland) C:\Program Files (x86)\Softland\FBackup 5\bService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
() C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Softland) C:\Program Files (x86)\Softland\FBackup 5\bTray.exe
(Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
() C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe
(Dropbox, Inc.) C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avrestart.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Copernic Inc.) C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearch.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SetDefault] => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [NeroCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466144 2014-11-27] (Sony)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Copernic Desktop Search - Home] => C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe [1692200 2013-01-28] (Copernic Inc.)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [FBackup 5 Tray Agent] => C:\Program Files (x86)\Softland\FBackup 5\bTray.exe [7862840 2014-09-30] (Softland)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1467200 2014-11-27] (Lavasoft)
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\xxx-NB\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1588870830-359060440-1081868607-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1588870830-359060440-1081868607-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {70DDF8F1-81D4-4DFA-B8E3-6E3A6E6EA9EF} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> {F508C8AB-762D-4759-BA05-C8D219F6E582} URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKU\S-1-5-21-1588870830-359060440-1081868607-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default
FF NewTab: hxxp://www.google.de/
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\9\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1588870830-359060440-1081868607-1001: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\searchplugins\google-maps.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-11-17]
FF Extension: Avira Browser Safety - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\abs@avira.com [2015-02-27]
FF Extension: Adblock Plus - C:\Users\xxx-NB\AppData\Roaming\Mozilla\Firefox\Profiles\4c8imuhi.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-11]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-01-18]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-18]
FF HKU\S-1-5-21-1588870830-359060440-1081868607-1001\...\Firefox\Extensions: [{57319509-7821-41B0-9FDF-3B58F146AE33}] - c:\program files (x86)\copernic desktop search - home\firefoxconnector
FF Extension: Copernic Desktop Search - Search Firefox content - c:\program files (x86)\copernic desktop search - home\firefoxconnector [2013-07-31]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-03]
CHR Extension: (Google Drive) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-03]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-21]
CHR Extension: (YouTube) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-03]
CHR Extension: (Google Search) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-03]
CHR Extension: (Avira Browser Safety) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-21]
CHR Extension: (Skype Click to Call) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-02-21]
CHR Extension: (Google Wallet) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Gmail) - C:\Users\xxx-NB\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-03]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-07-18] (Adobe Systems) [File not signed]
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-04] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 FBackup5Srv; C:\Program Files (x86)\Softland\FBackup 5\bService.exe [4642360 2014-09-30] (Softland)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-03-12] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed]
R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.2.9.5\LavasoftTcpService.exe [1351512 2014-11-27] (Lavasoft Limited)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [15208 2014-11-27] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
R3 cleanhlp; C:\EEK\bin\cleanhlp64.sys [57024 2015-03-04] (Emsisoft GmbH)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-17] (Sony Mobile Communications)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-04] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-11-12] (Windows (R) Win 7 DDK provider)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 17:34 - 2015-03-04 17:34 - 00000000 ____D () C:\Users\xxx-NB\Downloads\FRST-OlderVersion
2015-03-04 11:00 - 2015-03-04 11:00 - 00000743 _____ () C:\Users\xxx-NB\Desktop\Start Emsisoft Emergency Kit.lnk
2015-03-04 10:59 - 2015-03-04 11:01 - 00000000 ____D () C:\EEK
2015-03-04 10:34 - 2015-03-04 10:34 - 00852594 _____ () C:\Users\xxx-NB\Downloads\SecurityCheck.exe
2015-03-04 10:20 - 2015-03-04 10:22 - 166189904 _____ () C:\Users\xxx-NB\Downloads\EmsisoftEmergencyKit.exe
2015-03-03 09:56 - 2015-03-03 09:56 - 02347384 _____ (ESET) C:\Users\xxx-NB\Downloads\esetsmartinstaller_deu.exe
2015-03-03 09:56 - 2015-03-03 09:56 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-03 09:11 - 2015-03-03 09:11 - 00001437 _____ () C:\Users\xxx-NB\Desktop\JRT.txt
2015-03-03 09:00 - 2015-03-03 09:00 - 01388333 _____ (Thisisu) C:\Users\xxx-NB\Downloads\JRT.exe
2015-03-03 08:27 - 2015-03-03 08:27 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111(1).exe
2015-03-02 17:21 - 2015-03-02 17:21 - 00026096 _____ () C:\Users\xxx-NB\Documents\ComboFix-AN.txt
2015-03-02 17:05 - 2015-03-02 17:05 - 00026171 _____ () C:\ComboFix.txt
2015-03-02 15:35 - 2015-03-02 17:05 - 00000000 ____D () C:\Qoobox
2015-03-02 15:35 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-02 15:35 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-02 15:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-02 15:35 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-02 15:34 - 2015-03-02 17:00 - 00000000 ____D () C:\Windows\erdnt
2015-03-02 15:33 - 2015-03-02 15:33 - 05612482 ____R (Swearware) C:\Users\xxx-NB\Downloads\ComboFix.exe
2015-03-02 12:34 - 2015-03-02 12:34 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\xxx-NB\Downloads\revosetup95.exe
2015-03-02 12:34 - 2015-03-02 12:34 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-03-02 11:26 - 2015-03-02 11:27 - 00103576 _____ () C:\Users\xxx-NB\Downloads\abasan2.ttf
2015-03-01 16:45 - 2015-03-01 17:16 - 00040115 _____ () C:\Users\xxx-NB\Downloads\Addition.txt
2015-03-01 16:41 - 2015-03-04 17:36 - 00027026 _____ () C:\Users\xxx-NB\Downloads\FRST.txt
2015-03-01 16:41 - 2015-03-04 17:36 - 00000000 ____D () C:\FRST
2015-03-01 16:38 - 2015-03-04 17:34 - 02093056 _____ (Farbar) C:\Users\xxx-NB\Downloads\FRST64.exe
2015-02-28 18:42 - 2015-02-28 18:42 - 00000000 _____ () C:\Users\xxx-NB\defogger_reenable
2015-02-28 18:41 - 2015-02-28 18:44 - 00000480 _____ () C:\Users\xxx-NB\Downloads\defogger_disable.log
2015-02-28 18:41 - 2015-02-28 18:41 - 00000252 _____ () C:\Users\xxx-NB\Downloads\defogger_enable.log
2015-02-28 18:39 - 2015-02-28 18:39 - 00050477 _____ () C:\Users\xxx-NB\Downloads\Defogger.exe
2015-02-28 16:57 - 2015-03-01 09:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\10777241.sys
2015-02-28 16:44 - 2015-02-28 16:44 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-28 16:43 - 2015-02-28 16:43 - 20447120 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam_premium.exe
2015-02-28 14:58 - 2015-03-04 14:58 - 00003210 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForxxx-NB
2015-02-28 14:58 - 2015-03-04 14:58 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForxxx-NB.job
2015-02-28 14:47 - 2015-03-04 13:45 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-02-27 23:04 - 2015-02-27 23:04 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Avira
2015-02-27 22:58 - 2015-03-04 13:45 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-02-27 22:58 - 2015-03-04 13:45 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-02-27 22:58 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-02-27 22:54 - 2015-02-27 23:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-27 22:51 - 2015-02-27 22:51 - 04582672 _____ (Avira Operations & Co. KG) C:\Users\xxx-NB\Downloads\avira_de_av_5876132996__ws.exe
2015-02-27 21:07 - 2015-03-03 08:49 - 00000000 ____D () C:\AdwCleaner
2015-02-27 21:07 - 2015-02-27 21:07 - 02126848 _____ () C:\Users\xxx-NB\Downloads\AdwCleaner_4.111.exe
2015-02-26 20:02 - 2015-03-04 07:38 - 00000784 _____ () C:\Windows\setupact.log
2015-02-26 20:02 - 2015-03-02 16:48 - 00135728 _____ () C:\Windows\PFRO.log
2015-02-26 20:02 - 2015-02-26 20:02 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-26 18:18 - 2015-03-04 17:27 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-26 18:18 - 2015-02-28 16:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-26 18:18 - 2014-11-21 07:08 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-26 18:18 - 2014-11-21 07:07 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-26 18:18 - 2014-11-21 07:07 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-26 18:14 - 2015-02-26 18:17 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx-NB\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-25 23:19 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 23:19 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-25 20:10 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-25 20:10 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-25 20:10 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-25 20:10 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-25 18:22 - 2015-02-25 19:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-02-15 11:50 - 2015-01-23 05:07 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-15 11:50 - 2015-01-23 04:59 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-15 11:50 - 2015-01-23 04:00 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-15 11:50 - 2015-01-23 03:51 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-14 14:18 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-14 14:18 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-14 14:18 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-14 14:18 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-14 14:18 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-14 14:18 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-14 14:18 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-14 14:18 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-14 14:18 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-14 14:18 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-14 14:18 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-14 14:18 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-14 14:18 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-14 14:18 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-02-14 14:18 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-14 14:18 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-14 14:18 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-02-14 14:18 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-14 14:18 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-14 14:18 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-14 14:18 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-02-14 14:18 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-14 14:18 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-14 14:18 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-02-14 14:18 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-02-14 14:18 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-02-14 13:12 - 2015-02-14 13:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2015-02-14 13:12 - 2015-02-14 13:12 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2015-02-14 13:11 - 2015-02-14 13:11 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-02-14 13:11 - 2015-02-14 13:11 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00434176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00403248 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00353584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00227840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00203776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00160256 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-02-14 13:11 - 2015-02-14 13:11 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2015-02-14 13:11 - 2015-02-14 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2015-02-14 13:11 - 2015-02-14 13:11 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-02-14 13:11 - 2015-02-14 13:11 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2015-02-13 11:03 - 2015-02-26 18:27 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\PDFCreator
2015-02-11 22:09 - 2015-02-11 22:09 - 00010495 _____ () C:\Users\xxx-NB\Downloads\xxx_elster_11.02.2015.pfx
2015-02-11 16:33 - 2015-02-14 13:54 - 00001405 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-02-11 08:03 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 08:03 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 08:03 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 08:03 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 08:01 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 08:01 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 08:01 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 08:01 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 08:01 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 08:01 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 08:01 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 08:01 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 08:01 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 08:01 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 08:01 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 08:01 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 08:01 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 08:01 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 08:01 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 08:01 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 08:01 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 08:01 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 08:00 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 08:00 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 08:00 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 08:00 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 08:00 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 08:00 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 07:59 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 07:59 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 07:59 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 07:59 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 07:59 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-02-11 07:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 07:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 07:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 07:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 07:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 07:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 07:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 07:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 07:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 07:53 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-10 23:01 - 2015-02-10 23:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2015-02-10 23:00 - 2015-02-26 17:47 - 00000000 ____D () C:\Program Files\PDFCreator
2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Opera Software
2015-02-10 23:00 - 2015-02-10 23:00 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\Opera Software
2015-02-10 23:00 - 2015-01-22 16:14 - 00114872 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2015-02-10 22:58 - 2015-02-11 15:59 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-10 16:50 - 2015-02-10 16:50 - 00001464 _____ () C:\Users\Public\Desktop\ElsterFormular.lnk
2015-02-10 16:50 - 2015-02-10 16:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
2015-02-10 16:48 - 2015-02-10 16:48 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-02-10 16:45 - 2015-02-10 16:46 - 215975048 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113k.exe
2015-02-05 11:21 - 2015-02-05 11:21 - 115978680 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113p.exe
2015-02-05 11:13 - 2015-02-05 11:14 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u(1).exe
2015-02-05 09:14 - 2015-02-05 09:14 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-02-04 21:24 - 2015-02-10 10:49 - 00000000 ____D () C:\Users\xxx-NB\Desktop\steuerformulare
2015-02-04 21:22 - 2015-02-10 16:51 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\elsterformular
2015-02-04 20:52 - 2015-02-05 11:23 - 00000000 ____D () C:\ProgramData\elsterformular
2015-02-04 20:43 - 2015-02-04 20:45 - 176389328 _____ (Landesfinanzdirektion Thüringen) C:\Users\xxx-NB\Downloads\ElsterFormular-16.0.20150113u.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 17:39 - 2012-01-28 21:58 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Skype
2015-03-04 17:14 - 2015-01-22 12:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-04 14:17 - 2011-11-07 10:37 - 01411240 _____ () C:\Windows\WindowsUpdate.log
2015-03-04 11:15 - 2012-01-26 15:23 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DA7BE238-D6AB-4111-8246-3DC85ACF4280}
2015-03-04 07:52 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-04 07:52 - 2009-07-14 05:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-04 07:42 - 2014-09-22 17:53 - 00000000 ___RD () C:\Users\xxx-NB\Dropbox
2015-03-04 07:42 - 2014-04-08 08:19 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Dropbox
2015-03-04 07:38 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-03 17:34 - 2012-03-03 18:11 - 00000000 ____D () C:\Users\xxx-NB\AppData\Local\CrashDumps
2015-03-03 09:56 - 2011-08-09 21:16 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2015-03-03 09:56 - 2011-08-09 21:16 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2015-03-03 09:56 - 2009-07-14 06:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-02 17:16 - 2012-01-26 15:21 - 00080040 _____ () C:\Users\xxx-NB\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-02 17:05 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-03-02 16:54 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-02 16:50 - 2009-07-14 05:45 - 00330216 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-28 18:42 - 2012-01-26 15:18 - 00000000 ____D () C:\Users\xxx-NB
2015-02-28 17:01 - 2013-02-08 18:09 - 00053248 _____ () C:\Users\xxx-NB\Documents\laggie.xls
2015-02-28 14:56 - 2012-02-07 10:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\ProgramData\Avira
2015-02-27 22:58 - 2014-03-22 23:39 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-27 22:53 - 2014-08-05 09:35 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-27 22:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-27 20:59 - 2013-11-12 11:45 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2015-02-27 20:57 - 2014-06-18 15:26 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\SoftGrid Client
2015-02-26 20:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\TAPI
2015-02-26 17:42 - 2007-01-02 02:25 - 00000000 ____D () C:\Windows\Panther
2015-02-26 12:03 - 2014-07-22 13:57 - 00000000 ____D () C:\Users\xxx-NB\Documents\privat
2015-02-26 07:06 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-25 18:21 - 2015-01-18 14:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-25 18:21 - 2012-05-09 22:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-23 08:27 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-02-21 18:16 - 2014-05-03 18:27 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-14 13:54 - 2012-01-26 15:23 - 00001439 _____ () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-14 13:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-12 06:43 - 2014-12-10 16:39 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 06:43 - 2014-05-14 13:26 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 23:54 - 2014-06-18 13:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 23:49 - 2013-08-19 10:40 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 23:36 - 2012-01-31 13:14 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 07:25 - 2014-09-22 12:34 - 00000000 ____D () C:\Users\xxx-NB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-10 22:51 - 2013-08-02 09:33 - 00000000 ____D () C:\Users\xxx-NB\Documents\steuern
2015-02-06 13:44 - 2014-07-21 13:36 - 00000000 ____D () C:\Users\xxx-NB\Documents\Uni
2015-02-05 09:14 - 2015-01-22 12:57 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 09:14 - 2015-01-22 12:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 09:14 - 2015-01-22 12:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

==================== Files in the root of some directories =======

2014-12-01 13:18 - 2014-12-01 16:47 - 2929335 _____ () C:\Program Files (x86)\MysticThumbs.zip
2014-09-19 19:28 - 2014-09-19 19:28 - 0000000 _____ () C:\Users\xxx-NB\AppData\Roaming\downloads.m3u

Files to move or delete:
====================
C:\Users\xxx-NB\ccsetup412.exe


Some content of TEMP:
====================
C:\Users\xxx-NB\AppData\Local\Temp\avgnt.exe
C:\Users\xxx-NB\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpumgxi_.dll
C:\Users\xxx-NB\AppData\Local\Temp\Quarantine.exe
C:\Users\xxx-NB\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-27 21:37

==================== End Of Log ============================
         
--- --- ---


--- --- ---


Also gut, wenn Dich der gefundene Trojaner auf meiner externen Festplatte nicht nervös macht, darf ich auch nicht nervös sein. Ommmmm.....

Aber die Schmuddelwerbung auf einer bestimmten Seite (ein Forum, das ich seit Jahren besuche) ist immer noch da. (Ich habe nachgefragt, andere User dort bekommen keine Werbung zumindest nicht solche wie ich...)

Gruß,

Annoo

Geändert von 11annoo (04.03.2015 um 17:43 Uhr)

Antwort

Themen zu Ungewünschte Werbebanner Firefox
code, datenbank, datum, eingeblendet, elemente, ergebnis, erkannt, extra, firefox, gekauft, malware, malwarebytes, objekte, premium, schei, schutz, schädliche, service, ungewünschte, webseite, webseiten, werbebanner, windows, windows 7



Ähnliche Themen: Ungewünschte Werbebanner Firefox


  1. Firefox: unerwünschte Werbebanner überall,öffnet selbstständig neue Tabs z.B.zu ReimageRepair Windows7
    Plagegeister aller Art und deren Bekämpfung - 18.10.2015 (26)
  2. Firefox: ungewünschte Tabs öffnen sich bei klicken auf jegliche Links
    Plagegeister aller Art und deren Bekämpfung - 06.10.2015 (1)
  3. Firefox Seite wir mit immer neuen Werbebanner befüllt.
    Plagegeister aller Art und deren Bekämpfung - 29.08.2015 (20)
  4. Firefox öffnet viele Werbebanner
    Plagegeister aller Art und deren Bekämpfung - 19.04.2015 (9)
  5. Adware.SpeedingUp Virus Werbebanner Firefox
    Plagegeister aller Art und deren Bekämpfung - 17.04.2015 (16)
  6. Ständig Werbebanner beim Surfen mit Firefox
    Plagegeister aller Art und deren Bekämpfung - 28.02.2015 (17)
  7. Seit etwa 3 Stunden lahmt mein Laptop & in Firefox öffnen sich ständig werbebanner?
    Log-Analyse und Auswertung - 10.01.2015 (13)
  8. Firefox öffnet ungewünschte tabs automatisch
    Log-Analyse und Auswertung - 08.09.2014 (16)
  9. Firefox-Symbol wird zur Lupe, Aufforderung zu Mediaplayer-Installationen, ungewünschte Search Engines
    Log-Analyse und Auswertung - 23.05.2014 (27)
  10. In Firefox öffnet sich immer ein Weißer Werbebanner
    Plagegeister aller Art und deren Bekämpfung - 03.12.2013 (11)
  11. Firefox: Aufdringliches Werbebanner
    Plagegeister aller Art und deren Bekämpfung - 15.10.2013 (3)
  12. Probleme mit Firefox, es läde ungefragt weisses Feld und Werbebanner
    Log-Analyse und Auswertung - 01.10.2013 (30)
  13. Yontoo 2.053 lässt sich nicht deinstallieren / Werbebanner in Firefox
    Plagegeister aller Art und deren Bekämpfung - 21.06.2013 (17)
  14. AV Security Suite - Nach Entfernung öffnen sich in Firefox ungewünschte Tabs
    Log-Analyse und Auswertung - 15.07.2010 (29)
  15. Ungewünschte Werbeeinblendung
    Log-Analyse und Auswertung - 05.12.2008 (1)
  16. Ungewünschte Fenster Nerven!!
    Log-Analyse und Auswertung - 03.04.2008 (8)
  17. Ungewünschte Nachrichten
    Plagegeister aller Art und deren Bekämpfung - 09.02.2003 (1)

Zum Thema Ungewünschte Werbebanner Firefox - Hallo, ich fürchte ich habe mir Malware eingefangen. Ich bekomme neuerdings Schmuddel-Werbung eingeblendet (Abnehmen in 2 Tagen..., Muskeln, Software-Download-hier...), die es vorher in der Form nicht gab. Hier das Ergebnis - Ungewünschte Werbebanner Firefox...
Archiv
Du betrachtest: Ungewünschte Werbebanner Firefox auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.