Trojaner-Board - Windows 7 SP1 keine Downloads oder Updates aus dem Internet möglich

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7 SP1 keine Downloads oder Updates aus dem Internet möglich (https://www.trojaner-board.de/144176-windows-7-sp1-keine-downloads-updates-internet-moeglich.html)

Windows 7 SP1 keine Downloads oder Updates aus dem Internet möglich

Hallo,
auf dem Laptop meiner Bekannten ist es nicht mehr möglich Updates oder Downloads aus dem Internet herunterzuladen. Der Computer läuft sonst ohne Auffälligkeiten. Auch der Windows 7 Update ist nicht mehr möglich. Der Update wird gestartet, es wird aber nichts heruntergeladen. Auch nach einer halben Stunde ist kein KB heruntergeladen worden.

Bei dem Laptop handelt es sich um einen Dell Inspiron 15R mit 4 GB Arbeitsspeichen mit 64-Bit Software.

Wäre super wenn mir jemand helfen könnte um wieder downloaden zu können.

Ich habe sowohl den Antivir als auch MS Security Essentials laufen lassen alles ohne irgendwelche Funde.

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

OK - nachfolgend die Files im Treat.

Addition.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013

Ran by Laura at 2013-11-06 14:54:46

Running from C:\Users\Laura\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Microsoft Security Essentials (Enabled - Up to date) {3F839487-C7A2-C958-E30C-E2825BA31FB5}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Microsoft Security Essentials (Enabled - Up to date) {84E27563-E198-C6D6-D9BC-D9F020245508}
 

==================== Installed Programs ======================
 

64 Bit HP CIO Components Installer (Version: 6.2.1)

Adobe Flash Player 10 ActiveX (x32 Version: 10.1.53.64)

Adobe Flash Player 10 Plugin (x32 Version: 10.1.53.64)

Adobe Reader 9.1 - Deutsch (x32 Version: 9.1.0)

Advanced Audio FX Engine (x32 Version: 1.12.05)

ATI AVIVO64 Codecs (Version: 11.6.0.50601)

ATI Catalyst Install Manager (Version: 3.0.778.0)

BufferChm (x32 Version: 130.0.331.000)

Catalyst Control Center - Branding (x32 Version: 1.00.0000)

Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0601.2152.37421)

Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0601.2152.37421)

Catalyst Control Center InstallProxy (x32 Version: 2010.0601.2152.37421)

Catalyst Control Center Localization All (x32 Version: 2010.0601.2152.37421)

CCC Help Chinese Standard (x32 Version: 2010.0601.2151.37421)

CCC Help Chinese Traditional (x32 Version: 2010.0601.2151.37421)

CCC Help Danish (x32 Version: 2010.0601.2151.37421)

CCC Help Dutch (x32 Version: 2010.0601.2151.37421)

CCC Help English (x32 Version: 2010.0601.2151.37421)

CCC Help Finnish (x32 Version: 2010.0601.2151.37421)

CCC Help French (x32 Version: 2010.0601.2151.37421)

CCC Help German (x32 Version: 2010.0601.2151.37421)

CCC Help Italian (x32 Version: 2010.0601.2151.37421)

CCC Help Japanese (x32 Version: 2010.0601.2151.37421)

CCC Help Korean (x32 Version: 2010.0601.2151.37421)

CCC Help Norwegian (x32 Version: 2010.0601.2151.37421)

CCC Help Portuguese (x32 Version: 2010.0601.2151.37421)

CCC Help Russian (x32 Version: 2010.0601.2151.37421)

CCC Help Spanish (x32 Version: 2010.0601.2151.37421)

CCC Help Swedish (x32 Version: 2010.0601.2151.37421)

ccc-core-static (x32 Version: 2010.0601.2152.37421)

ccc-utility64 (Version: 2010.0601.2152.37421)

Cisco EAP-FAST Module (x32 Version: 2.2.14)

Cisco LEAP Module (x32 Version: 1.0.19)

Cisco PEAP Module (x32 Version: 1.1.6)

Conduit Engine (x32 Version: )

Copy (x32 Version: 130.0.366.000)

Dell DataSafe Local Backup - Support Software (x32 Version: 9.4.60)

Dell DataSafe Local Backup (x32 Version: 9.4.60)

Dell Dock (Version: 2.0)

Dell Dock (x32)

Dell Getting Started Guide (x32 Version: 1.00.0000)

Dell Support Center (Support Software) (x32 Version: 2.5.09100)

Dell Webcam Central (x32 Version: 1.40.05)

Destinations (x32 Version: 130.0.0.0)

DeviceDiscovery (x32 Version: 130.0.372.000)

Die Sims 2 (x32)

Die Sims™ 2 Vier Jahreszeiten (x32)

DJ_AIO_06_F2400_SW_Min (x32 Version: 130.0.373.000)

Dropbox (HKCU Version: 2.0.22)

DVDVideoSoftTB DE Toolbar (x32 Version: 6.9.0.16)

DVDVideoSoftTB Toolbar (x32 Version: )

DW WLAN Card Utility (Version: 5.60.48.35)

F2400 (x32 Version: 130.0.373.000)

Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)

Free Audio CD Burner version 1.4.8 (x32)

Free YouTube to MP3 Converter version 3.11.30.903 (x32 Version: 3.11.30.903)

Google Chrome (x32 Version: 30.0.1599.101)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0)

Google Toolbar for Internet Explorer (x32 Version: 6.6.1124.846)

Google Update Helper (x32 Version: 1.3.21.165)

GPBaseService2 (x32 Version: 130.0.371.000)

HP Customer Participation Program 13.0 (Version: 13.0)

HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6 (Version: 13.0)

HP Imaging Device Functions 13.0 (Version: 13.0)

HP Print Projects 1.0 (Version: 1.0)

HP Smart Web Printing 4.5 (Version: 4.5)

HP Solution Center 13.0 (Version: 13.0)

HP Update (x32 Version: 4.000.011.006)

HPPhotoGadget (x32 Version: 130.0.282.000)

hpPrintProjects (x32 Version: 130.0.303.000)

HPProductAssistant (x32 Version: 130.0.371.000)

HPSSupply (x32 Version: 130.0.371.000)

hpWLPGInstaller (x32 Version: 130.0.303.000)

ICQ Toolbar (x32 Version: 3.0.0)

ICQ7.2 (x32 Version: 7.2)

Intel(R) Control Center (x32 Version: 1.2.1.1007)

Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)

Intel(R) Rapid Storage Technology (x32 Version: 9.6.4.1002)

Java 7 Update 45 (x32 Version: 7.0.450)

Java Auto Updater (x32 Version: 2.1.9.8)

Java(TM) 6 Update 18 (64-bit) (Version: 6.0.180)

Java(TM) 6 Update 20 (64-bit) (Version: 6.0.200)

Junk Mail filter update (x32 Version: 14.0.8089.726)

Kies (x32 Version: 1.4)

Live! Cam Avatar Creator (x32 Version: 4.6.3009.1)

MarketResearch (x32 Version: 130.0.374.000)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)

Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Choice Guard (x32 Version: 2.0.48.0)

Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)

Microsoft Security Client (Version: 4.2.0223.1)

Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)

Microsoft Security Essentials (Version: 4.2.223.1)

Microsoft Silverlight (Version: 5.1.20125.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)

Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)

Microsoft Visual C++ 2005 Redistributable - KB2467175 (x32 Version: 8.0.51011)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.58299)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mozilla Firefox (3.6.12) (x32 Version: 3.6.12 (de))

MSVCRT (x32 Version: 14.0.1468.721)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)

My Scene(TM) EROBERT Hollywood (x32)

PC Connectivity Solution (x32 Version: 8.47.7.0)

PhotoScape (x32)

Picasa 3 (x32 Version: 3.8)

Quickset64 (Version: 10.5.0)

Roxio Burn (x32 Version: 1.01)

SAMSUNG USB Driver for Mobile Phones (Version: 1.3.1600.0)

Scan (x32 Version: 13.0.0.0)

Shop for HP Supplies (Version: 13.0)

Skype Toolbars (x32 Version: 5.0.4137)

Skype™ 5.10 (x32 Version: 5.10.116)

SmartWebPrinting (x32 Version: 130.0.373.000)

softonic-de3 Toolbar (x32 Version: 6.2.3.0)

SolutionCenter (x32 Version: 130.0.373.000)

Status (x32 Version: 130.0.373.000)

Synaptics Pointing Device Driver (Version: 15.0.0.1)

Toolbox (x32 Version: 130.0.648.000)

TrayApp (x32 Version: 130.0.376.000)

TuneUp Utilities 2012 (x32 Version: 12.0.3600.73)

TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.73)

Uninstall 1.0.0.1 (x32)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

VLC media player 1.1.4 (x32 Version: 1.1.4)

WebReg (x32 Version: 130.0.132.017)

WIDCOMM Bluetooth Software (Version: 6.2.1.1100)

WildTangent-Spiele (x32 Version: 1.0.0.71)

Windows Driver Package - Broadcom Corporation (BTHUSB) Bluetooth  (03/24/2010 6.3.0.2501) (Version: 03/24/2010 6.3.0.2501)

Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)

Windows Live Call (x32 Version: 14.0.8064.0206)

Windows Live Communications Platform (x32 Version: 14.0.8064.206)

Windows Live Essentials (x32 Version: 14.0.8089.0726)

Windows Live Essentials (x32 Version: 14.0.8089.726)

Windows Live Fotogalerie (x32 Version: 14.0.8081.709)

Windows Live Mail (x32 Version: 14.0.8089.0726)

Windows Live Messenger (x32 Version: 14.0.8089.0726)

Windows Live Movie Maker (x32 Version: 14.0.8091.0730)

Windows Live Sync (x32 Version: 14.0.8089.726)

Windows Live Toolbar (x32 Version: 14.0.8064.206)

Windows Live Writer (x32 Version: 14.0.8089.0726)

Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)

Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)

Yahoo! Toolbar (x32)
 

==================== Restore Points  =========================
 

02-08-2013 17:00:36 Windows Update

08-08-2013 14:30:38 Windows Update

06-11-2013 08:14:43 Removed Java(TM) 6 Update 22

06-11-2013 08:15:40 Installed Java 7 Update 45
 

==================== Hosts content: ==========================
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {0D54E938-CD48-4ED3-A2B1-507117C1AE12} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {25821F63-F7E8-4A7B-9B96-AB362EF26B0D} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001Core => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)

Task: {603C4706-FC99-40A0-8EFC-60EA525E4212} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

Task: {8110AF55-5C3E-4337-B915-8D416BD22D5C} - System32\Tasks\{EAC1A8DB-EDE0-4BD8-B43B-97A0972D1E4A} => E:\MSOffice2007\OFFICE12\setup.exe [2006-10-31] (Microsoft Corporation)

Task: {9DB90E47-70E9-4E99-9EF8-AED242D3C2B9} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe [2012-05-29] (TuneUp Software)

Task: {C1E833E2-A210-489A-822F-47F3FCC7EF6D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-01-06] (Google Inc.)

Task: {EF48E030-77E5-4CE6-86D1-149EBA60CF09} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001UA => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-13] (Facebook Inc.)

Task: {F7638760-8630-4090-86B0-992F62FB982D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-01-06] (Google Inc.)

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001Core.job => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001UA.job => C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2009-12-29 20:19 - 2009-12-29 20:19 - 00173344 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll

2013-09-04 20:35 - 2013-09-04 20:35 - 00472576 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_64\VistaBridgeLibrary\a408568532c8d635559ed2685e19f0ef\VistaBridgeLibrary.ni.dll

2010-03-08 17:02 - 2010-03-08 17:02 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2010-06-02 03:50 - 2010-06-02 03:50 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2013-03-13 21:48 - 2013-03-13 21:48 - 24978944 _____ () C:\Users\Laura\AppData\Roaming\Dropbox\bin\libcef.dll

2013-11-06 09:36 - 2013-11-06 09:36 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\6e0e5d6d7d5fe4e011335c395f6a8031\IsdiInterop.ni.dll

2010-10-06 13:12 - 2010-06-08 16:44 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (11/06/2013 01:09:12 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (11/06/2013 00:01:48 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (11/06/2013 00:01:48 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (11/06/2013 00:01:48 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".

Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (11/06/2013 11:56:39 AM) (Source: TOASTER.EXE) (User: )

Description: An Unhandled Exception occured.

Die Datei "C:\Users\Laura\AppData\local\\softthinks\scheduler.xml" ist bereits vorhanden.

   bei System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

   bei System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite)

   bei System.IO.File.Copy(String sourceFileName, String destFileName)

   bei Toaster.SchedulerReader.read()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.IsFsbScheduledNow()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.CheckReminder()

   bei Toaster.Helper.CheckReminders(ObservableCollection`1 notificationHelpers)

   bei Toaster.MainWindowViewModel.NotificationsTimerTick(Object sender, EventArgs e)

   bei System.Windows.Threading.DispatcherTimer.FireTick(Object unused)

   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Boolean isSingleParameter)

   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

Error: (11/06/2013 10:20:01 AM) (Source: DataSafe.exe) (User: )

Description: An Unhandled Exception occured.

System.Runtime.InteropServices.COMException (0x80040154): Die COM-Klassenfactory für die Komponente mit CLSID {FA9DF45C-1CD3-4197-A066-CAB0078BB55B} konnte aufgrund des folgenden Fehlers nicht abgerufen werden: 80040154.

   bei STUICore.RecoveryPartition.getRPLetter()

   bei DataSafe.Net.StartHelper.start(StartInfo& startInfo, Thread splashTread)

   bei DataSafe.Net.Program.Main(String[] Args)
 

Error: (11/06/2013 09:10:14 AM) (Source: TOASTER.EXE) (User: )

Description: An Unhandled Exception occured.

Die Datei "C:\Users\Laura\AppData\local\\softthinks\scheduler.xml" ist bereits vorhanden.

   bei System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

   bei System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite)

   bei System.IO.File.Copy(String sourceFileName, String destFileName)

   bei Toaster.SchedulerReader.read()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.IsFsbScheduledNow()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.CheckReminder()

   bei Toaster.Helper.CheckReminders(ObservableCollection`1 notificationHelpers)

   bei Toaster.MainWindowViewModel.NotificationsTimerTick(Object sender, EventArgs e)

   bei System.Windows.Threading.DispatcherTimer.FireTick(Object unused)

   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Boolean isSingleParameter)

   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

Error: (10/30/2013 09:28:30 AM) (Source: Application Hang) (User: )

Description: Programm ICQ.exe, Version 7.2.0.3525 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 650
 

Startzeit: 01ce9911f25a35ce
 

Endzeit: 344
 

Anwendungspfad: C:\Program Files (x86)\ICQ7.2\ICQ.exe
 

Berichts-ID: e14e8382-40db-11e3-8445-df1036d231ba
 

Error: (10/12/2013 02:37:48 PM) (Source: Application Hang) (User: )

Description: Programm OneClick.exe, Version 12.0.3600.73 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 2268
 

Startzeit: 01cec69b159def02
 

Endzeit: 538
 

Anwendungspfad: C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe
 

Berichts-ID: 6a6d16f3-3343-11e3-8445-df1036d231ba
 

Error: (10/08/2013 02:49:41 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16537, Zeitstempel: 0x512347f7

Name des fehlerhaften Moduls: swg.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4cabdb21

Ausnahmecode: 0xc0000005

Fehleroffset: 0x08c2a58e

ID des fehlerhaften Prozesses: 0x3450

Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0

Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1

Pfad des fehlerhaften Moduls: IEXPLORE.EXE2

Berichtskennung: IEXPLORE.EXE3
 
 

System errors:

=============

Error: (11/06/2013 02:55:17 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:54:47 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:54:17 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:53:47 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:53:17 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:52:47 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:52:17 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:51:47 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:51:17 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 

Error: (11/06/2013 02:50:47 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%126
 
 

Microsoft Office Sessions:

=========================

Error: (11/06/2013 01:09:12 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
 

Error: (11/06/2013 00:01:48 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
 

Error: (11/06/2013 00:01:48 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
 

Error: (11/06/2013 00:01:48 PM) (Source: SideBySide)(User: )

Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
 

Error: (11/06/2013 11:56:39 AM) (Source: TOASTER.EXE)(User: )

Description: An Unhandled Exception occured.

Die Datei "C:\Users\Laura\AppData\local\\softthinks\scheduler.xml" ist bereits vorhanden.

   bei System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

   bei System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite)

   bei System.IO.File.Copy(String sourceFileName, String destFileName)

   bei Toaster.SchedulerReader.read()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.IsFsbScheduledNow()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.CheckReminder()

   bei Toaster.Helper.CheckReminders(ObservableCollection`1 notificationHelpers)

   bei Toaster.MainWindowViewModel.NotificationsTimerTick(Object sender, EventArgs e)

   bei System.Windows.Threading.DispatcherTimer.FireTick(Object unused)

   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Boolean isSingleParameter)

   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

Error: (11/06/2013 10:20:01 AM) (Source: DataSafe.exe)(User: )

Description: An Unhandled Exception occured.

System.Runtime.InteropServices.COMException (0x80040154): Die COM-Klassenfactory für die Komponente mit CLSID {FA9DF45C-1CD3-4197-A066-CAB0078BB55B} konnte aufgrund des folgenden Fehlers nicht abgerufen werden: 80040154.

   bei STUICore.RecoveryPartition.getRPLetter()

   bei DataSafe.Net.StartHelper.start(StartInfo& startInfo, Thread splashTread)

   bei DataSafe.Net.Program.Main(String[] Args)
 

Error: (11/06/2013 09:10:14 AM) (Source: TOASTER.EXE)(User: )

Description: An Unhandled Exception occured.

Die Datei "C:\Users\Laura\AppData\local\\softthinks\scheduler.xml" ist bereits vorhanden.

   bei System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

   bei System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite)

   bei System.IO.File.Copy(String sourceFileName, String destFileName)

   bei Toaster.SchedulerReader.read()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.IsFsbScheduledNow()

   bei Toaster.Notifications.FullSystemBackup.FsbHelper.CheckReminder()

   bei Toaster.Helper.CheckReminders(ObservableCollection`1 notificationHelpers)

   bei Toaster.MainWindowViewModel.NotificationsTimerTick(Object sender, EventArgs e)

   bei System.Windows.Threading.DispatcherTimer.FireTick(Object unused)

   bei System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate callback, Object args, Boolean isSingleParameter)

   bei System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)
 

Error: (10/30/2013 09:28:30 AM) (Source: Application Hang)(User: )

Description: ICQ.exe7.2.0.352565001ce9911f25a35ce344C:\Program Files (x86)\ICQ7.2\ICQ.exee14e8382-40db-11e3-8445-df1036d231ba
 

Error: (10/12/2013 02:37:48 PM) (Source: Application Hang)(User: )

Description: OneClick.exe12.0.3600.73226801cec69b159def02538C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe6a6d16f3-3343-11e3-8445-df1036d231ba
 

Error: (10/08/2013 02:49:41 PM) (Source: Application Error)(User: )

Description: IEXPLORE.EXE10.0.9200.16537512347f7swg.dll_unloaded0.0.0.04cabdb21c000000508c2a58e345001cec42d1d345547C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEswg.dll7a60ea6c-3020-11e3-8445-df1036d231ba
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 58%

Total physical RAM: 3958.69 MB

Available physical RAM: 1638.6 MB

Total Pagefile: 7915.56 MB

Available Pagefile: 5183.43 MB

Total Virtual: 8192 MB

Available Virtual: 8191.79 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:93.14 GB) (Free:42.02 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive e: (Daten) (Fixed) (Total:488.28 GB) (Free:483.53 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 596 GB) (Disk ID: 9AE8D6C8)

Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)

Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=93 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=488 GB) - (Type=OF Extended)
 

==================== End Of Log ============================

FRST.txt

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013

Ran by Laura (administrator) on LAURA-PC on 06-11-2013 20:46:22

Running from C:\Users\Laura\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Devguru Co., Ltd.) C:\Windows\SysWOW64\dgdersvc.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

() C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE

() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(ICQ, LLC.) C:\Program Files (x86)\ICQ7.2\ICQ.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe

(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe

(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

() C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe

(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [3179288 2010-01-06] (Dell Inc.)

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-06-18] (IDT, Inc.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2010-03-17] (Synaptics Incorporated)

HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE [5712896 2010-02-03] (Dell Inc.)

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)

HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [559616 2011-10-10] (Dell)

HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-06] (Google Inc.)

HKCU\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\/\KiesTrayAgent.exe [3365176 2010-10-27] (Samsung Electronics Co., Ltd.)

HKCU\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)

HKCU\...\Run: [Facebook Update] - C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-13] (Facebook Inc.)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-06-08] (Intel Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [409744 2009-06-24] (Creative Technology Ltd)

HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-10-15] ()

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-02] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [DellSupportCenter] - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-11-06] (Avira Operations GmbH & Co. KG)

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk

ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

URLSearchHook: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

URLSearchHook: HKLM-x32 - softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)

URLSearchHook: HKLM-x32 - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)

URLSearchHook: HKLM-x32 - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)

URLSearchHook: HKCU - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

URLSearchHook: HKCU - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

URLSearchHook: HKCU - softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)

URLSearchHook: HKCU - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)

URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

URLSearchHook: HKCU - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)

SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050

SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050

SearchScopes: HKCU - DefaultScope {057B639C-42CC-4E9A-9D99-0ADAED5CAB7C} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7MOOI_de

SearchScopes: HKCU - {057B639C-42CC-4E9A-9D99-0ADAED5CAB7C} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7MOOI_de

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg64.dll (Google Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)

BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)

BHO-x32: softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

Toolbar: HKLM-x32 - softonic-de3 Toolbar - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)

Toolbar: HKLM-x32 - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM-x32 - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)

Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

Toolbar: HKLM-x32 - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKCU - No Name - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} -  No File

Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File

Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} -  No File

Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} -  No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Laura\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Conduit Engine  - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\engine@conduit.com

FF Extension: Plasmoo Search Engine - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\engine@plasmoo.com

FF Extension: DVDVideoSoftTB DE  - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}

FF Extension: DVDVideoSoftTB Toolbar - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

FF Extension: DVDVideoSoft Menu - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

FF Extension: softonic-de3 Community Toolbar - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HomePage: hxxp://plasmoo.com

CHR RestoreOnStartup: "hxxp://plasmoo.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\pdf.dll No File

CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\gears.dll No File

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.97\gcswf32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL No File

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll No File

CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR Extension: (DvdVideoSoft Free Youtube Download) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 dgdersvc; C:\Windows\SysWOW64\dgdersvc.exe [95568 2010-10-25] (Devguru Co., Ltd.)

R2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247096 2010-09-06] ()

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-05-29] (TuneUp Software)

R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE [48128 2010-02-03] (Dell Inc.)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-11-06] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-11-06] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-06] (Avira Operations GmbH & Co. KG)

R3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20568 2009-12-22] (Devguru Co., Ltd)

R3 dgderdrv; C:\Windows\SysWow64\drivers\dgderdrv.sys [18120 2010-10-25] (Devguru Co., Ltd)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 ss_bserd; C:\Windows\System32\DRIVERS\ss_bserd.sys [128000 2009-09-19] (MCCI Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-08] (TuneUp Software)

S1 nddwrzyi; \??\C:\Windows\system32\drivers\nddwrzyi.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-06 20:45 - 2013-11-06 20:45 - 00000472 _____ C:\Users\Laura\Desktop\defogger_disable.log

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Avira

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 _____ C:\Users\Laura\defogger_reenable

2013-11-06 20:44 - 2013-11-06 16:58 - 00050477 _____ C:\Users\Laura\Desktop\Defogger.exe

2013-11-06 20:39 - 2013-11-06 20:39 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\ProgramData\Avira

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\Program Files (x86)\Avira

2013-11-06 20:39 - 2013-11-06 12:25 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-11-06 20:39 - 2013-11-06 12:25 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-11-06 20:39 - 2013-11-06 12:25 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-11-06 14:54 - 2013-11-06 14:55 - 00028609 _____ C:\Users\Laura\Desktop\1Addition.txt

2013-11-06 14:52 - 2013-11-06 14:52 - 00000000 ____D C:\FRST

2013-11-06 13:31 - 2013-11-06 13:28 - 01957098 _____ (Farbar) C:\Users\Laura\Desktop\FRST64.exe

2013-11-06 12:01 - 2013-11-06 12:01 - 00000000 __RSD C:\Users\Laura\Documents\My Stationery

2013-11-06 09:16 - 2013-11-06 09:16 - 00000000 ____D C:\ProgramData\Oracle

2013-11-06 09:16 - 2013-11-06 09:15 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-06 09:15 - 2013-11-06 09:15 - 00000000 ____D C:\Program Files (x86)\Java
 

==================== One Month Modified Files and Folders =======
 

2013-11-06 20:45 - 2013-11-06 20:45 - 00000472 _____ C:\Users\Laura\Desktop\defogger_disable.log

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Avira

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 _____ C:\Users\Laura\defogger_reenable

2013-11-06 20:45 - 2011-01-05 16:44 - 00000000 ____D C:\Users\Laura

2013-11-06 20:45 - 2010-10-06 12:40 - 01791886 _____ C:\Windows\WindowsUpdate.log

2013-11-06 20:44 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-06 20:44 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-06 20:43 - 2010-10-06 15:29 - 00654400 _____ C:\Windows\system32\perfh007.dat

2013-11-06 20:43 - 2010-10-06 15:29 - 00130240 _____ C:\Windows\system32\perfc007.dat

2013-11-06 20:43 - 2009-07-14 06:13 - 00777466 _____ C:\Windows\system32\PerfStringBackup.INI

2013-11-06 20:42 - 2012-12-14 18:39 - 00000000 ___RD C:\Users\Laura\Dropbox

2013-11-06 20:42 - 2012-12-14 18:37 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox

2013-11-06 20:39 - 2013-11-06 20:39 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\ProgramData\Avira

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\Program Files (x86)\Avira

2013-11-06 20:37 - 2011-01-06 12:59 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-11-06 20:37 - 2011-01-05 16:48 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks

2013-11-06 20:37 - 2011-01-05 16:48 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks

2013-11-06 20:37 - 2010-10-06 13:34 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-11-06 20:36 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-06 20:36 - 2009-07-14 05:51 - 00092951 _____ C:\Windows\setupact.log

2013-11-06 20:35 - 2010-12-25 10:38 - 00104468 _____ C:\Windows\PFRO.log

2013-11-06 16:58 - 2013-11-06 20:44 - 00050477 _____ C:\Users\Laura\Desktop\Defogger.exe

2013-11-06 16:29 - 2011-09-16 23:55 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001UA.job

2013-11-06 16:29 - 2011-01-06 12:59 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-11-06 14:55 - 2013-11-06 14:54 - 00028609 _____ C:\Users\Laura\Desktop\1Addition.txt

2013-11-06 14:52 - 2013-11-06 14:52 - 00000000 ____D C:\FRST

2013-11-06 13:48 - 2011-01-05 17:15 - 00000000 ____D C:\Users\Laura\AppData\Roaming\ICQ

2013-11-06 13:28 - 2013-11-06 13:31 - 01957098 _____ (Farbar) C:\Users\Laura\Desktop\FRST64.exe

2013-11-06 13:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2013-11-06 12:25 - 2013-11-06 20:39 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-11-06 12:25 - 2013-11-06 20:39 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-11-06 12:25 - 2013-11-06 20:39 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-11-06 12:01 - 2013-11-06 12:01 - 00000000 __RSD C:\Users\Laura\Documents\My Stationery

2013-11-06 09:16 - 2013-11-06 09:16 - 00000000 ____D C:\ProgramData\Oracle

2013-11-06 09:15 - 2013-11-06 09:16 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-06 09:15 - 2013-11-06 09:15 - 00000000 ____D C:\Program Files (x86)\Java

2013-11-05 12:28 - 2011-09-16 23:55 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001Core.job

2013-10-18 18:00 - 2011-01-20 20:35 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2013-10-08 14:51 - 2011-01-06 12:59 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-10-08 14:51 - 2011-01-06 12:59 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
 

Some content of TEMP:

====================

C:\Users\Laura\AppData\Local\Temp\-rpzwhje.dll

C:\Users\Laura\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\Users\Laura\AppData\Local\Temp\a0ipqtd7.dll

C:\Users\Laura\AppData\Local\Temp\AskSLib.dll

C:\Users\Laura\AppData\Local\Temp\AutoRun.exe

C:\Users\Laura\AppData\Local\Temp\AutoRunGUI.dll

C:\Users\Laura\AppData\Local\Temp\First15.exe

C:\Users\Laura\AppData\Local\Temp\GLF7536.tmp.tbDVDV.dll

C:\Users\Laura\AppData\Local\Temp\GLFEAE0.tmp.ConduitEngineSetup.exe

C:\Users\Laura\AppData\Local\Temp\GLFEAE0.tmp.tbsoft.dll

C:\Users\Laura\AppData\Local\Temp\GLFF3C6.tmp.ConduitEngine.dll

C:\Users\Laura\AppData\Local\Temp\GoogleChromeInstaller.exe

C:\Users\Laura\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe

C:\Users\Laura\AppData\Local\Temp\lvhre3nl.dll

C:\Users\Laura\AppData\Local\Temp\pygvxy6k.dll

C:\Users\Laura\AppData\Local\Temp\softonic-de3.exe

C:\Users\Laura\AppData\Local\Temp\VP6Install.exe

C:\Users\Laura\AppData\Local\Temp\VP6VFW.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-11-06 13:04
 

==================== End Of Log ============================

--- --- ---

defogger_disable.log

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 20:45 on 06/11/2013 (Laura)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

gmer.txt

Code:

GMER Logfile:
 

        Code:


        
GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-11-06 21:02:54

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AK1 596,17GB

Running: ntn2cchg.exe; Driver: C:\Users\Laura\AppData\Local\Temp\ugloapob.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                               fffff80002feb000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607                                                               fffff80002feb02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
 

---- User code sections - GMER 2.1 ----
 

.text     C:\Windows\SysWOW64\dgdersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   00000000773c1465 2 bytes [3C, 77]

.text     C:\Windows\SysWOW64\dgdersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000773c14bb 2 bytes [3C, 77]

.text     ...                                                                                                                              * 2

.text     C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE[2112] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000773c1465 2 bytes [3C, 77]

.text     C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE[2112] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000773c14bb 2 bytes [3C, 77]

.text     ...                                                                                                                              * 2

.text     C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe[4172] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69             00000000773c1465 2 bytes [3C, 77]

.text     C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe[4172] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155            00000000773c14bb 2 bytes [3C, 77]

.text     ...                                                                                                                              * 2
 

---- Threads - GMER 2.1 ----
 

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [888:1036]                                                                    000007fefb4f2a7c
 

---- Registry - GMER 2.1 ----
 

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations                                                ?????n???????????,?e?e?e?e?e?f?h?k?h?f?j?j?h?i?j?k?k?k?m?k?m?m?n?n?n?n?r?t?x?t?x???x?{?|?|?x?????????l???l???????????????l?????????????????????????????????????????????????????????????????????????????????????????????m?????????????????????????????m???????????m?????????????????????????|?|?x???????????????????h?k?h?f?????????j?k?k?k?????????????????r????? j?????????????????atiumd64.dll?atiumd64.dll?atidxx64.dll?atidxx64.dll???????j?????????????????atiumdag.dll?atiumdag.dll?atidxx32.dll?atidxx32.dll??4????6??????6??????????atio6axx.dll?atio6axx.dll??g.d???????????t???????d???????????????????d???&??????????????????????????????????????????????????????????????????????LocalSystem?ra???????????????????????????????????????j???????e??????????Samsung Electronics Co., Ltd. ?ardm??iges MTP-Ger?t)?????????????????????????????????????j???????????????j??????????????????????????0-?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\5cac4ce74de8                                                      

Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\5cac4ce74de8 (not active ControlSet)                                  
 

---- EOF - GMER 2.1 ----

 
--- --- ---

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Schrauber,

nachfolgend das Logfile des Combofix scans:

Code:

ComboFix 13-11-04.01 - Laura 07.11.2013  19:58:32.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3959.2299 [GMT 1:00]

ausgeführt von:: c:\users\Laura\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\END

c:\windows\SysWow64\System32\MASetupCleaner.exe

c:\windows\SysWow64\System32\muzapp.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-10-07 bis 2013-11-07  ))))))))))))))))))))))))))))))

.

.

2013-11-07 19:09 . 2013-11-07 19:09        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-11-07 14:54 . 2013-11-07 14:53        81112        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-11-06 19:45 . 2013-11-06 19:45        --------        d-----w-        c:\users\Laura\AppData\Roaming\Avira

2013-11-06 19:39 . 2013-11-06 11:25        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2013-11-06 19:39 . 2013-11-06 11:25        132088        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-11-06 19:39 . 2013-11-06 11:25        105344        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-11-06 19:39 . 2013-11-06 19:39        --------        d-----w-        c:\programdata\Avira

2013-11-06 19:39 . 2013-11-06 19:39        --------        d-----w-        c:\program files (x86)\Avira

2013-11-06 13:52 . 2013-11-06 13:52        --------        d-----w-        C:\FRST

2013-11-06 08:16 . 2013-11-06 08:16        --------        d-----w-        c:\programdata\Oracle

2013-11-06 08:16 . 2013-11-06 08:16        --------        d-----w-        c:\program files (x86)\Common Files\Java

2013-11-06 08:15 . 2013-11-06 08:15        96168        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-11-06 08:15 . 2013-11-06 08:15        --------        d-----w-        c:\program files (x86)\Java

2013-11-05 11:32 . 2013-10-14 07:12        10280728        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E5BB5884-9D2F-42F1-983E-C0AE78F369BC}\mpengine.dll

2013-10-29 13:32 . 2013-10-14 07:12        10280728        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-10-19 22:03 . 2013-10-17 09:14        965000        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D9DB1EA2-24C3-47C6-827C-69CD439D5F7B}\gapaengine.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-09-04 19:58 . 2011-03-25 15:04        965008        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\program files (x86)\softonic-de3\tbsoft.dll" [2010-11-13 3913000]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

2011-05-09 09:49        176936        ----a-w-        c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2010-11-13 20:58        3913000        ----a-w-        c:\program files (x86)\ConduitEngine\ConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

2010-04-27 09:08        2393184        ----a-w-        c:\program files (x86)\DVDVideoSoftTB\tbDVDV.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

2010-11-13 20:58        3913000        ----a-w-        c:\program files (x86)\softonic-de3\tbsoft.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\program files (x86)\softonic-de3\tbsoft.dll" [2010-11-13 3913000]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\ConduitEngine.dll" [2010-11-13 3913000]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-01-06 39408]

"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\/\KiesTrayAgent.exe" [2010-10-27 3365176]

"ICQ"="c:\program files (x86)\ICQ7.2\ICQ.exe" [2011-01-05 133432]

"Facebook Update"="c:\users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-13 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-06-02 98304]

"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-11-06 347192]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-10-10 559616]

.

c:\users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-16 1324384]

Dropbox.lnk - c:\users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-12-29 1082656]

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-12-16 1324384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer9"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R1 nddwrzyi;nddwrzyi;c:\windows\system32\drivers\nddwrzyi.sys;c:\windows\SYSNATIVE\drivers\nddwrzyi.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]

R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]

R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]

R3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\DRIVERS\ss_bserd.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bserd.sys [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]

S2 dgdersvc;Device Error Recovery Service;c:\windows\SysWOW64\dgdersvc.exe;c:\windows\SysWOW64\dgdersvc.exe [x]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]

S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [x]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [x]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S3 BcmVWL;Broadcom Virtual Wireless;c:\windows\system32\DRIVERS\bcmvwl64.sys;c:\windows\SYSNATIVE\DRIVERS\bcmvwl64.sys [x]

S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys;c:\windows\SYSNATIVE\drivers\btusbflt.sys [x]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]

S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys;c:\windows\SYSNATIVE\drivers\dgderdrv.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-10-18 16:56        1185744        ----a-w-        c:\program files (x86)\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-11-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001Core.job

- c:\users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-16 01:19]

.

2013-11-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001UA.job

- c:\users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-16 01:19]

.

2013-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-06 11:59]

.

2013-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-06 11:59]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        164016        ----a-w-        c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-06-18 487424]

"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2010-02-03 5712896]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = https://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Free YouTube to MP3 Converter - c:\users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html

IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)

WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)

WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-11-07  20:26:58

ComboFix-quarantined-files.txt  2013-11-07 19:26

.

Vor Suchlauf: 10 Verzeichnis(se), 49.594.712.064 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 50.804.371.456 Bytes frei

.

- - End Of File - - 6371BF0B9B3581CD3DABF65C684D267E

Was mir heute auch noch aufgefallen ist, es können keine Programme deinstalliert werden. Es kommt immer die gleiche Meldung:

Bei der Deinstallation von ..... ist ein Fehler aufgetreten. Möglicherweise wurde es bereits deinstalliert.

Möchten Sie .... aus der Liste der Programme und Funktionen entfernen.

Im voraus vielen Dank für deine Mühe.

Gruß Omty

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo Schrauber,

anbei die Logs. Lief alles ohne Probleme durch.

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.11.08.08
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16540

Laura :: LAURA-PC [Administrator]
 

Schutz: Aktiviert
 

08.11.2013 21:59:37

mbam-log-2013-11-08 (21-59-37).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 216799

Laufzeit: 5 Minute(n), 22 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 2

C:\Users\Laura\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Laura\AppData\Roaming\OpenCandy\BE2FE6805D0C48028A65B5D56F5276A3 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 2

C:\Users\Laura\Documents\SoftonicDownloader_fuer_free-youtube-to-mp3-converter.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Laura\AppData\Roaming\OpenCandy\BE2FE6805D0C48028A65B5D56F5276A3\TuneUpUtilities2012_de-DE.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

# AdwCleaner v3.011 - Bericht erstellt am 08/11/2013 um 22:12:43

# Updated 03/11/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Laura - LAURA-PC

# Gestartet von : C:\Users\Laura\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

Dienst Gelöscht : ICQ Service
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar

Ordner Gelöscht : C:\Program Files (x86)\Conduit

Ordner Gelöscht : C:\Program Files (x86)\ConduitEngine

Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoftTB

Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar

Ordner Gelöscht : C:\Program Files (x86)\softonic-de3

Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoftTB_DE

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\Program Files (x86)\Common Files\Plasmoo

Ordner Gelöscht : C:\Users\Laura\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Laura\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Laura\AppData\LocalLow\ConduitEngine

Ordner Gelöscht : C:\Users\Laura\AppData\LocalLow\DVDVideoSoftTB

Ordner Gelöscht : C:\Users\Laura\AppData\LocalLow\PriceGong

Ordner Gelöscht : C:\Users\Laura\AppData\LocalLow\softonic-de3

Ordner Gelöscht : C:\Users\Laura\AppData\LocalLow\DVDVideoSoftTB_DE

Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}

Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\engine@conduit.com

Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\engine@plasmoo.com

Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}

Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

Ordner Gelöscht : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\Extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2431245

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2625848

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-download_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-download_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-to-mp3-converter_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-to-mp3-converter_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_photoscape_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66298303-EDE2-4808-AE4E-9989857A7401}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2C70B4DA-71F6-483D-BD74-31A2395BBE55}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0C58B7D1-D415-492B-A149-E976156BD3B8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{66298303-EDE2-4808-AE4E-9989857A7401}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2C70B4DA-71F6-483D-BD74-31A2395BBE55}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6AD0490B-F6B1-45C4-A084-78F0A2D6BD01}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E9B498CA-F62E-47DC-922C-6A52FC71A17D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13983FEF-AC27-4BC9-9C02-2F1E2D673B2C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{678AFF9E-4EC7-4548-BF40-548D07C9E383}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\conduitEngine

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\smartbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB_DE

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\softonic-de3

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\Software\conduitEngine

Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB

Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar

Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB_DE

Schlüssel Gelöscht : HKLM\Software\softonic-de3

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de3 Toolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB_DE Toolbar
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16537
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
 

-\\ Mozilla Firefox v3.6.12 (de)
 

[ Datei : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default\prefs.js ]
 

Zeile gelöscht : user_pref("CT2625848.autoDisableScopes", -1);
 

-\\ Google Chrome v30.0.1599.101
 

[ Datei : C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht : homepage

Gelöscht : urls_to_restore_on_startup
 

*************************
 

AdwCleaner[R0].txt - [18039 octets] - [08/11/2013 22:11:30]

AdwCleaner[S0].txt - [14541 octets] - [08/11/2013 22:12:43]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14602 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 7 Home Premium x64

Ran by Laura on 08.11.2013 at 22:19:10,27

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 08.11.2013 at 22:27:28,80

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013

Ran by Laura (administrator) on LAURA-PC on 08-11-2013 22:28:31

Running from C:\Users\Laura\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Devguru Co., Ltd.) C:\Windows\SysWOW64\dgdersvc.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe

(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

() C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe

(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-06-18] (IDT, Inc.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2010-03-17] (Synaptics Incorporated)

HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE [5712896 2010-02-03] (Dell Inc.)

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)

HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [559616 2011-10-10] (Dell)

HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-06] (Google Inc.)

HKCU\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\/\KiesTrayAgent.exe [3365176 2010-10-27] (Samsung Electronics Co., Ltd.)

HKCU\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)

HKCU\...\Run: [Facebook Update] - C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-13] (Facebook Inc.)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-06-08] (Intel Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [409744 2009-06-24] (Creative Technology Ltd)

HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-10-15] ()

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-02] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [DellSupportCenter] - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-11-06] (Avira Operations GmbH & Co. KG)

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk

ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

URLSearchHook: HKCU - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - {057B639C-42CC-4E9A-9D99-0ADAED5CAB7C} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7MOOI_de

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg64.dll (Google Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Laura\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()

CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\gears.dll No File

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL No File

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll No File

CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR Extension: (DvdVideoSoft Free Youtube Download) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 dgdersvc; C:\Windows\SysWOW64\dgdersvc.exe [95568 2010-10-25] (Devguru Co., Ltd.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-05-29] (TuneUp Software)

R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE [48128 2010-02-03] (Dell Inc.)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-11-06] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-11-06] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-06] (Avira Operations GmbH & Co. KG)

R3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20568 2009-12-22] (Devguru Co., Ltd)

R3 dgderdrv; C:\Windows\SysWow64\drivers\dgderdrv.sys [18120 2010-10-25] (Devguru Co., Ltd)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 ss_bserd; C:\Windows\System32\DRIVERS\ss_bserd.sys [128000 2009-09-19] (MCCI Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-08] (TuneUp Software)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S1 nddwrzyi; \??\C:\Windows\system32\drivers\nddwrzyi.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-08 22:27 - 2013-11-08 22:27 - 00000625 _____ C:\Users\Laura\Desktop\JRT.txt

2013-11-08 22:19 - 2013-11-08 22:19 - 00000000 ____D C:\Windows\ERUNT

2013-11-08 22:18 - 2013-11-08 21:46 - 01034531 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe

2013-11-08 22:16 - 2013-11-08 22:16 - 00014691 _____ C:\Users\Laura\Desktop\AdwCleaner[S0].txt

2013-11-08 22:11 - 2013-11-08 22:13 - 00000000 ____D C:\AdwCleaner

2013-11-08 22:11 - 2013-11-08 21:45 - 01073262 _____ C:\Users\Laura\Desktop\adwcleaner.exe

2013-11-08 21:54 - 2013-11-08 21:54 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 21:54 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-11-07 20:27 - 2013-11-07 20:27 - 00023616 _____ C:\ComboFix.txt

2013-11-07 19:56 - 2013-11-07 20:28 - 00000000 ____D C:\Qoobox

2013-11-07 19:56 - 2013-11-07 20:20 - 00000000 ____D C:\Windows\erdnt

2013-11-07 19:56 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2013-11-07 19:56 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2013-11-07 19:56 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2013-11-07 19:52 - 2013-11-07 19:47 - 05144303 ____R (Swearware) C:\Users\Laura\Desktop\ComboFix.exe

2013-11-07 15:54 - 2013-11-07 15:53 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-11-06 22:26 - 2013-11-06 22:26 - 500650158 _____ C:\Windows\MEMORY.DMP

2013-11-06 22:26 - 2013-11-06 22:26 - 00456112 _____ C:\Windows\Minidump\110613-18267-01.dmp

2013-11-06 22:26 - 2013-11-06 22:26 - 00000000 ____D C:\Windows\Minidump

2013-11-06 21:02 - 2013-11-06 21:02 - 00003941 _____ C:\Users\Laura\Desktop\gmer.txt

2013-11-06 20:54 - 2013-11-06 17:04 - 00377856 _____ C:\Users\Laura\Desktop\ntn2cchg.exe

2013-11-06 20:45 - 2013-11-06 20:45 - 00000472 _____ C:\Users\Laura\Desktop\defogger_disable.log

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Avira

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 _____ C:\Users\Laura\defogger_reenable

2013-11-06 20:44 - 2013-11-06 16:58 - 00050477 _____ C:\Users\Laura\Desktop\Defogger.exe

2013-11-06 20:39 - 2013-11-06 20:39 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\ProgramData\Avira

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\Program Files (x86)\Avira

2013-11-06 20:39 - 2013-11-06 12:25 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-11-06 20:39 - 2013-11-06 12:25 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-11-06 20:39 - 2013-11-06 12:25 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-11-06 14:54 - 2013-11-06 14:55 - 00028609 _____ C:\Users\Laura\Desktop\Addition.txt

2013-11-06 14:52 - 2013-11-06 14:52 - 00000000 ____D C:\FRST

2013-11-06 13:31 - 2013-11-06 13:28 - 01957098 _____ (Farbar) C:\Users\Laura\Desktop\FRST64.exe

2013-11-06 12:01 - 2013-11-06 12:01 - 00000000 __RSD C:\Users\Laura\Documents\My Stationery

2013-11-06 09:16 - 2013-11-06 09:16 - 00000000 ____D C:\ProgramData\Oracle

2013-11-06 09:16 - 2013-11-06 09:15 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-06 09:15 - 2013-11-06 09:15 - 00000000 ____D C:\Program Files (x86)\Java
 

==================== One Month Modified Files and Folders =======
 

2013-11-08 22:27 - 2013-11-08 22:27 - 00000625 _____ C:\Users\Laura\Desktop\JRT.txt

2013-11-08 22:24 - 2010-10-06 12:40 - 01936021 _____ C:\Windows\WindowsUpdate.log

2013-11-08 22:22 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-08 22:22 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-08 22:19 - 2013-11-08 22:19 - 00000000 ____D C:\Windows\ERUNT

2013-11-08 22:16 - 2013-11-08 22:16 - 00014691 _____ C:\Users\Laura\Desktop\AdwCleaner[S0].txt

2013-11-08 22:16 - 2012-12-14 18:39 - 00000000 ___RD C:\Users\Laura\Dropbox

2013-11-08 22:16 - 2012-12-14 18:37 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox

2013-11-08 22:14 - 2011-01-06 12:59 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-11-08 22:14 - 2011-01-05 16:48 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks

2013-11-08 22:14 - 2011-01-05 16:48 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks

2013-11-08 22:14 - 2010-10-06 13:34 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-11-08 22:14 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-08 22:14 - 2009-07-14 05:51 - 00093343 _____ C:\Windows\setupact.log

2013-11-08 22:13 - 2013-11-08 22:11 - 00000000 ____D C:\AdwCleaner

2013-11-08 22:08 - 2010-12-25 10:38 - 00110056 _____ C:\Windows\PFRO.log

2013-11-08 21:56 - 2011-01-06 12:59 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-11-08 21:54 - 2013-11-08 21:54 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 21:46 - 2013-11-08 22:18 - 01034531 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe

2013-11-08 21:45 - 2013-11-08 22:11 - 01073262 _____ C:\Users\Laura\Desktop\adwcleaner.exe

2013-11-08 06:25 - 2011-09-16 23:55 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001UA.job

2013-11-07 20:28 - 2013-11-07 19:56 - 00000000 ____D C:\Qoobox

2013-11-07 20:27 - 2013-11-07 20:27 - 00023616 _____ C:\ComboFix.txt

2013-11-07 20:20 - 2013-11-07 19:56 - 00000000 ____D C:\Windows\erdnt

2013-11-07 20:10 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini

2013-11-07 19:47 - 2013-11-07 19:52 - 05144303 ____R (Swearware) C:\Users\Laura\Desktop\ComboFix.exe

2013-11-07 15:59 - 2010-10-06 15:29 - 00654400 _____ C:\Windows\system32\perfh007.dat

2013-11-07 15:59 - 2010-10-06 15:29 - 00130240 _____ C:\Windows\system32\perfc007.dat

2013-11-07 15:59 - 2009-07-14 06:13 - 00777466 _____ C:\Windows\system32\PerfStringBackup.INI

2013-11-07 15:53 - 2013-11-07 15:54 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-11-07 03:25 - 2011-09-16 23:55 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001Core.job

2013-11-06 22:26 - 2013-11-06 22:26 - 500650158 _____ C:\Windows\MEMORY.DMP

2013-11-06 22:26 - 2013-11-06 22:26 - 00456112 _____ C:\Windows\Minidump\110613-18267-01.dmp

2013-11-06 22:26 - 2013-11-06 22:26 - 00000000 ____D C:\Windows\Minidump

2013-11-06 21:02 - 2013-11-06 21:02 - 00003941 _____ C:\Users\Laura\Desktop\gmer.txt

2013-11-06 20:45 - 2013-11-06 20:45 - 00000472 _____ C:\Users\Laura\Desktop\defogger_disable.log

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Avira

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 _____ C:\Users\Laura\defogger_reenable

2013-11-06 20:45 - 2011-01-05 16:44 - 00000000 ____D C:\Users\Laura

2013-11-06 20:39 - 2013-11-06 20:39 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\ProgramData\Avira

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\Program Files (x86)\Avira

2013-11-06 17:04 - 2013-11-06 20:54 - 00377856 _____ C:\Users\Laura\Desktop\ntn2cchg.exe

2013-11-06 16:58 - 2013-11-06 20:44 - 00050477 _____ C:\Users\Laura\Desktop\Defogger.exe

2013-11-06 14:55 - 2013-11-06 14:54 - 00028609 _____ C:\Users\Laura\Desktop\Addition.txt

2013-11-06 14:52 - 2013-11-06 14:52 - 00000000 ____D C:\FRST

2013-11-06 13:48 - 2011-01-05 17:15 - 00000000 ____D C:\Users\Laura\AppData\Roaming\ICQ

2013-11-06 13:28 - 2013-11-06 13:31 - 01957098 _____ (Farbar) C:\Users\Laura\Desktop\FRST64.exe

2013-11-06 13:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2013-11-06 12:25 - 2013-11-06 20:39 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-11-06 12:25 - 2013-11-06 20:39 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-11-06 12:25 - 2013-11-06 20:39 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-11-06 12:01 - 2013-11-06 12:01 - 00000000 __RSD C:\Users\Laura\Documents\My Stationery

2013-11-06 09:16 - 2013-11-06 09:16 - 00000000 ____D C:\ProgramData\Oracle

2013-11-06 09:15 - 2013-11-06 09:16 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-06 09:15 - 2013-11-06 09:15 - 00000000 ____D C:\Program Files (x86)\Java

2013-10-18 18:00 - 2011-01-20 20:35 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
 

Some content of TEMP:

====================

C:\Users\Laura\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-11-06 13:04
 

==================== End Of Log ============================

--- --- ---

Gruß
Omty

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo Schrauber,

die Scans sind wieder durchgelaufen. Nachfolgend die Logs:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=ae89bdfa97f1ed4993f50bc54a1a3f27

# engine=15823

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-11-09 09:21:49

# local_time=2013-11-09 10:21:49 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 94 9893 154703414 2672 0

# compatibility_mode=5892 16777213 88 94 21805890 34574617 0 0

# scanned=224879

# found=0

# cleaned=0

# scan_time=5902

Code:

 Results of screen317's Security Check version 0.99.74  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

Microsoft Security Essentials   

Avira Desktop                   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 TuneUp Utilities 2012   

 TuneUp Utilities Language Pack (de-DE) 

 Java 7 Update 45  

 Java version out of Date! 

 Adobe Flash Player 10 Flash Player out of Date! 

 Adobe Reader 9 Adobe Reader out of Date! 

 Mozilla Firefox (3.6.12) Firefox out of Date!  

 Google Chrome 30.0.1599.101  

 Google Chrome 30.0.1599.69  
 ````````Process Check: objlist.exe by Laurent````````  

 Microsoft Security Essentials MSMpEng.exe 

 Microsoft Security Essentials msseces.exe 

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013

Ran by Laura (administrator) on LAURA-PC on 09-11-2013 22:31:01

Running from C:\Users\Laura\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\system32\atiesrxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Devguru Co., Ltd.) C:\Windows\SysWOW64\dgdersvc.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe

() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe

() C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe

(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe

(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-06-18] (IDT, Inc.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2010-03-17] (Synaptics Incorporated)

HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE [5712896 2010-02-03] (Dell Inc.)

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)

HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [559616 2011-10-10] (Dell)

HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-06] (Google Inc.)

HKCU\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\/\KiesTrayAgent.exe [3365176 2010-10-27] (Samsung Electronics Co., Ltd.)

HKCU\...\Run: [ICQ] - C:\Program Files (x86)\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)

HKCU\...\Run: [Facebook Update] - C:\Users\Laura\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-13] (Facebook Inc.)

HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-06-08] (Intel Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [409744 2009-06-24] (Creative Technology Ltd)

HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-10-15] ()

HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-02] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [DellSupportCenter] - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-11-06] (Avira Operations GmbH & Co. KG)

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk

ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

URLSearchHook: HKCU - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - DefaultScope {057B639C-42CC-4E9A-9D99-0ADAED5CAB7C} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7MOOI_de

SearchScopes: HKCU - {057B639C-42CC-4E9A-9D99-0ADAED5CAB7C} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7MOOI_de

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg64.dll (Google Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\hltbsdz9.default

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Laura\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com

CHR RestoreOnStartup: "hxxp://www.google.com"

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()

CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\gears.dll No File

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File

CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL No File

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll No File

CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR Extension: (DvdVideoSoft Free Youtube Download) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-11-06] (Avira Operations GmbH & Co. KG)

R2 dgdersvc; C:\Windows\SysWOW64\dgdersvc.exe [95568 2010-10-25] (Devguru Co., Ltd.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)

S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)

R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-05-29] (TuneUp Software)

R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE [48128 2010-02-03] (Dell Inc.)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-11-06] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-11-06] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-06] (Avira Operations GmbH & Co. KG)

R3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20568 2009-12-22] (Devguru Co., Ltd)

R3 dgderdrv; C:\Windows\SysWow64\drivers\dgderdrv.sys [18120 2010-10-25] (Devguru Co., Ltd)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 ss_bserd; C:\Windows\System32\DRIVERS\ss_bserd.sys [128000 2009-09-19] (MCCI Corporation)

R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-08] (TuneUp Software)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S1 nddwrzyi; \??\C:\Windows\system32\drivers\nddwrzyi.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-09 22:30 - 2013-11-09 22:30 - 00001416 _____ C:\Users\Laura\Desktop\checkup.txt

2013-11-09 20:41 - 2013-11-09 20:41 - 00000000 ____D C:\Program Files (x86)\ESET

2013-11-09 20:40 - 2013-11-09 20:34 - 00891167 _____ C:\Users\Laura\Desktop\SecurityCheck.exe

2013-11-09 20:40 - 2013-11-09 20:33 - 02347384 _____ (ESET) C:\Users\Laura\Desktop\esetsmartinstaller_enu.exe

2013-11-09 20:37 - 2013-11-09 20:37 - 103387443 _____ C:\Windows\SysWOW64\`

2013-11-08 22:27 - 2013-11-08 22:27 - 00000625 _____ C:\Users\Laura\Desktop\JRT.txt

2013-11-08 22:19 - 2013-11-08 22:19 - 00000000 ____D C:\Windows\ERUNT

2013-11-08 22:18 - 2013-11-08 21:46 - 01034531 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe

2013-11-08 22:16 - 2013-11-08 22:16 - 00014691 _____ C:\Users\Laura\Desktop\AdwCleaner[S0].txt

2013-11-08 22:11 - 2013-11-08 22:13 - 00000000 ____D C:\AdwCleaner

2013-11-08 22:11 - 2013-11-08 21:45 - 01073262 _____ C:\Users\Laura\Desktop\adwcleaner.exe

2013-11-08 21:54 - 2013-11-08 21:54 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 21:54 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-11-07 20:27 - 2013-11-07 20:27 - 00023616 _____ C:\ComboFix.txt

2013-11-07 19:56 - 2013-11-07 20:28 - 00000000 ____D C:\Qoobox

2013-11-07 19:56 - 2013-11-07 20:20 - 00000000 ____D C:\Windows\erdnt

2013-11-07 19:56 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2013-11-07 19:56 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2013-11-07 19:56 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2013-11-07 19:56 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2013-11-07 19:52 - 2013-11-07 19:47 - 05144303 ____R (Swearware) C:\Users\Laura\Desktop\ComboFix.exe

2013-11-07 15:54 - 2013-11-07 15:53 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-11-06 22:26 - 2013-11-06 22:26 - 500650158 _____ C:\Windows\MEMORY.DMP

2013-11-06 22:26 - 2013-11-06 22:26 - 00456112 _____ C:\Windows\Minidump\110613-18267-01.dmp

2013-11-06 22:26 - 2013-11-06 22:26 - 00000000 ____D C:\Windows\Minidump

2013-11-06 21:02 - 2013-11-06 21:02 - 00003941 _____ C:\Users\Laura\Desktop\gmer.txt

2013-11-06 20:54 - 2013-11-06 17:04 - 00377856 _____ C:\Users\Laura\Desktop\ntn2cchg.exe

2013-11-06 20:45 - 2013-11-06 20:45 - 00000472 _____ C:\Users\Laura\Desktop\defogger_disable.log

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Avira

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 _____ C:\Users\Laura\defogger_reenable

2013-11-06 20:44 - 2013-11-06 16:58 - 00050477 _____ C:\Users\Laura\Desktop\Defogger.exe

2013-11-06 20:39 - 2013-11-06 20:39 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\ProgramData\Avira

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\Program Files (x86)\Avira

2013-11-06 20:39 - 2013-11-06 12:25 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-11-06 20:39 - 2013-11-06 12:25 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-11-06 20:39 - 2013-11-06 12:25 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-11-06 14:54 - 2013-11-06 14:55 - 00028609 _____ C:\Users\Laura\Desktop\Addition.txt

2013-11-06 14:52 - 2013-11-06 14:52 - 00000000 ____D C:\FRST

2013-11-06 13:31 - 2013-11-06 13:28 - 01957098 _____ (Farbar) C:\Users\Laura\Desktop\FRST64.exe

2013-11-06 12:01 - 2013-11-06 12:01 - 00000000 __RSD C:\Users\Laura\Documents\My Stationery

2013-11-06 09:16 - 2013-11-06 09:16 - 00000000 ____D C:\ProgramData\Oracle

2013-11-06 09:16 - 2013-11-06 09:15 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-06 09:15 - 2013-11-06 09:15 - 00000000 ____D C:\Program Files (x86)\Java
 

==================== One Month Modified Files and Folders =======
 

2013-11-09 22:30 - 2013-11-09 22:30 - 00001416 _____ C:\Users\Laura\Desktop\checkup.txt

2013-11-09 22:27 - 2010-10-06 12:40 - 01982043 _____ C:\Windows\WindowsUpdate.log

2013-11-09 21:56 - 2011-01-06 12:59 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-11-09 21:25 - 2011-09-16 23:55 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001UA.job

2013-11-09 20:44 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-09 20:44 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-09 20:41 - 2013-11-09 20:41 - 00000000 ____D C:\Program Files (x86)\ESET

2013-11-09 20:38 - 2012-12-14 18:39 - 00000000 ___RD C:\Users\Laura\Dropbox

2013-11-09 20:38 - 2012-12-14 18:37 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox

2013-11-09 20:37 - 2013-11-09 20:37 - 103387443 _____ C:\Windows\SysWOW64\`

2013-11-09 20:36 - 2011-01-06 12:59 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-11-09 20:36 - 2011-01-05 16:48 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks

2013-11-09 20:36 - 2011-01-05 16:48 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks

2013-11-09 20:36 - 2010-10-06 13:34 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-11-09 20:36 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-09 20:36 - 2009-07-14 05:51 - 00093399 _____ C:\Windows\setupact.log

2013-11-09 20:34 - 2013-11-09 20:40 - 00891167 _____ C:\Users\Laura\Desktop\SecurityCheck.exe

2013-11-09 20:33 - 2013-11-09 20:40 - 02347384 _____ (ESET) C:\Users\Laura\Desktop\esetsmartinstaller_enu.exe

2013-11-08 22:27 - 2013-11-08 22:27 - 00000625 _____ C:\Users\Laura\Desktop\JRT.txt

2013-11-08 22:19 - 2013-11-08 22:19 - 00000000 ____D C:\Windows\ERUNT

2013-11-08 22:16 - 2013-11-08 22:16 - 00014691 _____ C:\Users\Laura\Desktop\AdwCleaner[S0].txt

2013-11-08 22:13 - 2013-11-08 22:11 - 00000000 ____D C:\AdwCleaner

2013-11-08 22:12 - 2011-01-05 17:15 - 00000000 ____D C:\ProgramData\ICQ

2013-11-08 22:08 - 2010-12-25 10:38 - 00110056 _____ C:\Windows\PFRO.log

2013-11-08 21:54 - 2013-11-08 21:54 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-08 21:54 - 2013-11-08 21:54 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-08 21:46 - 2013-11-08 22:18 - 01034531 _____ (Thisisu) C:\Users\Laura\Desktop\JRT.exe

2013-11-08 21:45 - 2013-11-08 22:11 - 01073262 _____ C:\Users\Laura\Desktop\adwcleaner.exe

2013-11-07 20:28 - 2013-11-07 19:56 - 00000000 ____D C:\Qoobox

2013-11-07 20:27 - 2013-11-07 20:27 - 00023616 _____ C:\ComboFix.txt

2013-11-07 20:20 - 2013-11-07 19:56 - 00000000 ____D C:\Windows\erdnt

2013-11-07 20:10 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini

2013-11-07 19:47 - 2013-11-07 19:52 - 05144303 ____R (Swearware) C:\Users\Laura\Desktop\ComboFix.exe

2013-11-07 15:59 - 2010-10-06 15:29 - 00654400 _____ C:\Windows\system32\perfh007.dat

2013-11-07 15:59 - 2010-10-06 15:29 - 00130240 _____ C:\Windows\system32\perfc007.dat

2013-11-07 15:59 - 2009-07-14 06:13 - 00777466 _____ C:\Windows\system32\PerfStringBackup.INI

2013-11-07 15:53 - 2013-11-07 15:54 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2013-11-07 03:25 - 2011-09-16 23:55 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1772773647-172457383-241920096-1001Core.job

2013-11-06 22:26 - 2013-11-06 22:26 - 500650158 _____ C:\Windows\MEMORY.DMP

2013-11-06 22:26 - 2013-11-06 22:26 - 00456112 _____ C:\Windows\Minidump\110613-18267-01.dmp

2013-11-06 22:26 - 2013-11-06 22:26 - 00000000 ____D C:\Windows\Minidump

2013-11-06 21:02 - 2013-11-06 21:02 - 00003941 _____ C:\Users\Laura\Desktop\gmer.txt

2013-11-06 20:45 - 2013-11-06 20:45 - 00000472 _____ C:\Users\Laura\Desktop\defogger_disable.log

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Avira

2013-11-06 20:45 - 2013-11-06 20:45 - 00000000 _____ C:\Users\Laura\defogger_reenable

2013-11-06 20:45 - 2011-01-05 16:44 - 00000000 ____D C:\Users\Laura

2013-11-06 20:39 - 2013-11-06 20:39 - 00001996 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\ProgramData\Avira

2013-11-06 20:39 - 2013-11-06 20:39 - 00000000 ____D C:\Program Files (x86)\Avira

2013-11-06 17:04 - 2013-11-06 20:54 - 00377856 _____ C:\Users\Laura\Desktop\ntn2cchg.exe

2013-11-06 16:58 - 2013-11-06 20:44 - 00050477 _____ C:\Users\Laura\Desktop\Defogger.exe

2013-11-06 14:55 - 2013-11-06 14:54 - 00028609 _____ C:\Users\Laura\Desktop\Addition.txt

2013-11-06 14:52 - 2013-11-06 14:52 - 00000000 ____D C:\FRST

2013-11-06 13:48 - 2011-01-05 17:15 - 00000000 ____D C:\Users\Laura\AppData\Roaming\ICQ

2013-11-06 13:28 - 2013-11-06 13:31 - 01957098 _____ (Farbar) C:\Users\Laura\Desktop\FRST64.exe

2013-11-06 13:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2013-11-06 12:25 - 2013-11-06 20:39 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2013-11-06 12:25 - 2013-11-06 20:39 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2013-11-06 12:25 - 2013-11-06 20:39 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2013-11-06 12:01 - 2013-11-06 12:01 - 00000000 __RSD C:\Users\Laura\Documents\My Stationery

2013-11-06 09:16 - 2013-11-06 09:16 - 00000000 ____D C:\ProgramData\Oracle

2013-11-06 09:15 - 2013-11-06 09:16 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-11-06 09:15 - 2013-11-06 09:15 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-06 09:15 - 2013-11-06 09:15 - 00000000 ____D C:\Program Files (x86)\Java

2013-10-18 18:00 - 2011-01-20 20:35 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
 

Some content of TEMP:

====================

C:\Users\Laura\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-11-06 13:04
 

==================== End Of Log ============================

--- --- ---

Eset konnte nicht gelöscht werden, gleiche Meldung wie oben erwähnt. Downloads aus dem Internet und Updates laufen noch nicht.

Gruß Omty

Alle Downloads aus dem Internet? Egal welcher Browser?

Hallo Schrauber,

der Download über Firefox funtioniert. Über den CCleaner kann ich Software deinstallieren. Windows Updates laufen nicht kein Download, auch wenn ich über die Systemsteuerung versuche Programme zu deinstallieren funktioniert das nicht. Glaubst Du, dass das an einem Trojaner liegt oder das System einen Schaden hat? :headbang:

Ich würd jetzt erst mal die Win DVD einlegen und ein Inplace Upgrade machen.