Trojaner-Board - Firefox öffnet sowohl neue Tabs als auch Werbe-Videos selbstständig!

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Firefox öffnet sowohl neue Tabs als auch Werbe-Videos selbstständig! (https://www.trojaner-board.de/148311-firefox-oeffnet-sowohl-neue-tabs-werbe-videos-selbststaendig.html)

Firefox öffnet sowohl neue Tabs als auch Werbe-Videos selbstständig!

In den letzten Tagen hat sich folgendes Problem bei mir eingestellt: Firefox öffnet immer wieder neue Tabs und Fenster und startet sogar ohne weiteres zutuen Werbe-Videos. Das sind z.T. Seiten die immer wieder vorkommen, als auch neue. :confused:

Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hier die Log-Files:

Frst.txt

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2014 04

Ran by Holger-PC (administrator) on HOLGER on 21-01-2014 00:13:19

Running from C:\Users\Holger-PC\Downloads

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

() C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe

(The OpenVPN Project) C:\Program Files (x86)\OpenVPN\bin\openvpn.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe

(Spotify Ltd) C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

() C:\Users\Holger-PC\Downloads\Defogger.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-20] (APN)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

HKLM-x32\...\RunOnce: [VideoDownloadConverter_4zbar Uninstall] - rundll32 C:\PROGRA~2\4ZUNIN~1.DLL,O -3 uninstalltype="IE" [712264 2013-08-08] (MindSpark)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoViewOnDrive] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKLM\...\Policies\Explorer: [NoFind] 0

HKLM\...\Policies\Explorer: [NoFile] 0

HKLM\...\Policies\Explorer: [HideClock] 0

HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0

HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKLM\...\Policies\Explorer: [NoSetTaskbar] 0

HKLM\...\Policies\Explorer: [NoDeletePrinter] 0

HKLM\...\Policies\Explorer: [NoDFSTab] 0

HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0

HKLM\...\Policies\Explorer: [NoLogoff] 0

HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0

HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0

HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKLM\...\Policies\Explorer: [NoResolveSearch] 0

HKLM\...\Policies\Explorer: [NoSaveSettings] 0

HKLM\...\Policies\Explorer: [NoHardwareTab] 0

HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKLM\...\Policies\Explorer: [NoDesktop] 0

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-20] (Spotify Ltd)

HKCU\...\Run: [iLivid] - "C:\Users\Holger-PC\AppData\Local\iLivid\iLivid.exe" -autorun

HKCU\...\Policies\system: [DisableCMD] 0

HKCU\...\Policies\system: [NoDispAppearancePage] 0

HKCU\...\Policies\system: [NoDispBackgroundPage] 0

HKCU\...\Policies\system: [NoDispSettingsPage] 0

HKCU\...\Policies\Explorer: [NoViewOnDrive] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000

HKCU\...\Policies\Explorer: [NoFile] 0

HKCU\...\Policies\Explorer: [NoTrayContextMenu] 0

HKCU\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKCU\...\Policies\Explorer: [NoSetTaskbar] 0

HKCU\...\Policies\Explorer: [NoDeletePrinter] 0

HKCU\...\Policies\Explorer: [NoDFSTab] 0

HKCU\...\Policies\Explorer: [NoChangeStartMenu] 0

HKCU\...\Policies\Explorer: [NoWindowsUpdate] 0

HKCU\...\Policies\Explorer: [NoEncryptOnMove] 0

HKCU\...\Policies\Explorer: [NoResolveSearch] 0

HKCU\...\Policies\Explorer: [NoSaveSettings] 0

HKCU\...\Policies\Explorer: [NoHardwareTab] 0

HKCU\...\Policies\Explorer: [NoStartMenuSubFolders] 0

AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => File Not Found

Startup: C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

SearchScopes: HKLM - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm382^YYA^de&si=pconverter&ptb=C50355B6-DCED-469C-BA97-A38F881B1C56&ind=2013082107&n=77fd31fb&psa=&st=sb&searchfor={searchTerms}

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SPE98476B4-FD43-4D55-A9DF-F823732BAE14&q={searchTerms}&SSPV=

SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SPE98476B4-FD43-4D55-A9DF-F823732BAE14&q={searchTerms}&SSPV=

SearchScopes: HKCU - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = 

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=D4A700FFDF60208D&affID=121565&tsp=5023

SearchScopes: HKCU - {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm382^YYA^de&si=pconverter&ptb=C50355B6-DCED-469C-BA97-A38F881B1C56&ind=2013082107&n=77fd31fb&psa=&st=sb&searchfor={searchTerms}

BHO: click-n-mark-5 - {11111111-1111-1111-1111-110411511182} - C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho64.dll (Remarkable)

BHO: Feven 2.2 - {11111111-1111-1111-1111-110411901112} - C:\Program Files (x86)\Feven 2.2\Feven 2.2-bho64.dll No File

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll No File

BHO: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)

BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Re-Markable - {bd55172e-59c1-4a93-b19c-633f0d7790ad} - C:\Program Files (x86)\Re-Markable\150.dll ()

BHO-x32: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)

Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 132.231.221.253
 

FireFox:

========

FF ProfilePath: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default

FF user.js: detected! => C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\user.js

FF NewTab: hxxp://search.conduit.com/?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=2&UP=SPE98476B4-FD43-4D55-A9DF-F823732BAE14

FF SearchEngineOrder.1: Ask.com

FF SelectedSearchEngine: Google

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( )

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF SearchPlugin: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\searchplugins\ask-web-search.xml

FF SearchPlugin: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\searchplugins\Ask.xml

FF SearchPlugin: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\searchplugins\conduit-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Ask.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\nationzoom.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Widget context - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-14]

FF Extension: Feven 2.2 - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\15d84a30-fc9d-4fca-80a7-e5797da621a2@b2cb2d04-e262-4863-aee7-9d0e4333b550.com [2014-01-07]

FF Extension: click-n-mark-5 - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com [2014-01-05]

FF Extension: Delta Toolbar - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\ffxtlbr@delta.com [2013-10-02]

FF Extension: Websteroids - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\support@websteroidsapp.com [2014-01-09]

FF Extension: Yahoo! Toolbar - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2013-08-21]

FF Extension: Value Apps - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\{94cd2cc3-083f-49ba-a218-4cda4b4829fd} [2014-01-09]

FF Extension: Amazon 1Button App for Firefox - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\abb@amazon.com.xpi [2013-09-04]

FF Extension: GutscheinCodes.de GutscheinFinder - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi [2013-07-12]

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-10-23]

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-11-26]

FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

FF HKCU\...\Firefox\Extensions: [{cb1bb3bd-8ce0-4d26-98c4-99f6415a6002}] - C:\Program Files (x86)\Re-Markable\150.xpi

FF Extension: Re-Markable - C:\Program Files (x86)\Re-Markable\150.xpi [2014-01-03]
 

Chrome: 

=======

CHR Extension: (No Name) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhbagplpkkoeifmpmpdaieomnggppmo [2014-01-07]

CHR Extension: (No Name) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiiggndjhacnnhnhmaljgbgcaneehld [2014-01-03]

CHR Extension: (No Name) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-14]

CHR Extension: (No Name) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec [2013-07-11]

CHR HKLM-x32\...\Chrome\Extension: [ejdfidgapfiokiphmcjpmmjbdndepoja] - C:\Program Files (x86)\Re-Markable\150.crx [2014-01-03]

CHR HKLM-x32\...\Chrome\Extension: [onpejdpfebeopffobknkodakfphdelnh] - C:\Users\Holger-PC\AppData\Roaming\BabSolution\CR\Delta.crx [2014-01-03]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

U2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-07-16] (Freemake)

U2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

U2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

U3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)

U3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)

U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

U3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [x]
 

==================== Drivers (Whitelisted) ====================
 

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-19] (Avira Operations GmbH & Co. KG)

U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

U3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

U3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)

U2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

U3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

U3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )

U3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

U3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

U0 SR; 

U2 srservice; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-21 00:13 - 2014-01-21 00:13 - 00022410 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:13 - 2014-01-21 00:13 - 00000000 ____D C:\FRST

2014-01-21 00:11 - 2014-01-21 00:11 - 02076672 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST64.exe

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 23:47 - 2014-01-20 23:47 - 00000000 ____D C:\AdwCleaner

2014-01-20 23:38 - 2013-08-08 11:37 - 00712264 _____ (MindSpark) C:\Program Files (x86)\4zUninstall VideoDownloadConverter.dll

2014-01-20 23:38 - 2013-08-08 11:37 - 00194968 _____ () C:\Program Files (x86)\4zres.dll

2014-01-20 22:43 - 2014-01-20 22:52 - 00260400 _____ C:\windows\PFRO.log

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-20 20:35 - 2014-01-20 20:35 - 01236282 _____ C:\Users\Holger-PC\Desktop\adwcleaner_3.017.exe

2014-01-18 19:51 - 2014-01-20 20:37 - 00616555 _____ C:\windows\WindowsUpdate.log

2014-01-17 14:14 - 2014-01-17 14:35 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-15 23:46 - 2014-01-15 23:46 - 00000000 ____D C:\windows\SysWOW64\SearchProtect

2014-01-15 21:40 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll

2014-01-15 21:40 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\MPSSVC.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\windows\SysWOW64\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mpsdrv.sys

2014-01-15 21:40 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll

2014-01-15 21:40 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll

2014-01-15 21:40 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys

2014-01-15 21:40 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2014-01-15 21:40 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2014-01-15 21:40 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2014-01-15 21:40 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2014-01-13 13:24 - 2014-01-14 20:27 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 19:20 - 2014-01-20 22:52 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-09 11:33 - 2014-01-20 22:52 - 00000000 ____D C:\ProgramData\RHelpers

2014-01-09 11:33 - 2014-01-20 22:52 - 00000000 ____D C:\Program Files\Conduit

2014-01-09 11:33 - 2014-01-20 22:40 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Conduit

2014-01-09 11:33 - 2014-01-20 22:40 - 00000000 ____D C:\Program Files (x86)\Conduit

2014-01-09 11:33 - 2014-01-20 22:30 - 00000000 ____D C:\ProgramData\Updater

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-09 11:32 - 2014-01-20 22:40 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\SwvUpdater

2014-01-07 21:14 - 2014-01-20 22:40 - 00000000 ____D C:\Program Files (x86)\Movies Toolbar

2014-01-07 21:06 - 2014-01-09 18:49 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-14 20:29 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro

2014-01-07 20:39 - 2014-01-14 20:27 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Mobogenie

2014-01-07 20:39 - 2014-01-14 20:24 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\genienext

2014-01-07 20:39 - 2014-01-10 19:57 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Mobogenie

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00004030 _____ C:\windows\System32\Tasks\LaunchApp

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-03 14:58 - 2014-01-20 22:55 - 00001376 _____ C:\windows\Tasks\click-n-mark-5-updater.job

2014-01-03 14:58 - 2014-01-20 22:55 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-03 14:58 - 2014-01-03 14:58 - 00004380 _____ C:\windows\System32\Tasks\click-n-mark-5-updater

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\Desktop\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\emaze

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\ProgramData\VisualBee

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2014-01-03 14:57 - 2014-01-20 22:55 - 00001994 _____ C:\windows\Tasks\click-n-mark-5-chromeinstaller.job

2014-01-03 14:57 - 2014-01-20 22:54 - 00001920 _____ C:\windows\Tasks\click-n-mark-5-firefoxinstaller.job

2014-01-03 14:57 - 2014-01-20 22:53 - 00001282 _____ C:\windows\Tasks\click-n-mark-5-codedownloader.job

2014-01-03 14:57 - 2014-01-20 22:53 - 00001182 _____ C:\windows\Tasks\click-n-mark-5-enabler.job

2014-01-03 14:57 - 2014-01-18 15:30 - 00000000 ____D C:\Program Files (x86)\click-n-mark-5

2014-01-03 14:57 - 2014-01-14 20:28 - 00000000 ____D C:\Program Files (x86)\MyPC Backup

2014-01-03 14:57 - 2014-01-03 14:57 - 00004286 _____ C:\windows\System32\Tasks\click-n-mark-5-codedownloader

2014-01-03 14:57 - 2014-01-03 14:57 - 00004186 _____ C:\windows\System32\Tasks\click-n-mark-5-enabler

2014-01-03 14:56 - 2014-01-20 22:43 - 00000000 ____D C:\ProgramData\WPM

2013-12-30 18:20 - 2014-01-20 22:40 - 00000000 ____D C:\Program Files (x86)\SearchProtect

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\SearchProtect

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe

2013-12-24 03:31 - 2013-12-24 03:49 - 146959905 _____ C:\Users\Holger-PC\Downloads\Ame - Leidku(3).rar
 

==================== One Month Modified Files and Folders =======
 

2014-01-21 00:13 - 2014-01-21 00:13 - 00022410 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:13 - 2014-01-21 00:13 - 00000000 ____D C:\FRST

2014-01-21 00:11 - 2014-01-21 00:11 - 02076672 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST64.exe

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-21 00:00 - 2013-07-11 10:24 - 00000000 ____D C:\Users\Holger-PC

2014-01-21 00:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 23:49 - 2013-07-11 11:49 - 00000318 _____ C:\windows\Tasks\Dealply.job

2014-01-20 23:47 - 2014-01-20 23:47 - 00000000 ____D C:\AdwCleaner

2014-01-20 23:25 - 2013-09-30 09:30 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2014-01-20 23:18 - 2013-07-11 12:41 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Spotify

2014-01-20 23:18 - 2013-07-11 12:40 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Spotify

2014-01-20 22:55 - 2014-01-03 14:58 - 00001376 _____ C:\windows\Tasks\click-n-mark-5-updater.job

2014-01-20 22:55 - 2014-01-03 14:58 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-20 22:55 - 2014-01-03 14:57 - 00001994 _____ C:\windows\Tasks\click-n-mark-5-chromeinstaller.job

2014-01-20 22:54 - 2014-01-03 14:57 - 00001920 _____ C:\windows\Tasks\click-n-mark-5-firefoxinstaller.job

2014-01-20 22:53 - 2014-01-03 14:57 - 00001282 _____ C:\windows\Tasks\click-n-mark-5-codedownloader.job

2014-01-20 22:53 - 2014-01-03 14:57 - 00001182 _____ C:\windows\Tasks\click-n-mark-5-enabler.job

2014-01-20 22:53 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2014-01-20 22:52 - 2014-01-20 22:43 - 00260400 _____ C:\windows\PFRO.log

2014-01-20 22:52 - 2014-01-11 19:20 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-20 22:52 - 2014-01-09 11:33 - 00000000 ____D C:\ProgramData\RHelpers

2014-01-20 22:52 - 2014-01-09 11:33 - 00000000 ____D C:\Program Files\Conduit

2014-01-20 22:52 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2014-01-20 22:43 - 2014-01-03 14:56 - 00000000 ____D C:\ProgramData\WPM

2014-01-20 22:40 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Conduit

2014-01-20 22:40 - 2014-01-09 11:33 - 00000000 ____D C:\Program Files (x86)\Conduit

2014-01-20 22:40 - 2014-01-09 11:32 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\SwvUpdater

2014-01-20 22:40 - 2014-01-07 21:14 - 00000000 ____D C:\Program Files (x86)\Movies Toolbar

2014-01-20 22:40 - 2013-12-30 18:20 - 00000000 ____D C:\Program Files (x86)\SearchProtect

2014-01-20 22:40 - 2013-10-02 14:39 - 00000000 ____D C:\ProgramData\DSearchLink

2014-01-20 22:30 - 2014-01-09 11:33 - 00000000 ____D C:\ProgramData\Updater

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-20 20:37 - 2014-01-18 19:51 - 00616555 _____ C:\windows\WindowsUpdate.log

2014-01-20 20:35 - 2014-01-20 20:35 - 01236282 _____ C:\Users\Holger-PC\Desktop\adwcleaner_3.017.exe

2014-01-18 15:30 - 2014-01-03 14:57 - 00000000 ____D C:\Program Files (x86)\click-n-mark-5

2014-01-17 14:59 - 2013-10-27 12:18 - 00768688 _____ C:\windows\system32\perfh019.dat

2014-01-17 14:59 - 2013-10-27 12:18 - 00157826 _____ C:\windows\system32\perfc019.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2014-01-17 14:59 - 2012-07-26 08:28 - 02671956 _____ C:\windows\system32\PerfStringBackup.INI

2014-01-17 14:55 - 2013-08-22 17:49 - 00000000 ____D C:\Users\Holger-PC\Desktop\Musik

2014-01-17 14:35 - 2014-01-17 14:14 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-16 19:47 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache

2014-01-16 18:53 - 2013-08-09 14:37 - 00000000 ____D C:\windows\system32\MRT

2014-01-16 18:53 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2014-01-16 18:51 - 2013-07-12 21:14 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-01-15 23:46 - 2014-01-15 23:46 - 00000000 ____D C:\windows\SysWOW64\SearchProtect

2014-01-14 20:29 - 2014-01-07 20:39 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro

2014-01-14 20:28 - 2014-01-03 14:57 - 00000000 ____D C:\Program Files (x86)\MyPC Backup

2014-01-14 20:28 - 2013-07-11 10:30 - 00000000 ___RD C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-14 20:27 - 2014-01-13 13:24 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2014-01-14 20:27 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Mobogenie

2014-01-14 20:24 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\genienext

2014-01-13 16:21 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2014-01-13 13:44 - 2013-10-04 15:05 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Studium

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 16:49 - 2013-07-11 11:48 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2413837752-2537467696-3434217499-1001

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-11 16:37 - 2013-12-12 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-10 19:57 - 2014-01-07 20:39 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-10 14:49 - 2013-12-19 05:49 - 00000082 _____ C:\Users\Holger-PC\AppData\Roaming\WB.CFG

2014-01-09 18:49 - 2014-01-07 21:06 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-09 11:33 - 2013-07-05 19:21 - 00000000 _____ C:\END

2014-01-09 09:02 - 2013-11-14 18:05 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-01-09 09:02 - 2013-11-14 18:05 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-07 21:10 - 2013-07-11 10:29 - 00001671 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Mobogenie

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00004030 _____ C:\windows\System32\Tasks\LaunchApp

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-07 20:15 - 2012-11-07 21:48 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games

2014-01-07 19:52 - 2013-08-09 18:16 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\WildTangent

2014-01-07 19:52 - 2012-11-07 21:48 - 00000000 ____D C:\ProgramData\WildTangent

2014-01-03 14:58 - 2014-01-03 14:58 - 00004380 _____ C:\windows\System32\Tasks\click-n-mark-5-updater

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\Desktop\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\emaze

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\ProgramData\VisualBee

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2014-01-03 14:57 - 2014-01-03 14:57 - 00004286 _____ C:\windows\System32\Tasks\click-n-mark-5-codedownloader

2014-01-03 14:57 - 2014-01-03 14:57 - 00004186 _____ C:\windows\System32\Tasks\click-n-mark-5-enabler

2013-12-30 18:21 - 2013-10-02 14:36 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\SearchProtect

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe

2013-12-24 03:49 - 2013-12-24 03:31 - 146959905 _____ C:\Users\Holger-PC\Downloads\Ame - Leidku(3).rar
 

Files to move or delete:

====================

C:\Users\Public\AlexaNSISPlugin.8188.dll
 
 

Some content of TEMP:

====================

C:\Users\Holger-PC\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-17 21:08
 

==================== End Of Log ============================

--- --- ---

Addition.txt

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-01-2014 04

Ran by Holger-PC at 2014-01-21 00:13:58

Running from C:\Users\Holger-PC\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)

Amazon Browser Bar (Version: 3.0.2012.0802 - Amazon.com)

Amazon Browser Settings (x32 Version: 3.0 - Amazon)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC) Hidden

Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)

Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)

AVG 2014 (Version: 14.0.3604 - AVG Technologies) Hidden

Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)

Avira SearchFree Toolbar (x32 Version: 12.10.0.2949 - APN, LLC)

AVS Audio Converter 7 (x32 Version: 7.2.1.528 - Online Media Technologies Ltd.)

Bonjour (Version: 3.0.0.10 - Apple Inc.)

CCleaner (Version: 4.08 - Piriform)

Citavi 4 (x32 Version: 4.2.0.11 - Swiss Academic Software)

click-n-mark-5 (x32 Version: 1.29.153.3 - Remarkable)

Dealply (HKCU Version:  - ) <==== ATTENTION

DMUninstaller (x32 Version:  - )

Exact Audio Copy 1.0beta3 (x32 Version: 1.0beta3 - Andre Wiethoff)

Free YouTube Download version 3.2.19.1219 (x32 Version: 3.2.19.1219 - DVDVideoSoft Ltd.)

Free Zip Opener (x32 Version: 1.0 - Tripro Limited)

Freemake Audio Converter Version 1.1.0 (x32 Version: 1.1.0 - Ellora Assets Corporation)

Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION

Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)

Intel AppUp(SM) center (x32 Version: 3.6.1.33268.15 - Intel)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION

iTunes (Version: 11.1.0.126 - Apple Inc.)

Lightspark 0.5.3-git (x32 Version: 0.5.3-git - Lightspark Team)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft Office (x32 Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft Silverlight (x32 Version: 4.0.60310.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

Nero 12 Essentials Toshiba (x32 Version: 12.0.00400 - Nero AG)

Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden

Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)

OpenVPN 2.3.2 UniPassau (x32 Version: 2.3.2 - )

PC Speed Maximizer v3.1 (x32 Version: 3.1 - Smart PC Solutions)

Premium Sound HD (Version: 1.12.4600 - SRS Labs, Inc.)

Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp) Hidden

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6687 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (x32 Version: 2.00.0020 - REALTEK Semiconductor Corp.)

Re-Markable (x32 Version:  - Re-Markable Software)

Shared C Run-time for x64 (Version: 10.0.0 - McAfee)

Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)

Synaptics Pointing Device Driver (Version: 16.2.10.3 - Synaptics Incorporated)

TAP-Windows 9.9.2 (Version: 9.9.2 - )

TOSHIBA Desktop Assist (Version: 1.00.0007.00002 - Toshiba Corporation)

TOSHIBA eco Utility (Version: 2.0.0.6415 - Toshiba Corporation)

TOSHIBA Function Key (Version: 1.00.6425 - Toshiba Corporation)

TOSHIBA Manuals (x32 Version: 10.10 - TOSHIBA)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden

TOSHIBA PC Health Monitor (Version: 1.8.17.640104 - Toshiba Corporation)

Toshiba Places Icon Utility (Version: 2.1.1 - TOSHIBA)

TOSHIBA Recovery Media Creator (x32 Version: 2.2.0.54043005 - Toshiba Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00 - TOSHIBA Corporation)

TOSHIBA Service Station (Version: 2.4.4 - TOSHIBA)

TOSHIBA System Driver (x32 Version: 1.00.0012 - Toshiba Corporation)

TOSHIBA System Settings (x32 Version: 1.00.0002.32002 - Toshiba Corporation)

Toshiba TEMPRO (x32 Version: 4.2.1 - Toshiba Europe GmbH)

TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A - Toshiba Corporation)

Updater (x32 Version: 2.6.53 - Creative Island Media, LLC)

Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VisualBee for Microsoft PowerPoint (HKCU Version: V4.1 - VisualBee.com)

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden

Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3 - Realtek Semiconductor Corp.)

WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
 

==================== Restore Points  =========================
 

01-01-2014 13:20:16 Geplanter Prüfpunkt

07-01-2014 20:29:08 Removed Bonjour

09-01-2014 10:33:40 Uniblue SpeedUpMyPC installation

16-01-2014 17:35:48 Windows Update
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {00C107C2-027E-4224-83B4-754CDD462CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-08-14] (Toshiba Europe GmbH)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {2807D834-4937-49CF-ABDE-3E9AD3CBDB68} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)

Task: {3C34E352-D102-4B2E-A790-FC5D6226257D} - System32\Tasks\Re-Markable Update => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe [2014-01-03] ()

Task: {411A5387-5618-4EE2-A0D0-8ECC6EF5C97B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {4DEAF078-4D55-4C04-8165-FD15AB799510} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)

Task: {74BF0576-AABC-4F6A-943C-569671751CD2} - System32\Tasks\click-n-mark-5-chromeinstaller => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-chromeinstaller.exe [2014-01-03] (Remarkable)

Task: {7B4A55C2-0879-44B1-A6BF-1F593C7656A7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)

Task: {838F8540-ADDE-47B4-9249-168CC1902CBE} - System32\Tasks\click-n-mark-5-updater => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-updater.exe [2014-01-03] (Remarkable)

Task: {84962D8B-E8A6-4638-A2C9-DB0ABE38826C} - System32\Tasks\EPUpdater => C:\Users\HOLGER~1\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION

Task: {92FA85CF-6EAE-4B68-9422-55CA63A44942} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION

Task: {9CFED9B0-4237-4D10-B501-63E94791061F} - System32\Tasks\click-n-mark-5-enabler => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-enabler.exe [2014-01-03] (Remarkable)

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {AFD492DE-DF9F-4CBA-8335-F5F8308134DC} - System32\Tasks\click-n-mark-5-codedownloader => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-codedownloader.exe [2014-01-03] (Remarkable)

Task: {BFA92997-4C5D-4E1C-AD96-0F23B44C4BDB} - System32\Tasks\click-n-mark-5-firefoxinstaller => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-firefoxinstaller.exe [2014-01-03] (Remarkable)

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {D6D9C3CF-E8FB-4C19-8537-87838A384F14} - System32\Tasks\Dealply => C:\Users\HOLGER~1\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {F6C11617-6D62-4525-91D5-00D4CDA3557C} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\click-n-mark-5-chromeinstaller.job => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-chromeinstaller.exe

Task: C:\windows\Tasks\click-n-mark-5-codedownloader.job => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-codedownloader.exe

Task: C:\windows\Tasks\click-n-mark-5-enabler.job => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-enabler.exe

Task: C:\windows\Tasks\click-n-mark-5-firefoxinstaller.job => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-firefoxinstaller.exe

Task: C:\windows\Tasks\click-n-mark-5-updater.job => C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-updater.exe

Task: C:\windows\Tasks\Dealply.job => C:\Users\HOLGER~1\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\windows\Tasks\Re-Markable Update.job => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-07-18 14:22 - 2010-12-29 12:24 - 00120320 _____ () C:\Program Files (x86)\Free Zip Opener\contmenu_x64.dll

2013-12-07 18:49 - 2013-11-22 12:01 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2013-04-21 20:44 - 2013-04-21 20:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2013-04-21 20:44 - 2013-04-21 20:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-11-07 21:27 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00161992 _____ () C:\Program Files (x86)\OpenVPN\bin\liblzo2-2.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00107720 _____ () C:\Program Files (x86)\OpenVPN\bin\libpkcs11-helper-1.dll

2014-01-11 16:37 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Could not start eventlog service, could not read events.
 

Der angeforderte Dienst wurde bereits gestartet.
 

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.

gmer.txt

Code:

GMER 2.1.19324 - hxxp://www.gmer.net

Rootkit scan 2014-01-21 00:40:27

Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003b Hitachi_HTS545050A7E380 rev.GG2OA7A0 465,76GB

Running: gmer.exe; Driver: C:\Users\HOLGER~1\AppData\Local\Temp\kfdoipob.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

.text   C:\windows\System32\win32k.sys!W32pServiceTable                                     fffff960000d3100 7 bytes [40, 4F, 82, 01, 00, 51, F2]

.text   C:\windows\System32\win32k.sys!W32pServiceTable + 8                                 fffff960000d3108 7 bytes [01, 15, C0, FF, 00, 12, DB]
 

---- User code sections - GMER 2.1 ----
 

.text   C:\windows\Explorer.EXE[2032] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690    000007fe61541532 4 bytes [54, 61, FE, 07]

.text   C:\windows\Explorer.EXE[2032] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698    000007fe6154153a 4 bytes [54, 61, FE, 07]

.text   C:\windows\Explorer.EXE[2032] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246  000007fe6154165a 4 bytes [54, 61, FE, 07]
 

---- Threads - GMER 2.1 ----
 

Thread  C:\windows\system32\csrss.exe [628:652]                                             fffff960008c05e8
 

---- Disk sectors - GMER 2.1 ----
 

Disk    \Device\Harddisk0\DR0                                                               unknown MBR code
 

---- EOF - GMER 2.1 ----

Avira.txt

Code:

Exportierte Ereignisse:
 

21.01.2014 00:44 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.174

      VDF Version:        7.11.125.224 
 

21.01.2014 00:44 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

21.01.2014 00:44 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.174

      VDF Version:        7.11.125.224
 

21.01.2014 00:43 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

21.01.2014 00:42 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

21.01.2014 00:42 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

21.01.2014 00:42 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

21.01.2014 00:28 [Echtzeit-Scanner] Echtzeit-Scanner deaktiviert

      Echtzeit-Scanner wurde deaktiviert.
 

20.01.2014 22:54 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.174

      VDF Version:        7.11.125.224 
 

20.01.2014 22:54 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

20.01.2014 22:54 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.174

      VDF Version:        7.11.125.224
 

20.01.2014 22:53 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

20.01.2014 22:52 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

20.01.2014 22:52 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

20.01.2014 22:52 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

20.01.2014 22:49 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (192.168.32.188) von 

      "hxxp://87.248.217.253/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

20.01.2014 22:49 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

20.01.2014 22:44 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.174

      VDF Version:        7.11.125.224 
 

20.01.2014 22:44 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

20.01.2014 22:44 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.174

      VDF Version:        7.11.125.224
 

20.01.2014 22:44 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

20.01.2014 22:41 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

20.01.2014 22:41 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

20.01.2014 22:41 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

20.01.2014 20:26 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde abgebrochen!].

      Anzahl Dateien:        267050

      Anzahl Verzeichnisse:        11121

      Anzahl Malware:        0

      Anzahl Warnungen:        0
 

20.01.2014 17:36 [Planer] Auftrag gestartet

      Auftrag "Vollständige Systemprüfung"

      wurde erfolgreich gestartet.
 

20.01.2014 16:57 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde abgebrochen!].

      Anzahl Dateien:        28262

      Anzahl Verzeichnisse:        3643

      Anzahl Malware:        0

      Anzahl Warnungen:        0
 

20.01.2014 16:47 [Planer] Auftrag gestartet

      Auftrag "Vollständige Systemprüfung"

      wurde erfolgreich gestartet.
 

20.01.2014 16:46 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase027.vdf 7.11.125.207

      vbase028.vdf 7.11.125.208

      vbase029.vdf 7.11.125.209

      vbase030.vdf 7.11.125.210

      vbase031.vdf 7.11.125.224

      aevdf.dat 7.11.125.224
 

20.01.2014 16:45 [Planer] Auftrag gestartet

      Auftrag "AVImmediateUpdateJobEx"

      wurde erfolgreich gestartet.
 

20.01.2014 16:45 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

19.01.2014 13:50 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (192.168.32.188) von 

      "hxxp://208.111.128.7/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

19.01.2014 13:50 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

18.01.2014 22:42 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].

      Anzahl Dateien:        604683

      Anzahl Verzeichnisse:        47454

      Anzahl Malware:        4

      Anzahl Warnungen:        4
 

18.01.2014 22:42 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup(1).exe'

      enthielt einen Virus oder unerwünschtes Programm 'Adware/iBryte.L' [adware].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '106d21db.qua' 

      verschoben!
 

18.01.2014 22:42 [System-Scanner] Malware gefunden

      Die Datei 

      'C:\Windows.old\Users\Holger-PC\AppData\Local\Microsoft\Windows\Temporary 

      Internet Files\Content.IE5\Q4S61HK3\pack[1].7z'

      enthielt einen Virus oder unerwünschtes Programm 'Adware/BHO.Bprotector.1.2' 

      [adware].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5aa65483.qua' 

      verschoben!
 

18.01.2014 22:42 [System-Scanner] Malware gefunden

      Die Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup.exe'

      enthielt einen Virus oder unerwünschtes Programm 'Adware/iBryte.spl.1' [adware].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '42327b33.qua' 

      verschoben!
 

18.01.2014 21:47 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (192.168.32.188) von 

      "hxxp://208.111.168.6/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

18.01.2014 21:47 [Planer] Auftrag gestartet

      Auftrag "AVImmediateUpdateJobEx"

      wurde erfolgreich gestartet.
 

18.01.2014 20:57 [Planer] Auftrag gestartet

      Auftrag "Vollständige Systemprüfung"

      wurde erfolgreich gestartet.
 

18.01.2014 20:57 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (127.0.0.1) von 

      "hxxp://perspeak.avira-update.com/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

18.01.2014 20:57 [Planer] Auftrag gestartet

      Auftrag "AVImmediateUpdateJobEx"

      wurde erfolgreich gestartet.
 

18.01.2014 20:56 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (127.0.0.1) von 

      "hxxp://perspeak.avira-update.com/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

18.01.2014 20:56 [Planer] Auftrag gestartet

      Auftrag "AVImmediateUpdateJobEx"

      wurde erfolgreich gestartet.
 

18.01.2014 20:55 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (127.0.0.1) von 

      "hxxp://perspeak.avira-update.com/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

18.01.2014 20:55 [Planer] Auftrag gestartet

      Auftrag "AVImmediateUpdateJobEx"

      wurde erfolgreich gestartet.
 

18.01.2014 20:55 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

18.01.2014 15:30 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde abgebrochen!].

      Anzahl Dateien:        38982

      Anzahl Verzeichnisse:        5293

      Anzahl Malware:        1

      Anzahl Warnungen:        0
 

18.01.2014 15:30 [System-Scanner] Malware gefunden

      Die Datei 'C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho.dll'

      enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.A.4402' 

      [adware].

      Durchgeführte Aktion(en):

      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5a05323c.qua' 

      verschoben!
 

18.01.2014 15:20 [Planer] Auftrag gestartet

      Auftrag "Vollständige Systemprüfung"

      wurde erfolgreich gestartet.
 

18.01.2014 14:44 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (192.168.32.188) von 

      "hxxp://68.142.123.254/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

18.01.2014 14:44 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

18.01.2014 12:34 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup.exe'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/iBryte.spl.1' [adware] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

18.01.2014 12:34 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup(1).exe'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/iBryte.L' [adware] gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

18.01.2014 12:33 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho.dll'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.A.4402' [adware] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

18.01.2014 12:33 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup(1).exe'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/iBryte.L' [adware] gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

18.01.2014 12:33 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup.exe'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/iBryte.spl.1' [adware] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

18.01.2014 12:29 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho.dll'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.A.4402' [adware] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

17.01.2014 21:13 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho.dll'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.A.4402' [adware] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

17.01.2014 18:08 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase026.vdf 7.11.125.149

      vbase027.vdf 7.11.125.150

      vbase028.vdf 7.11.125.151

      vbase029.vdf 7.11.125.152

      vbase030.vdf 7.11.125.153

      vbase031.vdf 7.11.125.156

      aevdf.dat 7.11.125.156

      aeheur.dll 8.1.4.870

      aescript.dll 8.1.4.180

      aeset.dat 8.2.12.174
 

17.01.2014 18:07 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

16.01.2014 19:01 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (192.168.32.188) von 

      "hxxp://208.111.128.6/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

16.01.2014 19:01 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

16.01.2014 18:57 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.172

      VDF Version:        7.11.125.100 
 

16.01.2014 18:57 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

16.01.2014 18:57 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.172

      VDF Version:        7.11.125.100
 

16.01.2014 18:56 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

16.01.2014 18:54 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

16.01.2014 18:54 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

16.01.2014 18:54 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

16.01.2014 18:52 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho.dll'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/Adware.A.4402' [adware] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

15.01.2014 21:12 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat4.dat

      vbase031.vdf 7.11.125.100

      aevdf.dat 7.11.125.100

      aegen.dll 8.1.7.22

      aeset.dat 8.2.12.172

      avlode.rdf 13.0.1.66
 

15.01.2014 21:11 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

15.01.2014 11:32 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.17/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase025.vdf 7.11.125.41

      vbase026.vdf 7.11.125.42

      vbase027.vdf 7.11.125.43

      vbase028.vdf 7.11.125.44

      vbase029.vdf 7.11.125.45

      vbase030.vdf 7.11.125.46

      vbase031.vdf 7.11.125.80

      aevdf.dat 7.11.125.80
 

15.01.2014 11:31 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

15.01.2014 11:27 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.170

      VDF Version:        7.11.125.38 
 

15.01.2014 11:27 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

15.01.2014 11:27 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.170

      VDF Version:        7.11.125.38
 

15.01.2014 11:26 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

15.01.2014 11:25 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

15.01.2014 11:25 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

15.01.2014 11:25 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

14.01.2014 23:36 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.125.38

      aevdf.dat 7.11.125.38
 

14.01.2014 23:36 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

14.01.2014 20:37 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Holger-PC\AppData\Local\Temp\sblomktupjpbv.exe'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/DomaIQ.6144' [adware] 

      gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

14.01.2014 14:54 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].

      Anzahl Dateien:        2790

      Anzahl Verzeichnisse:        0

      Anzahl Malware:        0

      Anzahl Warnungen:        0
 

14.01.2014 14:53 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.17/update" aktualisiert:

      webcat0.dat

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.125.26

      aevdf.dat 7.11.125.26
 

14.01.2014 14:53 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

14.01.2014 14:52 [Planer] Auftrag gestartet

      Auftrag "Schnelle Systemprüfung"

      wurde erfolgreich gestartet.
 

13.01.2014 17:33 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.17/update" aktualisiert:

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.125.0

      aevdf.dat 7.11.125.0

      aeheur.dll 8.1.4.860

      aesbx.dll 8.2.20.6

      aeset.dat 8.2.12.170

      avlode.rdf 13.0.1.64
 

13.01.2014 17:31 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

13.01.2014 16:50 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup(1).exe'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/iBryte.L' [adware] gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

12.01.2014 15:51 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.17/update" aktualisiert:

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.124.216

      aevdf.dat 7.11.124.216
 

12.01.2014 15:51 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

11.01.2014 19:07 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.75/update" aktualisiert:

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase024.vdf 7.11.124.177

      vbase025.vdf 7.11.124.178

      vbase026.vdf 7.11.124.179

      vbase027.vdf 7.11.124.180

      vbase028.vdf 7.11.124.181

      vbase029.vdf 7.11.124.182

      vbase030.vdf 7.11.124.183

      vbase031.vdf 7.11.124.210

      aevdf.dat 7.11.124.210
 

11.01.2014 19:06 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

11.01.2014 16:30 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.168

      VDF Version:        7.11.124.116 
 

11.01.2014 16:30 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

11.01.2014 16:30 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.168

      VDF Version:        7.11.124.116
 

11.01.2014 16:29 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

11.01.2014 16:27 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

11.01.2014 16:27 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

11.01.2014 16:27 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

11.01.2014 13:43 [Echtzeit-Scanner] Malware gefunden

      In der Datei 'C:\Users\Holger-PC\Downloads\Updater_Setup(1).exe'

      wurde ein Virus oder unerwünschtes Programm 'ADWARE/iBryte.L' [adware] gefunden.

      Ausgeführte Aktion: Zugriff verweigern
 

11.01.2014 13:06 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (192.168.32.188) von 

      "hxxp://208.111.128.6/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

11.01.2014 13:06 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

11.01.2014 13:02 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.168

      VDF Version:        7.11.124.116 
 

11.01.2014 13:02 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

11.01.2014 13:02 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.168

      VDF Version:        7.11.124.116
 

11.01.2014 13:01 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

09.01.2014 20:26 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.75/update" aktualisiert:

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase023.vdf 7.11.124.79

      vbase024.vdf 7.11.124.80

      vbase025.vdf 7.11.124.81

      vbase026.vdf 7.11.124.82

      vbase027.vdf 7.11.124.83

      vbase028.vdf 7.11.124.84

      vbase029.vdf 7.11.124.85

      vbase030.vdf 7.11.124.86

      vbase031.vdf 7.11.124.116

      aevdf.dat 7.11.124.116

      aeheur.dll 8.1.4.858

      aescript.dll 8.1.4.178

      aeexp.dll 8.4.1.164

      aeset.dat 8.2.12.168
 

09.01.2014 20:22 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

08.01.2014 19:12 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.75/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.124.56

      aevdf.dat 7.11.124.56
 

08.01.2014 19:10 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

08.01.2014 12:13 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.32.188) 

      erfolgreich durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase022.vdf 7.11.124.11

      vbase023.vdf 7.11.124.12

      vbase024.vdf 7.11.124.13

      vbase025.vdf 7.11.124.14

      vbase026.vdf 7.11.124.15

      vbase027.vdf 7.11.124.16

      vbase028.vdf 7.11.124.17

      vbase029.vdf 7.11.124.18

      vbase030.vdf 7.11.124.19

      vbase031.vdf 7.11.124.22

      aevdf.dat 7.11.124.22
 

08.01.2014 12:12 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

07.01.2014 21:40 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.123.202 
 

07.01.2014 21:40 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

07.01.2014 21:40 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.123.202
 

07.01.2014 21:39 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

07.01.2014 21:38 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

07.01.2014 21:38 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

07.01.2014 21:38 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

07.01.2014 19:51 [Updater] Update nicht ausgeführt

      Das Update von Computer HOLGER (192.168.32.188) von 

      "hxxp://208.111.128.7/update" ist fehlgeschlagen.

      Während des Herunterladens ist ein Fehler aufgetreten.

      Es wurden keine neuen Dateien geladen.
 

07.01.2014 19:51 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

07.01.2014 19:47 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.123.202 
 

07.01.2014 19:47 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

07.01.2014 19:47 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.123.202
 

07.01.2014 19:46 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

06.01.2014 21:41 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].

      Anzahl Dateien:        2676

      Anzahl Verzeichnisse:        0

      Anzahl Malware:        0

      Anzahl Warnungen:        0
 

06.01.2014 21:40 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.123.202

      aevdf.dat 7.11.123.202
 

06.01.2014 21:39 [Planer] Auftrag gestartet

      Auftrag "Schnelle Systemprüfung"

      wurde erfolgreich gestartet.
 

06.01.2014 21:39 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

05.01.2014 23:59 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      webcat1.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.123.168

      aevdf.dat 7.11.123.168
 

05.01.2014 23:59 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

05.01.2014 12:17 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.17/update" aktualisiert:

      vbase021.vdf 7.11.123.141

      vbase022.vdf 7.11.123.142

      vbase023.vdf 7.11.123.143

      vbase024.vdf 7.11.123.144

      vbase025.vdf 7.11.123.145

      vbase026.vdf 7.11.123.146

      vbase027.vdf 7.11.123.147

      vbase028.vdf 7.11.123.148

      vbase029.vdf 7.11.123.149

      vbase030.vdf 7.11.123.150

      vbase031.vdf 7.11.123.152

      aevdf.dat 7.11.123.152
 

05.01.2014 12:16 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

05.01.2014 12:13 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.123.138 
 

05.01.2014 12:13 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

05.01.2014 12:13 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.123.138
 

05.01.2014 12:11 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

05.01.2014 02:20 [Updater] Update erfolgreich durchgeführt

      Update auf Computer HOLGER (192.168.2.124) von "hxxp://89.105.213.18/update" 

      wurde erfolgreich durchgeführt.

      Es sind keine neuen Engine/VDF Dateien verfügbar.
 

05.01.2014 02:19 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

04.01.2014 18:50 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.123.138

      aevdf.dat 7.11.123.138
 

04.01.2014 18:48 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

03.01.2014 15:23 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase020.vdf 7.11.123.39

      vbase021.vdf 7.11.123.40

      vbase022.vdf 7.11.123.41

      vbase023.vdf 7.11.123.42

      vbase024.vdf 7.11.123.43

      vbase025.vdf 7.11.123.44

      vbase026.vdf 7.11.123.45

      vbase027.vdf 7.11.123.46

      vbase028.vdf 7.11.123.47

      vbase029.vdf 7.11.123.48

      vbase030.vdf 7.11.123.49

      vbase031.vdf 7.11.123.104

      aevdf.dat 7.11.123.104
 

03.01.2014 15:22 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

02.01.2014 18:09 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat0.dat

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.123.26

      aevdf.dat 7.11.123.26
 

02.01.2014 18:08 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

01.01.2014 20:31 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase019.vdf 7.11.122.219

      vbase020.vdf 7.11.122.220

      vbase021.vdf 7.11.122.221

      vbase022.vdf 7.11.122.222

      vbase023.vdf 7.11.122.223

      vbase024.vdf 7.11.122.224

      vbase025.vdf 7.11.122.225

      vbase026.vdf 7.11.122.226

      vbase027.vdf 7.11.122.227

      vbase028.vdf 7.11.122.228

      vbase029.vdf 7.11.122.229

      vbase030.vdf 7.11.122.230

      vbase031.vdf 7.11.123.4

      aevdf.dat 7.11.123.4
 

01.01.2014 20:30 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

31.12.2013 12:13 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.0.121) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      webcat4.dat

      vbase031.vdf 7.11.122.208

      aevdf.dat 7.11.122.208
 

31.12.2013 12:12 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

30.12.2013 13:19 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].

      Anzahl Dateien:        2483

      Anzahl Verzeichnisse:        0

      Anzahl Malware:        0

      Anzahl Warnungen:        0
 

30.12.2013 13:19 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.0.116) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.122.186

      aevdf.dat 7.11.122.186
 

30.12.2013 13:18 [Planer] Auftrag gestartet

      Auftrag "Schnelle Systemprüfung"

      wurde erfolgreich gestartet.
 

30.12.2013 13:18 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

28.12.2013 12:49 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      vbase018.vdf 7.11.122.123

      vbase019.vdf 7.11.122.124

      vbase020.vdf 7.11.122.125

      vbase021.vdf 7.11.122.126

      vbase022.vdf 7.11.122.127

      vbase023.vdf 7.11.122.128

      vbase024.vdf 7.11.122.129

      vbase025.vdf 7.11.122.130

      vbase026.vdf 7.11.122.131

      vbase027.vdf 7.11.122.132

      vbase028.vdf 7.11.122.133

      vbase029.vdf 7.11.122.134

      vbase030.vdf 7.11.122.135

      vbase031.vdf 7.11.122.136

      aevdf.dat 7.11.122.136
 

28.12.2013 12:48 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

27.12.2013 23:14 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde abgebrochen!].

      Anzahl Dateien:        0

      Anzahl Verzeichnisse:        0

      Anzahl Malware:        0

      Anzahl Warnungen:        0
 

27.12.2013 23:03 [Planer] Auftrag gestartet

      Auftrag "Vollständige Systemprüfung"

      wurde erfolgreich gestartet.
 

27.12.2013 23:02 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      vbase031.vdf 7.11.122.118

      aevdf.dat 7.11.122.118
 

27.12.2013 23:02 [Planer] Auftrag gestartet

      Auftrag "AVImmediateUpdateJobEx"

      wurde erfolgreich gestartet.
 

27.12.2013 18:50 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase017.vdf 7.11.122.57

      vbase018.vdf 7.11.122.58

      vbase019.vdf 7.11.122.59

      vbase020.vdf 7.11.122.60

      vbase021.vdf 7.11.122.61

      vbase022.vdf 7.11.122.62

      vbase023.vdf 7.11.122.63

      vbase024.vdf 7.11.122.64

      vbase025.vdf 7.11.122.65

      vbase026.vdf 7.11.122.66

      vbase027.vdf 7.11.122.67

      vbase028.vdf 7.11.122.68

      vbase029.vdf 7.11.122.69

      vbase030.vdf 7.11.122.70

      vbase031.vdf 7.11.122.114

      aevdf.dat 7.11.122.114
 

27.12.2013 18:49 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

26.12.2013 03:41 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.17/update" aktualisiert:

      webcat1.dat

      webcat3.dat

      webcat4.dat

      vbase016.vdf 7.11.121.233

      vbase017.vdf 7.11.121.234

      vbase018.vdf 7.11.121.235

      vbase019.vdf 7.11.121.236

      vbase020.vdf 7.11.121.237

      vbase021.vdf 7.11.121.238

      vbase022.vdf 7.11.121.239

      vbase023.vdf 7.11.121.240

      vbase024.vdf 7.11.121.241

      vbase025.vdf 7.11.121.242

      vbase026.vdf 7.11.121.243

      vbase027.vdf 7.11.121.244

      vbase028.vdf 7.11.121.245

      vbase029.vdf 7.11.121.246

      vbase030.vdf 7.11.121.247

      vbase031.vdf 7.11.122.28

      aevdf.dat 7.11.122.28
 

26.12.2013 03:41 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

24.12.2013 12:22 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.121.206 
 

24.12.2013 12:22 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

24.12.2013 12:22 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.121.206
 

24.12.2013 12:21 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

24.12.2013 12:20 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

24.12.2013 12:20 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

24.12.2013 12:20 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

24.12.2013 11:32 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase015.vdf 7.11.121.147

      vbase016.vdf 7.11.121.148

      vbase017.vdf 7.11.121.149

      vbase018.vdf 7.11.121.150

      vbase019.vdf 7.11.121.151

      vbase020.vdf 7.11.121.152

      vbase021.vdf 7.11.121.153

      vbase022.vdf 7.11.121.154

      vbase023.vdf 7.11.121.155

      vbase024.vdf 7.11.121.156

      vbase025.vdf 7.11.121.157

      vbase026.vdf 7.11.121.158

      vbase027.vdf 7.11.121.159

      vbase028.vdf 7.11.121.160

      vbase029.vdf 7.11.121.161

      vbase030.vdf 7.11.121.162

      vbase031.vdf 7.11.121.206

      aevdf.dat 7.11.121.206
 

24.12.2013 11:31 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

24.12.2013 11:27 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.121.112 
 

24.12.2013 11:27 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

24.12.2013 11:27 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.121.112
 

24.12.2013 11:26 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

23.12.2013 17:58 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.17/update" aktualisiert:

      webcat1.dat

      webcat3.dat

      webcat4.dat

      vbase031.vdf 7.11.121.112

      aevdf.dat 7.11.121.112
 

23.12.2013 17:57 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

22.12.2013 21:58 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://80.190.148.74/update" aktualisiert:

      vbase031.vdf 7.11.121.86

      aevdf.dat 7.11.121.86
 

22.12.2013 21:57 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

22.12.2013 14:41 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.121.84 
 

22.12.2013 14:41 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

22.12.2013 14:41 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.121.84
 

22.12.2013 14:40 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180
 

22.12.2013 14:39 [Browser-Schutz] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

22.12.2013 14:39 [Echtzeit-Scanner] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

22.12.2013 14:39 [Planer] Dienst gestoppt

      Der Dienst wurde gestoppt.
 

22.12.2013 14:12 [System-Scanner] Suche

      Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.].

      Anzahl Dateien:        2474

      Anzahl Verzeichnisse:        0

      Anzahl Malware:        0

      Anzahl Warnungen:        0
 

22.12.2013 14:11 [Updater] Update erfolgreich durchgeführt

      Update von Avira Free Antivirus auf Computer HOLGER (192.168.2.124) erfolgreich 

      durchgeführt.

      Folgende Dateien wurden von "hxxp://89.105.213.18/update" aktualisiert:

      webcat1.dat

      webcat2.dat

      webcat3.dat

      webcat4.dat

      vbase014.vdf 7.11.121.19

      vbase015.vdf 7.11.121.20

      vbase016.vdf 7.11.121.21

      vbase017.vdf 7.11.121.22

      vbase018.vdf 7.11.121.23

      vbase019.vdf 7.11.121.24

      vbase020.vdf 7.11.121.25

      vbase021.vdf 7.11.121.26

      vbase022.vdf 7.11.121.27

      vbase023.vdf 7.11.121.28

      vbase024.vdf 7.11.121.29

      vbase025.vdf 7.11.121.30

      vbase026.vdf 7.11.121.31

      vbase027.vdf 7.11.121.32

      vbase028.vdf 7.11.121.33

      vbase029.vdf 7.11.121.34

      vbase030.vdf 7.11.121.35

      vbase031.vdf 7.11.121.84

      aevdf.dat 7.11.121.84
 

22.12.2013 14:10 [Planer] Auftrag gestartet

      Auftrag "Schnelle Systemprüfung"

      wurde erfolgreich gestartet.
 

22.12.2013 14:10 [Planer] Auftrag gestartet

      Auftrag "Automatisches Update"

      wurde erfolgreich gestartet.
 

22.12.2013 14:06 [Browser-Schutz] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.00.02.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.120.252 
 

22.12.2013 14:06 [Echtzeit-Scanner] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.1.519

      Engine Version:        

      VDF Version:        
 

22.12.2013 14:06 [Hilfsdienst] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version:        14.0.2.254

      Engine Version:        8.2.12.166

      VDF Version:        7.11.120.252
 

22.12.2013 14:05 [Planer] Dienst gestartet

      Der Dienst wurde gestartet.

      Dienst Version 14.0.2.180

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Der hat nichts gefunden, somit musste ich nicht rebooten

Hier der Log:

mbar.txt

Code:

Malwarebytes Anti-Rootkit BETA 1.07.0.1008

www.malwarebytes.org
 

Database version: v2014.01.21.03
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16750

Holger-PC :: HOLGER [administrator]
 

21.01.2014 11:51:11

mbar-log-2014-01-21 (11-51-11).txt
 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: 

Objects scanned: 264094

Time elapsed: 1 hour(s), 26 minute(s), 44 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 0

(No malicious items detected)
 

Physical Sectors Detected: 0

(No malicious items detected)
 

(end)

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Wenn ich den Suchlauf mit Adware starte läuft dieser erst reibungslos bis kurz vor Schluss und immer an der selben Stelle, dort hängt sich das Programm dann auf. Und ich hab es mehrmals probiert

Starte den adwCleaner mal explizit mit Adminrechten, also Rechtsklick => als Admin ausführen

Ne das hilft auch nichts. Ich habe auch sonst alle Programme geschlossen, auch Antivir.

Dann tausche bitte die Reihenfolge; also erst JRT, danach adwCleaner

Hier schon mal der JRT-Log:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.0 (01.07.2014:1)

OS: Windows 8 x64

Ran by Holger-PC on 22.01.2014 at 14:33:13,10

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{39CB8175-E224-4446-8746-00566302DF8D}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escort.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortapp.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escorteng.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortlbr.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\esrv.exe

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{57C91446-8D81-4156-A70E-624551442DE9}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{781CA792-9B6E-400B-B36F-15C097D2CA54}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\apn dtx

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\babsolution

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\delta

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\distromatic

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\ilivid

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installedbrowserextensions

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\pc speed maximizer

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\visualbee

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\dynconie

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\plus-hd-2.3

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2413837752-2537467696-3434217499-1001\Software\sweetim

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dealply

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\delta

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\desksvc

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\searchprotect

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\visualbee

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\alxssb.alxtbssb

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\alxssb.alxtbssb.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\alxtb2.toolbarproxy

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\alxtb2.toolbarproxy.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\delta.deltaappcore.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\driverscanner

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\speedupmypc

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220322342226}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422512282}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422902212}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455515582}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660366346626}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466516682}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466906612}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440444514482}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220322342226}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220422512282}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220422902212}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{55555555-5555-5555-5555-550455515582}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660366346626}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466516682}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466906612}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444514482}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550455515582}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660366346626}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466516682}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466906612}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{44444444-4444-4444-4444-440444514482}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110411511182}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550455515582}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660366346626}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466516682}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466906612}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444514482}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8}
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\windows\Tasks\Dealply.job

Successfully deleted: [File] "C:\end"
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\ProgramData\apn"

Successfully deleted: [Folder] "C:\ProgramData\babylon"

Successfully deleted: [Folder] "C:\ProgramData\dsearchlink"

Successfully deleted: [Folder] "C:\ProgramData\visualbee"

Successfully deleted: [Folder] "C:\Users\Holger-PC\AppData\Roaming\systweak"

Successfully deleted: [Folder] "C:\Users\Holger-PC\appdata\local\conduit"

Successfully deleted: [Folder] "C:\Users\Holger-PC\appdata\local\iac"

Successfully deleted: [Folder] "C:\Users\Holger-PC\appdata\local\searchprotect"

Successfully deleted: [Folder] "C:\Users\Holger-PC\appdata\local\swvupdater"

Successfully deleted: [Folder] "C:\Users\Holger-PC\appdata\locallow\iac"

Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"

Successfully deleted: [Folder] "C:\Program Files (x86)\delta"

Successfully deleted: [Folder] "C:\Program Files (x86)\movies toolbar"

Successfully deleted: [Folder] "C:\Program Files (x86)\mypc backup"

Successfully deleted: [Folder] "C:\Program Files (x86)\optimizer pro"

Successfully deleted: [Folder] "C:\Program Files (x86)\pc speed maximizer"

Successfully deleted: [Folder] "C:\Program Files (x86)\searchprotect"
 
 
 

~~~ FireFox
 

Failed to delete: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\ask.xml"

Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\ask.xml"

Successfully deleted: [File] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\user.js

Successfully deleted: [File] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\bprotector_extensions.sqlite

Successfully deleted: [File] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\bprotector_prefs.js

Successfully deleted: [File] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\invalidprefs.js

Successfully deleted: [File] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\extensions\toolbar_avira-v7@apn.ask.com.xpi

Successfully deleted: [File] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\searchplugins\ask-web-search.xml

Successfully deleted: [File] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\searchplugins\ask.xml

Successfully deleted: [Folder] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\extensions\15d84a30-fc9d-4fca-80a7-e5797da621a2@b2cb2d04-e262-4863-aee7-9d0e4333b550.com

Successfully deleted: [Folder] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com

Successfully deleted: [Folder] C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\extensions\ffxtlbr@delta.com

Successfully deleted the following from C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\prefs.js
 

user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3318001&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=2&UP=SPE98476B4-FD43-4D55-A9DF-F823732BAE

user_pref("extensions.delta.admin", false);

user_pref("extensions.delta.aflt", "babsst");

user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

user_pref("extensions.delta.autoRvrt", "false");

user_pref("extensions.delta.dfltLng", "de");

user_pref("extensions.delta.excTlbr", false);

user_pref("extensions.delta.ffxUnstlRst", true);

user_pref("extensions.delta.id", "d4a7f6c000000000000000ffdf60208d");

user_pref("extensions.delta.instlDay", "15980");

user_pref("extensions.delta.instlRef", "sst");

user_pref("extensions.delta.newTab", false);

user_pref("extensions.delta.prdct", "delta");

user_pref("extensions.delta.prtnrId", "delta");

user_pref("extensions.delta.rvrt", "false");

user_pref("extensions.delta.smplGrp", "none");

user_pref("extensions.delta.tlbrId", "base");

user_pref("extensions.delta.tlbrSrchUrl", "");

user_pref("extensions.delta.vrsn", "1.8.24.6");

user_pref("extensions.delta.vrsnTs", "1.8.24.615:40:09");

user_pref("extensions.delta.vrsni", "1.8.24.6");

user_pref("extensions.delta_i.babExt", "");

user_pref("extensions.delta_i.babTrack", "affID=121565&tsp=5023");

user_pref("extensions.delta_i.srcExt", "ss");

user_pref("extensions.dynconff.cache.search.conduit.com.content", "<package expire=\"3600\" message=\"Empty\"></package>");

user_pref("extensions.dynconff.cache.search.conduit.com.expires", "1390400967089");

user_pref("extensions.toolbar.mindspark.hp.enabled", false);

user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");

user_pref("extensions.toolbar.mindspark.lastInstalled", "videodownloadconverter@mindspark.com");

Emptied folder: C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\minidumps [28 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 22.01.2014 at 14:36:59,74

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdwCleaner funktioniert leider nach wie vor nicht.

Frische FRST Logs bitte

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-01-2014 01

Ran by Holger-PC (administrator) on HOLGER on 25-01-2014 23:59:47

Running from C:\Users\Holger-PC\Downloads\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe

(The OpenVPN Project) C:\Program Files (x86)\OpenVPN\bin\openvpn.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoViewOnDrive] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKLM\...\Policies\Explorer: [NoFind] 0

HKLM\...\Policies\Explorer: [NoFile] 0

HKLM\...\Policies\Explorer: [HideClock] 0

HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0

HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKLM\...\Policies\Explorer: [NoSetTaskbar] 0

HKLM\...\Policies\Explorer: [NoDeletePrinter] 0

HKLM\...\Policies\Explorer: [NoDFSTab] 0

HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0

HKLM\...\Policies\Explorer: [NoLogoff] 0

HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0

HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0

HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKLM\...\Policies\Explorer: [NoResolveSearch] 0

HKLM\...\Policies\Explorer: [NoSaveSettings] 0

HKLM\...\Policies\Explorer: [NoHardwareTab] 0

HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKLM\...\Policies\Explorer: [NoDesktop] 0

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-20] (Spotify Ltd)

HKCU\...\Run: [iLivid] - "C:\Users\Holger-PC\AppData\Local\iLivid\iLivid.exe" -autorun

HKCU\...\Policies\system: [DisableCMD] 0

HKCU\...\Policies\system: [NoDispAppearancePage] 0

HKCU\...\Policies\system: [NoDispBackgroundPage] 0

HKCU\...\Policies\system: [NoDispSettingsPage] 0

HKCU\...\Policies\Explorer: [NoViewOnDrive] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000

HKCU\...\Policies\Explorer: [NoFile] 0

HKCU\...\Policies\Explorer: [NoTrayContextMenu] 0

HKCU\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKCU\...\Policies\Explorer: [NoSetTaskbar] 0

HKCU\...\Policies\Explorer: [NoDeletePrinter] 0

HKCU\...\Policies\Explorer: [NoDFSTab] 0

HKCU\...\Policies\Explorer: [NoChangeStartMenu] 0

HKCU\...\Policies\Explorer: [NoWindowsUpdate] 0

HKCU\...\Policies\Explorer: [NoEncryptOnMove] 0

HKCU\...\Policies\Explorer: [NoResolveSearch] 0

HKCU\...\Policies\Explorer: [NoSaveSettings] 0

HKCU\...\Policies\Explorer: [NoHardwareTab] 0

HKCU\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\Administrator\...\Run: [] - [x]

Startup: C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

SearchScopes: HKLM - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1389125416&from=adks&uid=HitachiXHTS545050A7E380_120616TA95113V04GD8SX&q={searchTerms}

SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKCU - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = 

BHO: click-n-mark-5 - {11111111-1111-1111-1111-110411511182} - C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho64.dll (Remarkable)

BHO: Feven 2.2 - {11111111-1111-1111-1111-110411901112} - C:\Program Files (x86)\Feven 2.2\Feven 2.2-bho64.dll No File

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll No File

BHO: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)

BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Re-Markable - {bd55172e-59c1-4a93-b19c-633f0d7790ad} - C:\Program Files (x86)\Re-Markable\150.dll ()

BHO-x32: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 132.231.221.253
 

FireFox:

========

FF ProfilePath: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default

FF SearchEngineOrder.1: Ask.com

FF SelectedSearchEngine: Google

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( )

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF SearchPlugin: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\searchplugins\conduit-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\nationzoom.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Widget context - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-14]

FF Extension: click-n-mark-5 - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com [2014-01-22]

FF Extension: Websteroids - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\support@websteroidsapp.com [2014-01-09]

FF Extension: Yahoo! Toolbar - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2013-08-21]

FF Extension: Value Apps - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\{94cd2cc3-083f-49ba-a218-4cda4b4829fd} [2014-01-09]

FF Extension: Amazon 1Button App for Firefox - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\abb@amazon.com.xpi [2013-09-04]

FF Extension: GutscheinCodes.de GutscheinFinder - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi [2013-07-12]

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-11-26]

FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

FF HKCU\...\Firefox\Extensions: [{cb1bb3bd-8ce0-4d26-98c4-99f6415a6002}] - C:\Program Files (x86)\Re-Markable\150.xpi

FF Extension: No Name - C:\Program Files (x86)\Re-Markable\150.xpi [2014-01-03]
 

Chrome: 

=======

CHR Extension: (Feven 2.2) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhbagplpkkoeifmpmpdaieomnggppmo [2014-01-07]

CHR Extension: (click-n-mark-5) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiiggndjhacnnhnhmaljgbgcaneehld [2014-01-03]

CHR Extension: (Widget context) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-14]

CHR Extension: (Plus-HD-2.3) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec [2013-07-11]

CHR HKLM-x32\...\Chrome\Extension: [ejdfidgapfiokiphmcjpmmjbdndepoja] - C:\Program Files (x86)\Re-Markable\150.crx [2014-01-03]

CHR HKLM-x32\...\Chrome\Extension: [onpejdpfebeopffobknkodakfphdelnh] - C:\Users\Holger-PC\AppData\Roaming\BabSolution\CR\Delta.crx [2014-01-03]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

U2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-07-16] (Freemake)

U2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

U2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

U3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)

U3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)

U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

U3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [x]
 

==================== Drivers (Whitelisted) ====================
 

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-19] (Avira Operations GmbH & Co. KG)

U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

U3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

U3 mbamchameleon; C:\windows\system32\drivers\mbamchameleon.sys [89304 2014-01-21] (Malwarebytes Corporation)

U3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)

U2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

U3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

U3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )

U3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

U3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

U0 SR; 

U2 srservice; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-25 12:06 - 2014-01-25 23:10 - 00056184 _____ C:\windows\WindowsUpdate.log

2014-01-24 16:02 - 2014-01-24 16:30 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 21:08 - 2014-01-24 15:09 - 00000000 ____D C:\AdwCleaner

2014-01-21 20:44 - 2014-01-21 20:47 - 100400976 _____ (Apple Inc.) C:\Users\Holger-PC\Downloads\iTunes64Setup(1).exe

2014-01-21 20:31 - 2014-01-19 08:33 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-21 11:51 - 2014-01-21 16:57 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 11:51 - 2014-01-21 14:59 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-01-21 11:48 - 2014-01-21 11:48 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008(1).exe

2014-01-21 11:07 - 2014-01-21 11:07 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008.exe

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:17 - 2014-01-21 02:34 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:27 - 2014-01-17 20:25 - 00379904 _____ C:\Users\Holger-PC\Downloads\gmer.exe

2014-01-21 00:13 - 2014-01-25 23:59 - 00000000 ____D C:\FRST

2014-01-21 00:13 - 2014-01-21 00:14 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:13 - 2014-01-21 00:14 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-17 14:14 - 2014-01-17 14:35 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-15 23:46 - 2014-01-15 23:46 - 00000000 ____D C:\windows\SysWOW64\SearchProtect

2014-01-15 21:40 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll

2014-01-15 21:40 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\MPSSVC.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\windows\SysWOW64\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mpsdrv.sys

2014-01-15 21:40 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll

2014-01-15 21:40 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll

2014-01-15 21:40 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys

2014-01-15 21:40 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2014-01-15 21:40 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2014-01-15 21:40 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2014-01-15 21:40 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2014-01-13 13:24 - 2014-01-14 20:27 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 19:20 - 2014-01-20 22:52 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-09 11:33 - 2014-01-20 22:52 - 00000000 ____D C:\ProgramData\RHelpers

2014-01-09 11:33 - 2014-01-20 22:52 - 00000000 ____D C:\Program Files\Conduit

2014-01-09 11:33 - 2014-01-20 22:30 - 00000000 ____D C:\ProgramData\Updater

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-07 21:06 - 2014-01-09 18:49 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-14 20:27 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Mobogenie

2014-01-07 20:39 - 2014-01-14 20:24 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\genienext

2014-01-07 20:39 - 2014-01-10 19:57 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Mobogenie

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00004030 _____ C:\windows\System32\Tasks\LaunchApp

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-03 14:58 - 2014-01-25 23:00 - 00001376 _____ C:\windows\Tasks\click-n-mark-5-updater.job

2014-01-03 14:58 - 2014-01-25 23:00 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-03 14:58 - 2014-01-03 14:58 - 00004380 _____ C:\windows\System32\Tasks\click-n-mark-5-updater

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\emaze

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2014-01-03 14:57 - 2014-01-25 23:00 - 00001994 _____ C:\windows\Tasks\click-n-mark-5-chromeinstaller.job

2014-01-03 14:57 - 2014-01-25 23:00 - 00001920 _____ C:\windows\Tasks\click-n-mark-5-firefoxinstaller.job

2014-01-03 14:57 - 2014-01-25 23:00 - 00001282 _____ C:\windows\Tasks\click-n-mark-5-codedownloader.job

2014-01-03 14:57 - 2014-01-25 23:00 - 00001182 _____ C:\windows\Tasks\click-n-mark-5-enabler.job

2014-01-03 14:57 - 2014-01-18 15:30 - 00000000 ____D C:\Program Files (x86)\click-n-mark-5

2014-01-03 14:57 - 2014-01-03 14:57 - 00004286 _____ C:\windows\System32\Tasks\click-n-mark-5-codedownloader

2014-01-03 14:57 - 2014-01-03 14:57 - 00004186 _____ C:\windows\System32\Tasks\click-n-mark-5-enabler

2014-01-03 14:56 - 2014-01-20 22:43 - 00000000 ____D C:\ProgramData\WPM

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe
 

==================== One Month Modified Files and Folders =======
 

2014-01-25 23:59 - 2014-01-21 00:13 - 00000000 ____D C:\FRST

2014-01-25 23:25 - 2013-09-30 09:30 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2014-01-25 23:10 - 2014-01-25 12:06 - 00056184 _____ C:\windows\WindowsUpdate.log

2014-01-25 23:00 - 2014-01-03 14:58 - 00001376 _____ C:\windows\Tasks\click-n-mark-5-updater.job

2014-01-25 23:00 - 2014-01-03 14:58 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-25 23:00 - 2014-01-03 14:57 - 00001994 _____ C:\windows\Tasks\click-n-mark-5-chromeinstaller.job

2014-01-25 23:00 - 2014-01-03 14:57 - 00001920 _____ C:\windows\Tasks\click-n-mark-5-firefoxinstaller.job

2014-01-25 23:00 - 2014-01-03 14:57 - 00001282 _____ C:\windows\Tasks\click-n-mark-5-codedownloader.job

2014-01-25 23:00 - 2014-01-03 14:57 - 00001182 _____ C:\windows\Tasks\click-n-mark-5-enabler.job

2014-01-25 23:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2014-01-25 00:10 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2014-01-25 00:09 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2014-01-24 20:11 - 2013-07-11 12:41 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Spotify

2014-01-24 20:11 - 2013-07-11 12:40 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Spotify

2014-01-24 16:30 - 2014-01-24 16:02 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-24 15:09 - 2014-01-21 21:08 - 00000000 ____D C:\AdwCleaner

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-23 18:29 - 2013-07-18 13:49 - 00000000 ____D C:\ProgramData\Apple

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 20:47 - 2014-01-21 20:44 - 100400976 _____ (Apple Inc.) C:\Users\Holger-PC\Downloads\iTunes64Setup(1).exe

2014-01-21 16:57 - 2014-01-21 11:51 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 14:59 - 2014-01-21 11:51 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-01-21 11:48 - 2014-01-21 11:48 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008(1).exe

2014-01-21 11:07 - 2014-01-21 11:07 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008.exe

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:34 - 2014-01-21 02:17 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:23 - 2013-07-11 10:24 - 00000000 ____D C:\Users\Holger-PC

2014-01-21 00:14 - 2014-01-21 00:13 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:14 - 2014-01-21 00:13 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 22:52 - 2014-01-11 19:20 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-20 22:52 - 2014-01-09 11:33 - 00000000 ____D C:\ProgramData\RHelpers

2014-01-20 22:52 - 2014-01-09 11:33 - 00000000 ____D C:\Program Files\Conduit

2014-01-20 22:43 - 2014-01-03 14:56 - 00000000 ____D C:\ProgramData\WPM

2014-01-20 22:30 - 2014-01-09 11:33 - 00000000 ____D C:\ProgramData\Updater

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-19 08:33 - 2014-01-21 20:31 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-18 15:30 - 2014-01-03 14:57 - 00000000 ____D C:\Program Files (x86)\click-n-mark-5

2014-01-17 20:25 - 2014-01-21 00:27 - 00379904 _____ C:\Users\Holger-PC\Downloads\gmer.exe

2014-01-17 14:59 - 2013-10-27 12:18 - 00768688 _____ C:\windows\system32\perfh019.dat

2014-01-17 14:59 - 2013-10-27 12:18 - 00157826 _____ C:\windows\system32\perfc019.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2014-01-17 14:59 - 2012-07-26 08:28 - 02671956 _____ C:\windows\system32\PerfStringBackup.INI

2014-01-17 14:35 - 2014-01-17 14:14 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-16 19:47 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache

2014-01-16 18:53 - 2013-08-09 14:37 - 00000000 ____D C:\windows\system32\MRT

2014-01-16 18:53 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2014-01-16 18:51 - 2013-07-12 21:14 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-01-15 23:46 - 2014-01-15 23:46 - 00000000 ____D C:\windows\SysWOW64\SearchProtect

2014-01-14 20:28 - 2013-07-11 10:30 - 00000000 ___RD C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-14 20:27 - 2014-01-13 13:24 - 00000000 ____D C:\Program Files (x86)\Mobogenie

2014-01-14 20:27 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Mobogenie

2014-01-14 20:24 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\genienext

2014-01-13 16:21 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2014-01-13 13:44 - 2013-10-04 15:05 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Studium

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 16:49 - 2013-07-11 11:48 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2413837752-2537467696-3434217499-1001

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-11 16:37 - 2013-12-12 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-10 19:57 - 2014-01-07 20:39 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-10 14:49 - 2013-12-19 05:49 - 00000082 _____ C:\Users\Holger-PC\AppData\Roaming\WB.CFG

2014-01-09 18:49 - 2014-01-07 21:06 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-09 09:02 - 2013-11-14 18:05 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-01-09 09:02 - 2013-11-14 18:05 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-07 21:10 - 2013-07-11 10:29 - 00001671 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Mobogenie

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00004030 _____ C:\windows\System32\Tasks\LaunchApp

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-07 20:15 - 2012-11-07 21:48 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games

2014-01-07 19:52 - 2013-08-09 18:16 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\WildTangent

2014-01-07 19:52 - 2012-11-07 21:48 - 00000000 ____D C:\ProgramData\WildTangent

2014-01-03 14:58 - 2014-01-03 14:58 - 00004380 _____ C:\windows\System32\Tasks\click-n-mark-5-updater

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\emaze

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2014-01-03 14:57 - 2014-01-03 14:57 - 00004286 _____ C:\windows\System32\Tasks\click-n-mark-5-codedownloader

2014-01-03 14:57 - 2014-01-03 14:57 - 00004186 _____ C:\windows\System32\Tasks\click-n-mark-5-enabler

2013-12-30 18:21 - 2013-10-02 14:36 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe
 

Files to move or delete:

====================

C:\Users\Public\AlexaNSISPlugin.8188.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-17 21:08
 

==================== End Of Log ============================

--- --- ---

Malwarebytes Anti-Malware (MBAM)

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.01.25.10
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16750

Holger-PC :: HOLGER [Administrator]
 

26.01.2014 00:12:03

MBAM-log-2014-01-26 (00-18-55).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 231994

Laufzeit: 5 Minute(n), 56 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 3

HKCU\Software\Conduit\ValueApps (PUP.Optional.ValueApps.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\click-n-mark-5 (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\click-n-mark-5 (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 1

C:\Program Files (x86)\click-n-mark-5 (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.
 

Infizierte Dateien: 24

C:\Windows\Tasks\click-n-mark-5-chromeinstaller.job (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Windows\Tasks\click-n-mark-5-codedownloader.job (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Windows\Tasks\click-n-mark-5-enabler.job (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Windows\Tasks\click-n-mark-5-firefoxinstaller.job (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Windows\Tasks\click-n-mark-5-updater.job (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\45182.crx (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\45182.xpi (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\background.html (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bg.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho64.dll (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-buttonutil.dll (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-buttonutil.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-buttonutil64.dll (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-buttonutil64.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-chromeinstaller.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-codedownloader.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-enabler.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-firefoxinstaller.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-helper.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-updater.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\click-n-mark-5.ico (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\Installer.log (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\Uninstall.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.

C:\Program Files (x86)\click-n-mark-5\utils.exe (PUP.Optional.ClickNMark.A) -> Keine Aktion durchgeführt.
 

(Ende)

Waum hast du die Funde nicht entfernt??

Oh man sry.

Hier der Log in ´clean`

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.01.25.10
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16750

Holger-PC :: HOLGER [Administrator]
 

26.01.2014 00:38:22

mbam-log-2014-01-26 (00-38-22).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 232009

Laufzeit: 5 Minute(n), 56 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 1

HKCU\Software\Conduit\ValueApps (PUP.Optional.ValueApps.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Ok, dann probier bitte jetzt nochmal adwCleaner aus. Natürlich neu runterladen auf den Desktop bite

Jetzt hat es geklappt!

Code:

# AdwCleaner v3.017 - Bericht erstellt am 26/01/2014 um 01:43:59

# Aktualisiert 12/01/2014 von Xplode

# Betriebssystem : Windows 8  (64 bits)

# Benutzername : Holger-PC - HOLGER

# Gestartet von : C:\Users\Holger-PC\Downloads\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\AVG Nation toolbar

Ordner Gelöscht : C:\ProgramData\RHelpers

Ordner Gelöscht : C:\ProgramData\WPM

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Speed Maximizer

Ordner Gelöscht : C:\Program Files (x86)\AVG Nation toolbar

Ordner Gelöscht : C:\Program Files (x86)\Mobogenie

Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search

Ordner Gelöscht : C:\windows\SysWOW64\Searchprotect

Ordner Gelöscht : C:\Program Files\Conduit

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Local\AVG Nation toolbar

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Local\emaze

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Local\genienext

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Local\Mobogenie

Ordner Gelöscht : C:\Users\Holger-PC\AppData\LocalLow\AVG Nation toolbar

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard

Ordner Gelöscht : C:\Users\Holger-PC\Music\Documents\Mobogenie

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\VideoDownloadConverter_4z

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\{94CD2CC3-083F-49BA-A218-4CDA4B4829FD}

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec

Datei Gelöscht : C:\windows\System32\roboot64.exe

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\Ask.xml

Datei Gelöscht : C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\searchplugins\conduit-search.xml

Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\nationzoom.xml

Datei Gelöscht : C:\windows\System32\Tasks\Desk 365 RunAsStdUser

Datei Gelöscht : C:\windows\System32\Tasks\EPUpdater

Datei Gelöscht : C:\windows\System32\Tasks\LaunchApp
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Desinfiziert : C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Verknüpfung Desinfiziert : C:\Users\Holger-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\onpejdpfebeopffobknkodakfphdelnh

Schlüssel Gelöscht : HKCU\Software\Classes\Applications\lollipop.exe

Schlüssel Gelöscht : HKCU\Software\Classes\iLivid.torrent

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [iLivid]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\d

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]

Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc

Schlüssel Gelöscht : HKCU\Software\f28fdee23abf41

Schlüssel Gelöscht : HKLM\SOFTWARE\f28fdee23abf41

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{008F6853-9CB4-41C5-A950-39D55E5E06BA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69A72A8A-84ED-4A75-8CE7-263DBEF3E5D3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{87BEF026-9269-413C-A5B3-11F35451380E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{292ECB89-350E-45D2-816F-52C15305B144}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{51F04BD6-3888-4849-864C-617FAE709CE0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C953EC4-8CFA-44FB-B32E-1249E5505091}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D03FA45-4B8C-4427-BE67-EE8885147151}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E4E394E0-D331-431F-B76D-E3A19193D5F6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{312F84FB-8970-4FD3-BDDB-7012EAC4AFC9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{48586425-6BB7-4F51-8DC6-38C88E3EBB58}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C547C6C2-561B-4169-A2A5-20BA771CA93B}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{312F84FB-8970-4FD3-BDDB-7012EAC4AFC9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{48586425-6BB7-4F51-8DC6-38C88E3EBB58}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C547C6C2-561B-4169-A2A5-20BA771CA93B}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B424109-6F99-4306-8F2B-0B2BB1C8C415}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D86A75B-CB6B-4764-885D-CA6336F04BA2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C0EB0A9-265F-4D9D-AF96-0EF2403A73E8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9DF046E1-80F7-43E0-80C0-0AD696799C8F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D0FD0502-5878-441D-A3C0-9A4531C526CB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3E46008-1902-41A7-91C7-26EC6E0B66D2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{F63AAEDC-3602-49EF-AA45-262380A98980}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{17B10E59-09E1-4C39-A738-6774D7AB7778}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1AD2049E-E483-4425-8555-8E0775ACB631}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{292ECB89-350E-45D2-816F-52C15305B144}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2D73F2D0-2FAB-458E-977D-2F9050E0ED60}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9083CE-8758-4704-BA57-3C891D7452BD}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3E9469AF-E866-4476-B767-810630F1F6E7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47700C35-9E3E-4DAD-934C-0CE28A87237C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{716E443D-7CAA-44F1-866B-F45D00E712CC}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72063D77-7590-4DA9-A7F8-F5ECAF3632C4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7FC87AC5-FA93-476E-A32C-A941229DED0B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Schlüssel Gelöscht : HKCU\Software\Alexa Internet

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms

Schlüssel Gelöscht : HKCU\Software\lollipop

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Schlüssel Gelöscht : HKLM\Software\hdcode

Schlüssel Gelöscht : HKLM\Software\supWPM

Schlüssel Gelöscht : HKLM\Software\Uniblue

Schlüssel Gelöscht : HKLM\Software\V9

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Settings

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Amazon Browser Bar

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Bar
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16537
 

Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]

Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\prefs.js ]
 
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [15976 octets] - [26/01/2014 01:39:30]

AdwCleaner[R1].txt - [16037 octets] - [26/01/2014 01:43:28]

AdwCleaner[S0].txt - [14823 octets] - [26/01/2014 01:43:59]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14884 octets] ##########

Ok, Kontrollscn mit ESET

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hier der ESET-Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=52919a42bffc9040b6852e36b0983d39

# engine=16808

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-01-27 04:42:46

# local_time=2014-01-27 05:42:46 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.2.9200 NT 

# compatibility_mode=1799 16775165 100 94 88871 5726493 81643 0

# compatibility_mode=5893 16776574 100 94 508236 18124441 0 0

# scanned=238074

# found=0

# cleaned=0

# scan_time=19076

TFC - Temp File Cleaner

Lade dir

TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

Öffne die TFC.exe.
Vista und Win 7 User mit Rechtsklick "als Administrator starten".
Schließe alle anderen Programme.
Drücke auf den Button Start.
Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Ne es ist noch nicht wieder in Ordnung. Was halt noch auftritt ist, dass ich immer wieder in einem neuen Fenster dazu aufgerufen werde meinen Media-Player zu aktualisieren und sich immer wieder ein Spiel einschleicht, auf der Seite auf der ich zu dem Zeitpunkt bin.

Geht das auch genauer? In welchen Browsern?

Ähäm verstehe nicht genau. Also ich gebrauche Firefox, aber das meinst du sicher nicht. Also eigentlich besteht das Problem weiterhin, ich meine zwar, das es sich ein wenig verbessert hat, aber es öffnen sich nach wie vor Videos und Tabs selbstständig. Aber in Facebook z.B. ist die Werbung komplett verschwunden, was sehr positiv ist. Ich habe auch in einem anderen Thread zu einem sehr ähnlichen Thema gelesen, dass es mit der Zeit dann besser wurde und nicht sofort. Soll ich vllt mal die Links zu den Seiten schicken, die sich öffnen?

Mach mal neue FRST Logs. Haken bei additions setzen

Frst-Log:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014

Ran by Holger-PC (administrator) on HOLGER on 29-01-2014 13:13:47

Running from C:\Users\Holger-PC\Downloads\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

() C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(The OpenVPN Project) C:\Program Files (x86)\OpenVPN\bin\openvpn.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoViewOnDrive] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKLM\...\Policies\Explorer: [NoFind] 0

HKLM\...\Policies\Explorer: [NoFile] 0

HKLM\...\Policies\Explorer: [HideClock] 0

HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0

HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKLM\...\Policies\Explorer: [NoSetTaskbar] 0

HKLM\...\Policies\Explorer: [NoDeletePrinter] 0

HKLM\...\Policies\Explorer: [NoDFSTab] 0

HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0

HKLM\...\Policies\Explorer: [NoLogoff] 0

HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0

HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0

HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKLM\...\Policies\Explorer: [NoResolveSearch] 0

HKLM\...\Policies\Explorer: [NoSaveSettings] 0

HKLM\...\Policies\Explorer: [NoHardwareTab] 0

HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKLM\...\Policies\Explorer: [NoDesktop] 0

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-20] (Spotify Ltd)

HKCU\...\Policies\system: [DisableCMD] 0

HKCU\...\Policies\system: [NoDispAppearancePage] 0

HKCU\...\Policies\system: [NoDispBackgroundPage] 0

HKCU\...\Policies\system: [NoDispSettingsPage] 0

HKCU\...\Policies\Explorer: [NoViewOnDrive] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000

HKCU\...\Policies\Explorer: [NoFile] 0

HKCU\...\Policies\Explorer: [NoTrayContextMenu] 0

HKCU\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKCU\...\Policies\Explorer: [NoSetTaskbar] 0

HKCU\...\Policies\Explorer: [NoDeletePrinter] 0

HKCU\...\Policies\Explorer: [NoDFSTab] 0

HKCU\...\Policies\Explorer: [NoChangeStartMenu] 0

HKCU\...\Policies\Explorer: [NoWindowsUpdate] 0

HKCU\...\Policies\Explorer: [NoEncryptOnMove] 0

HKCU\...\Policies\Explorer: [NoResolveSearch] 0

HKCU\...\Policies\Explorer: [NoSaveSettings] 0

HKCU\...\Policies\Explorer: [NoHardwareTab] 0

HKCU\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\Administrator\...\Run: [] - [x]

Startup: C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = 

BHO: click-n-mark-5 - {11111111-1111-1111-1111-110411511182} - C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho64.dll No File

BHO: Feven 2.2 - {11111111-1111-1111-1111-110411901112} - C:\Program Files (x86)\Feven 2.2\Feven 2.2-bho64.dll No File

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll No File

BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Re-Markable - {bd55172e-59c1-4a93-b19c-633f0d7790ad} - C:\Program Files (x86)\Re-Markable\150.dll ()

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 132.231.51.4 132.231.1.24
 

FireFox:

========

FF ProfilePath: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default

FF SearchEngineOrder.1: Ask.com

FF SelectedSearchEngine: Google

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( )

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Widget context - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-14]

FF Extension: click-n-mark-5 - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com [2014-01-29]

FF Extension: Websteroids - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\support@websteroidsapp.com [2014-01-09]

FF Extension: Amazon 1Button App for Firefox - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\abb@amazon.com.xpi [2013-09-04]

FF Extension: GutscheinCodes.de GutscheinFinder - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi [2013-07-12]

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-11-26]

FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

FF HKCU\...\Firefox\Extensions: [{cb1bb3bd-8ce0-4d26-98c4-99f6415a6002}] - C:\Program Files (x86)\Re-Markable\150.xpi

FF Extension: No Name - C:\Program Files (x86)\Re-Markable\150.xpi [2014-01-03]
 

Chrome: 

=======

CHR Extension: (Feven 2.2) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhbagplpkkoeifmpmpdaieomnggppmo [2014-01-07]

CHR Extension: (click-n-mark-5) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiiggndjhacnnhnhmaljgbgcaneehld [2014-01-03]

CHR Extension: (Widget context) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-14]

CHR Extension: (No Name) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec [2013-07-11]

CHR HKLM-x32\...\Chrome\Extension: [ejdfidgapfiokiphmcjpmmjbdndepoja] - C:\Program Files (x86)\Re-Markable\150.crx [2014-01-03]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

U2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-07-16] (Freemake)

U2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

U2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

U3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)

U3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)

U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

U3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [x]
 

==================== Drivers (Whitelisted) ====================
 

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-19] (Avira Operations GmbH & Co. KG)

U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

U3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

U3 mbamchameleon; C:\windows\system32\drivers\mbamchameleon.sys [89304 2014-01-21] (Malwarebytes Corporation)

U3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)

U2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

U3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

U3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )

U3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

U3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

U0 SR; 

U2 srservice; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-29 13:04 - 2014-01-29 13:06 - 00020755 _____ C:\windows\WindowsUpdate.log

2014-01-28 00:22 - 2014-01-28 00:24 - 00137180 _____ C:\Users\Holger-PC\Downloads\hosts.zip

2014-01-27 12:17 - 2014-01-27 12:17 - 02347384 _____ (ESET) C:\Users\Holger-PC\Downloads\esetsmartinstaller_enu.exe

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D C:\Program Files (x86)\ESET

2014-01-26 01:39 - 2014-01-26 02:07 - 00000000 ____D C:\AdwCleaner

2014-01-24 16:02 - 2014-01-24 16:30 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 20:44 - 2014-01-21 20:47 - 100400976 _____ (Apple Inc.) C:\Users\Holger-PC\Downloads\iTunes64Setup(1).exe

2014-01-21 20:31 - 2014-01-19 08:33 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-21 11:51 - 2014-01-21 16:57 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 11:48 - 2014-01-21 11:48 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008(1).exe

2014-01-21 11:07 - 2014-01-21 11:07 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008.exe

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:17 - 2014-01-21 02:34 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:27 - 2014-01-17 20:25 - 00379904 _____ C:\Users\Holger-PC\Downloads\gmer.exe

2014-01-21 00:13 - 2014-01-29 13:13 - 00000000 ____D C:\FRST

2014-01-21 00:13 - 2014-01-21 00:14 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:13 - 2014-01-21 00:14 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-17 14:14 - 2014-01-17 14:35 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-15 21:40 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll

2014-01-15 21:40 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\MPSSVC.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\windows\SysWOW64\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mpsdrv.sys

2014-01-15 21:40 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll

2014-01-15 21:40 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll

2014-01-15 21:40 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys

2014-01-15 21:40 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2014-01-15 21:40 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2014-01-15 21:40 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2014-01-15 21:40 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 19:20 - 2014-01-20 22:52 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-09 11:33 - 2014-01-20 22:30 - 00000000 ____D C:\ProgramData\Updater

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-07 21:06 - 2014-01-09 18:49 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-10 19:57 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-03 14:58 - 2014-01-29 12:13 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe
 

==================== One Month Modified Files and Folders =======
 

2014-01-29 13:13 - 2014-01-21 00:13 - 00000000 ____D C:\FRST

2014-01-29 13:06 - 2014-01-29 13:04 - 00020755 _____ C:\windows\WindowsUpdate.log

2014-01-29 13:02 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2014-01-29 12:25 - 2013-09-30 09:30 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2014-01-29 12:13 - 2014-01-03 14:58 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-28 00:24 - 2014-01-28 00:22 - 00137180 _____ C:\Users\Holger-PC\Downloads\hosts.zip

2014-01-27 12:17 - 2014-01-27 12:17 - 02347384 _____ (ESET) C:\Users\Holger-PC\Downloads\esetsmartinstaller_enu.exe

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D C:\Program Files (x86)\ESET

2014-01-26 23:10 - 2013-07-11 12:40 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Spotify

2014-01-26 19:33 - 2013-07-11 12:41 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Spotify

2014-01-26 02:07 - 2014-01-26 01:39 - 00000000 ____D C:\AdwCleaner

2014-01-26 01:58 - 2013-07-11 11:48 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2413837752-2537467696-3434217499-1001

2014-01-26 01:45 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2014-01-26 01:44 - 2013-07-11 10:29 - 00001014 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-01-26 01:44 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2014-01-24 16:30 - 2014-01-24 16:02 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-23 18:29 - 2013-07-18 13:49 - 00000000 ____D C:\ProgramData\Apple

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 20:47 - 2014-01-21 20:44 - 100400976 _____ (Apple Inc.) C:\Users\Holger-PC\Downloads\iTunes64Setup(1).exe

2014-01-21 16:57 - 2014-01-21 11:51 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 11:48 - 2014-01-21 11:48 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008(1).exe

2014-01-21 11:07 - 2014-01-21 11:07 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008.exe

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:34 - 2014-01-21 02:17 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:23 - 2013-07-11 10:24 - 00000000 ____D C:\Users\Holger-PC

2014-01-21 00:14 - 2014-01-21 00:13 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:14 - 2014-01-21 00:13 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 22:52 - 2014-01-11 19:20 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-20 22:30 - 2014-01-09 11:33 - 00000000 ____D C:\ProgramData\Updater

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-19 08:33 - 2014-01-21 20:31 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-17 20:25 - 2014-01-21 00:27 - 00379904 _____ C:\Users\Holger-PC\Downloads\gmer.exe

2014-01-17 14:59 - 2013-10-27 12:18 - 00768688 _____ C:\windows\system32\perfh019.dat

2014-01-17 14:59 - 2013-10-27 12:18 - 00157826 _____ C:\windows\system32\perfc019.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2014-01-17 14:59 - 2012-07-26 08:28 - 02671956 _____ C:\windows\system32\PerfStringBackup.INI

2014-01-17 14:35 - 2014-01-17 14:14 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-16 19:47 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache

2014-01-16 18:53 - 2013-08-09 14:37 - 00000000 ____D C:\windows\system32\MRT

2014-01-16 18:53 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2014-01-16 18:51 - 2013-07-12 21:14 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-01-14 20:28 - 2013-07-11 10:30 - 00000000 ___RD C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-13 16:21 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2014-01-13 13:44 - 2013-10-04 15:05 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Studium

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-11 16:37 - 2013-12-12 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-10 19:57 - 2014-01-07 20:39 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-10 14:49 - 2013-12-19 05:49 - 00000082 _____ C:\Users\Holger-PC\AppData\Roaming\WB.CFG

2014-01-09 18:49 - 2014-01-07 21:06 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-09 09:02 - 2013-11-14 18:05 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-01-09 09:02 - 2013-11-14 18:05 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-07 20:15 - 2012-11-07 21:48 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games

2014-01-07 19:52 - 2013-08-09 18:16 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\WildTangent

2014-01-07 19:52 - 2012-11-07 21:48 - 00000000 ____D C:\ProgramData\WildTangent

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2013-12-30 18:21 - 2013-10-02 14:36 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe
 

Files to move or delete:

====================

C:\Users\Public\AlexaNSISPlugin.8188.dll
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-27 20:22
 

==================== End Of Log ============================

--- --- ---

Addition-Log:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014

Ran by Holger-PC at 2014-01-29 13:14:43

Running from C:\Users\Holger-PC\Downloads\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC) Hidden

Apple Application Support (x32 Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)

AVG 2014 (Version: 14.0.3604 - AVG Technologies) Hidden

Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)

Avira SearchFree Toolbar (x32 Version: 12.10.0.2949 - APN, LLC)

AVS Audio Converter 7 (x32 Version: 7.2.1.528 - Online Media Technologies Ltd.)

Bonjour (Version: 3.0.0.10 - Apple Inc.)

CCleaner (Version: 4.08 - Piriform)

Citavi 4 (x32 Version: 4.2.0.11 - Swiss Academic Software)

DMUninstaller (x32 Version:  - )

ESET Online Scanner v3 (x32 Version:  - )

Exact Audio Copy 1.0beta3 (x32 Version: 1.0beta3 - Andre Wiethoff)

Free YouTube Download version 3.2.19.1219 (x32 Version: 3.2.19.1219 - DVDVideoSoft Ltd.)

Free Zip Opener (x32 Version: 1.0 - Tripro Limited)

Freemake Audio Converter Version 1.1.0 (x32 Version: 1.1.0 - Ellora Assets Corporation)

Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION

Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)

Intel AppUp(SM) center (x32 Version: 3.6.1.33268.15 - Intel)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION

iTunes (Version: 11.1.4.62 - Apple Inc.)

Lightspark 0.5.3-git (x32 Version: 0.5.3-git - Lightspark Team)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft Office (x32 Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft Silverlight (x32 Version: 4.0.60310.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

Nero 12 Essentials Toshiba (x32 Version: 12.0.00400 - Nero AG)

Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden

Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)

OpenVPN 2.3.2 UniPassau (x32 Version: 2.3.2 - )

PC Speed Maximizer v3.1 (x32 Version: 3.1 - Smart PC Solutions)

Premium Sound HD (Version: 1.12.4600 - SRS Labs, Inc.)

Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp) Hidden

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6687 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (x32 Version: 2.00.0020 - REALTEK Semiconductor Corp.)

Re-Markable (x32 Version:  - Re-Markable Software)

Shared C Run-time for x64 (Version: 10.0.0 - McAfee)

Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)

Synaptics Pointing Device Driver (Version: 16.2.10.3 - Synaptics Incorporated)

TAP-Windows 9.9.2 (Version: 9.9.2 - )

TOSHIBA Desktop Assist (Version: 1.00.0007.00002 - Toshiba Corporation)

TOSHIBA eco Utility (Version: 2.0.0.6415 - Toshiba Corporation)

TOSHIBA Function Key (Version: 1.00.6425 - Toshiba Corporation)

TOSHIBA Manuals (x32 Version: 10.10 - TOSHIBA)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden

TOSHIBA PC Health Monitor (Version: 1.8.17.640104 - Toshiba Corporation)

Toshiba Places Icon Utility (Version: 2.1.1 - TOSHIBA)

TOSHIBA Recovery Media Creator (x32 Version: 2.2.0.54043005 - Toshiba Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00 - TOSHIBA Corporation)

TOSHIBA Service Station (Version: 2.4.4 - TOSHIBA)

TOSHIBA System Driver (x32 Version: 1.00.0012 - Toshiba Corporation)

TOSHIBA System Settings (x32 Version: 1.00.0002.32002 - Toshiba Corporation)

Toshiba TEMPRO (x32 Version: 4.2.1 - Toshiba Europe GmbH)

TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A - Toshiba Corporation)

Updater (x32 Version: 2.6.53 - Creative Island Media, LLC)

Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VisualBee for Microsoft PowerPoint (HKCU Version: V4.1 - VisualBee.com)

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden

Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3 - Realtek Semiconductor Corp.)

WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
 

==================== Restore Points  =========================
 

09-01-2014 10:33:40 Uniblue SpeedUpMyPC installation

16-01-2014 17:35:48 Windows Update

21-01-2014 19:55:14 Installed iTunes

26-01-2014 00:58:19 Windows Update
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {00C107C2-027E-4224-83B4-754CDD462CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-08-14] (Toshiba Europe GmbH)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {2807D834-4937-49CF-ABDE-3E9AD3CBDB68} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)

Task: {3C34E352-D102-4B2E-A790-FC5D6226257D} - System32\Tasks\Re-Markable Update => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe [2014-01-03] ()

Task: {411A5387-5618-4EE2-A0D0-8ECC6EF5C97B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {4DEAF078-4D55-4C04-8165-FD15AB799510} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)

Task: {7B4A55C2-0879-44B1-A6BF-1F593C7656A7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)

Task: {84962D8B-E8A6-4638-A2C9-DB0ABE38826C} - \EPUpdater No Task File

Task: {92FA85CF-6EAE-4B68-9422-55CA63A44942} - \Desk 365 RunAsStdUser No Task File

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {F6C11617-6D62-4525-91D5-00D4CDA3557C} - \LaunchApp No Task File

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\Re-Markable Update.job => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-07-18 14:22 - 2010-12-29 12:24 - 00120320 _____ () C:\Program Files (x86)\Free Zip Opener\contmenu_x64.dll

2013-07-07 22:38 - 2013-07-07 22:39 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll

2013-12-07 18:49 - 2013-11-22 12:01 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-11-07 21:27 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2014-01-11 16:37 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00161992 _____ () C:\Program Files (x86)\OpenVPN\bin\liblzo2-2.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00107720 _____ () C:\Program Files (x86)\OpenVPN\bin\libpkcs11-helper-1.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Could not start eventlog service, could not read events.
 

Der angeforderte Dienst wurde bereits gestartet.
 

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 51%

Total physical RAM: 3979.21 MB

Available physical RAM: 1912.38 MB

Total Pagefile: 5963.21 MB

Available Pagefile: 3420.99 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB
 

==================== Drives ================================
 

Drive c: (TI30992300A) (Fixed) (Total:455.29 GB) (Free:220.76 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type

==================== End Of Log ============================

Wo kommt denn die ganze Adware schon wieder her :balla:

Adwcleaner neu runterladen und ausführen!

Code:

# AdwCleaner v3.018 - Bericht erstellt am 29/01/2014 um 14:20:43

# Updated 28/01/2014 von Xplode

# Betriebssystem : Windows 8  (64 bits)

# Benutzername : Holger-PC - HOLGER

# Gestartet von : C:\Users\Holger-PC\Downloads\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16537
 
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\prefs.js ]
 
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [1036 octets] - [29/01/2014 14:19:52]

AdwCleaner[S0].txt - [959 octets] - [29/01/2014 14:20:43]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1018 octets] ##########

Neuer Quickscan mit MBAM bitte, MBAM vorher aktualisieren

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.01.29.05
 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16750

Holger-PC :: HOLGER [Administrator]
 

29.01.2014 15:31:58

mbam-log-2014-01-29 (15-31-58).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 232942

Laufzeit: 5 Minute(n), 50 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\Holger-PC\Downloads\rcpsetup_chip_de_chip_de.exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Frische FRST Logs bitte :D

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014

Ran by Holger-PC (administrator) on HOLGER on 29-01-2014 16:12:26

Running from C:\Users\Holger-PC\Downloads\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe

() C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe

(The OpenVPN Project) C:\Program Files (x86)\OpenVPN\bin\openvpn.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoViewOnDrive] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKLM\...\Policies\Explorer: [NoFind] 0

HKLM\...\Policies\Explorer: [NoFile] 0

HKLM\...\Policies\Explorer: [HideClock] 0

HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0

HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKLM\...\Policies\Explorer: [NoSetTaskbar] 0

HKLM\...\Policies\Explorer: [NoDeletePrinter] 0

HKLM\...\Policies\Explorer: [NoDFSTab] 0

HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0

HKLM\...\Policies\Explorer: [NoLogoff] 0

HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0

HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0

HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKLM\...\Policies\Explorer: [NoResolveSearch] 0

HKLM\...\Policies\Explorer: [NoSaveSettings] 0

HKLM\...\Policies\Explorer: [NoHardwareTab] 0

HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKLM\...\Policies\Explorer: [NoDesktop] 0

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-20] (Spotify Ltd)

HKCU\...\Policies\system: [DisableCMD] 0

HKCU\...\Policies\system: [NoDispAppearancePage] 0

HKCU\...\Policies\system: [NoDispBackgroundPage] 0

HKCU\...\Policies\system: [NoDispSettingsPage] 0

HKCU\...\Policies\Explorer: [NoViewOnDrive] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000

HKCU\...\Policies\Explorer: [NoFile] 0

HKCU\...\Policies\Explorer: [NoTrayContextMenu] 0

HKCU\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKCU\...\Policies\Explorer: [NoSetTaskbar] 0

HKCU\...\Policies\Explorer: [NoDeletePrinter] 0

HKCU\...\Policies\Explorer: [NoDFSTab] 0

HKCU\...\Policies\Explorer: [NoChangeStartMenu] 0

HKCU\...\Policies\Explorer: [NoWindowsUpdate] 0

HKCU\...\Policies\Explorer: [NoEncryptOnMove] 0

HKCU\...\Policies\Explorer: [NoResolveSearch] 0

HKCU\...\Policies\Explorer: [NoSaveSettings] 0

HKCU\...\Policies\Explorer: [NoHardwareTab] 0

HKCU\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\Administrator\...\Run: [] - [x]

Startup: C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = 

BHO: click-n-mark-5 - {11111111-1111-1111-1111-110411511182} - C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho64.dll No File

BHO: Feven 2.2 - {11111111-1111-1111-1111-110411901112} - C:\Program Files (x86)\Feven 2.2\Feven 2.2-bho64.dll No File

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll No File

BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Re-Markable - {bd55172e-59c1-4a93-b19c-633f0d7790ad} - C:\Program Files (x86)\Re-Markable\150.dll ()

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Tcpip\Parameters: [DhcpNameServer] 132.231.51.4 132.231.1.24
 

FireFox:

========

FF ProfilePath: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default

FF SearchEngineOrder.1: Ask.com

FF SelectedSearchEngine: Google

FF Homepage: www.sz.de

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( )

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Widget context - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-14]

FF Extension: click-n-mark-5 - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com [2014-01-29]

FF Extension: Websteroids - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\support@websteroidsapp.com [2014-01-09]

FF Extension: Amazon 1Button App for Firefox - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\abb@amazon.com.xpi [2013-09-04]

FF Extension: GutscheinCodes.de GutscheinFinder - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi [2013-07-12]

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-11-26]

FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

FF HKCU\...\Firefox\Extensions: [{cb1bb3bd-8ce0-4d26-98c4-99f6415a6002}] - C:\Program Files (x86)\Re-Markable\150.xpi

FF Extension: No Name - C:\Program Files (x86)\Re-Markable\150.xpi [2014-01-03]
 

Chrome: 

=======

CHR Extension: (Feven 2.2) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhbagplpkkoeifmpmpdaieomnggppmo [2014-01-07]

CHR Extension: (click-n-mark-5) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiiggndjhacnnhnhmaljgbgcaneehld [2014-01-03]

CHR Extension: (Widget context) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-14]

CHR HKLM-x32\...\Chrome\Extension: [ejdfidgapfiokiphmcjpmmjbdndepoja] - C:\Program Files (x86)\Re-Markable\150.crx [2014-01-03]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-20] (APN LLC.)

U2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-07-16] (Freemake)

U2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

U2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

U3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)

U3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)

U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

U3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [x]
 

==================== Drivers (Whitelisted) ====================
 

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-19] (Avira Operations GmbH & Co. KG)

U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

U3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

U3 mbamchameleon; C:\windows\system32\drivers\mbamchameleon.sys [89304 2014-01-21] (Malwarebytes Corporation)

U3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)

U2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

U3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

U3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )

U3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

U3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

U0 SR; 

U2 srservice; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-29 16:02 - 2014-01-29 16:02 - 00000358 _____ C:\windows\PFRO.log

2014-01-29 14:19 - 2014-01-29 14:27 - 00000000 ____D C:\AdwCleaner

2014-01-29 13:04 - 2014-01-29 13:16 - 00023212 _____ C:\windows\WindowsUpdate.log

2014-01-28 00:22 - 2014-01-28 00:24 - 00137180 _____ C:\Users\Holger-PC\Downloads\hosts.zip

2014-01-27 12:17 - 2014-01-27 12:17 - 02347384 _____ (ESET) C:\Users\Holger-PC\Downloads\esetsmartinstaller_enu.exe

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D C:\Program Files (x86)\ESET

2014-01-24 16:02 - 2014-01-24 16:30 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 20:44 - 2014-01-21 20:47 - 100400976 _____ (Apple Inc.) C:\Users\Holger-PC\Downloads\iTunes64Setup(1).exe

2014-01-21 20:31 - 2014-01-19 08:33 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-21 11:51 - 2014-01-21 16:57 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 11:48 - 2014-01-21 11:48 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008(1).exe

2014-01-21 11:07 - 2014-01-21 11:07 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008.exe

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:17 - 2014-01-21 02:34 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:27 - 2014-01-17 20:25 - 00379904 _____ C:\Users\Holger-PC\Downloads\gmer.exe

2014-01-21 00:13 - 2014-01-29 16:12 - 00000000 ____D C:\FRST

2014-01-21 00:13 - 2014-01-21 00:14 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:13 - 2014-01-21 00:14 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-17 14:14 - 2014-01-17 14:35 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-15 21:40 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll

2014-01-15 21:40 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\MPSSVC.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\windows\SysWOW64\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mpsdrv.sys

2014-01-15 21:40 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll

2014-01-15 21:40 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll

2014-01-15 21:40 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys

2014-01-15 21:40 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2014-01-15 21:40 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2014-01-15 21:40 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2014-01-15 21:40 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 19:20 - 2014-01-20 22:52 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-09 11:33 - 2014-01-20 22:30 - 00000000 ____D C:\ProgramData\Updater

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-07 21:06 - 2014-01-09 18:49 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-10 19:57 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-03 14:58 - 2014-01-29 16:03 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe
 

==================== One Month Modified Files and Folders =======
 

2014-01-29 16:13 - 2013-07-11 12:40 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Spotify

2014-01-29 16:12 - 2014-01-21 00:13 - 00000000 ____D C:\FRST

2014-01-29 16:03 - 2014-01-03 14:58 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-29 16:03 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2014-01-29 16:02 - 2014-01-29 16:02 - 00000358 _____ C:\windows\PFRO.log

2014-01-29 16:02 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2014-01-29 16:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2014-01-29 15:25 - 2013-09-30 09:30 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2014-01-29 14:27 - 2014-01-29 14:19 - 00000000 ____D C:\AdwCleaner

2014-01-29 13:16 - 2014-01-29 13:04 - 00023212 _____ C:\windows\WindowsUpdate.log

2014-01-28 00:24 - 2014-01-28 00:22 - 00137180 _____ C:\Users\Holger-PC\Downloads\hosts.zip

2014-01-27 12:17 - 2014-01-27 12:17 - 02347384 _____ (ESET) C:\Users\Holger-PC\Downloads\esetsmartinstaller_enu.exe

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D C:\Program Files (x86)\ESET

2014-01-26 19:33 - 2013-07-11 12:41 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Spotify

2014-01-26 01:58 - 2013-07-11 11:48 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2413837752-2537467696-3434217499-1001

2014-01-26 01:44 - 2013-07-11 10:29 - 00001014 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-01-24 16:30 - 2014-01-24 16:02 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-23 18:29 - 2013-07-18 13:49 - 00000000 ____D C:\ProgramData\Apple

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 20:47 - 2014-01-21 20:44 - 100400976 _____ (Apple Inc.) C:\Users\Holger-PC\Downloads\iTunes64Setup(1).exe

2014-01-21 16:57 - 2014-01-21 11:51 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 11:48 - 2014-01-21 11:48 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008(1).exe

2014-01-21 11:07 - 2014-01-21 11:07 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Holger-PC\Downloads\mbar-1.07.0.1008.exe

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:34 - 2014-01-21 02:17 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:23 - 2013-07-11 10:24 - 00000000 ____D C:\Users\Holger-PC

2014-01-21 00:14 - 2014-01-21 00:13 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:14 - 2014-01-21 00:13 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:09 - 2014-01-21 00:09 - 01221120 _____ (Farbar) C:\Users\Holger-PC\Downloads\FRST.exe

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 23:57 - 2014-01-20 23:57 - 00050477 _____ C:\Users\Holger-PC\Downloads\Defogger.exe

2014-01-20 22:52 - 2014-01-11 19:20 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-20 22:30 - 2014-01-09 11:33 - 00000000 ____D C:\ProgramData\Updater

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:37 - 2014-01-20 20:37 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Holger-PC\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-19 08:33 - 2014-01-21 20:31 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-17 20:25 - 2014-01-21 00:27 - 00379904 _____ C:\Users\Holger-PC\Downloads\gmer.exe

2014-01-17 14:59 - 2013-10-27 12:18 - 00768688 _____ C:\windows\system32\perfh019.dat

2014-01-17 14:59 - 2013-10-27 12:18 - 00157826 _____ C:\windows\system32\perfc019.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2014-01-17 14:59 - 2012-07-26 08:28 - 02671956 _____ C:\windows\system32\PerfStringBackup.INI

2014-01-17 14:35 - 2014-01-17 14:14 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-16 19:47 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache

2014-01-16 18:53 - 2013-08-09 14:37 - 00000000 ____D C:\windows\system32\MRT

2014-01-16 18:53 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2014-01-16 18:51 - 2013-07-12 21:14 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-01-14 20:28 - 2013-07-11 10:30 - 00000000 ___RD C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-13 16:21 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2014-01-13 13:44 - 2013-10-04 15:05 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Studium

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-11 16:37 - 2013-12-12 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-10 19:57 - 2014-01-07 20:39 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-10 14:49 - 2013-12-19 05:49 - 00000082 _____ C:\Users\Holger-PC\AppData\Roaming\WB.CFG

2014-01-09 18:49 - 2014-01-07 21:06 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-09 09:02 - 2013-11-14 18:05 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-01-09 09:02 - 2013-11-14 18:05 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-07 21:06 - 2014-01-07 21:06 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-07 20:15 - 2012-11-07 21:48 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games

2014-01-07 19:52 - 2013-08-09 18:16 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\WildTangent

2014-01-07 19:52 - 2012-11-07 21:48 - 00000000 ____D C:\ProgramData\WildTangent

2014-01-03 14:58 - 2014-01-03 14:58 - 00003064 _____ C:\windows\System32\Tasks\Re-Markable Update

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2014-01-03 14:58 - 2014-01-03 14:58 - 00000000 ____D C:\Program Files (x86)\Re-Markable

2013-12-30 18:21 - 2013-10-02 14:36 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft

2013-12-30 18:18 - 2013-12-30 18:18 - 32350440 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Holger-PC\Downloads\Free19YouTubeDownload.exe
 

Files to move or delete:

====================

C:\Users\Public\AlexaNSISPlugin.8188.dll
 
 

Some content of TEMP:

====================

C:\Users\Holger-PC\AppData\Local\Temp\avgnt.exe

C:\Users\Holger-PC\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-27 20:22
 

==================== End Of Log ============================

--- --- ---
FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014

Ran by Holger-PC at 2014-01-29 16:13:03

Running from C:\Users\Holger-PC\Downloads\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC) Hidden

Apple Application Support (x32 Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)

AVG 2014 (Version: 14.0.3604 - AVG Technologies) Hidden

Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)

Avira SearchFree Toolbar (x32 Version: 12.10.0.2949 - APN, LLC)

AVS Audio Converter 7 (x32 Version: 7.2.1.528 - Online Media Technologies Ltd.)

Bonjour (Version: 3.0.0.10 - Apple Inc.)

CCleaner (Version: 4.08 - Piriform)

Citavi 4 (x32 Version: 4.2.0.11 - Swiss Academic Software)

DMUninstaller (x32 Version:  - )

ESET Online Scanner v3 (x32 Version:  - )

Exact Audio Copy 1.0beta3 (x32 Version: 1.0beta3 - Andre Wiethoff)

Free YouTube Download version 3.2.19.1219 (x32 Version: 3.2.19.1219 - DVDVideoSoft Ltd.)

Free Zip Opener (x32 Version: 1.0 - Tripro Limited)

Freemake Audio Converter Version 1.1.0 (x32 Version: 1.1.0 - Ellora Assets Corporation)

Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION

Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)

Intel AppUp(SM) center (x32 Version: 3.6.1.33268.15 - Intel)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION

iTunes (Version: 11.1.4.62 - Apple Inc.)

Lightspark 0.5.3-git (x32 Version: 0.5.3-git - Lightspark Team)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft Office (x32 Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft Silverlight (x32 Version: 4.0.60310.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

Nero 12 Essentials Toshiba (x32 Version: 12.0.00400 - Nero AG)

Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden

Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)

OpenVPN 2.3.2 UniPassau (x32 Version: 2.3.2 - )

PC Speed Maximizer v3.1 (x32 Version: 3.1 - Smart PC Solutions)

Premium Sound HD (Version: 1.12.4600 - SRS Labs, Inc.)

Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp) Hidden

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6687 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (x32 Version: 2.00.0020 - REALTEK Semiconductor Corp.)

Re-Markable (x32 Version:  - Re-Markable Software)

Shared C Run-time for x64 (Version: 10.0.0 - McAfee)

Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)

Synaptics Pointing Device Driver (Version: 16.2.10.3 - Synaptics Incorporated)

TAP-Windows 9.9.2 (Version: 9.9.2 - )

TOSHIBA Desktop Assist (Version: 1.00.0007.00002 - Toshiba Corporation)

TOSHIBA eco Utility (Version: 2.0.0.6415 - Toshiba Corporation)

TOSHIBA Function Key (Version: 1.00.6425 - Toshiba Corporation)

TOSHIBA Manuals (x32 Version: 10.10 - TOSHIBA)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden

TOSHIBA PC Health Monitor (Version: 1.8.17.640104 - Toshiba Corporation)

Toshiba Places Icon Utility (Version: 2.1.1 - TOSHIBA)

TOSHIBA Recovery Media Creator (x32 Version: 2.2.0.54043005 - Toshiba Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00 - TOSHIBA Corporation)

TOSHIBA Service Station (Version: 2.4.4 - TOSHIBA)

TOSHIBA System Driver (x32 Version: 1.00.0012 - Toshiba Corporation)

TOSHIBA System Settings (x32 Version: 1.00.0002.32002 - Toshiba Corporation)

Toshiba TEMPRO (x32 Version: 4.2.1 - Toshiba Europe GmbH)

TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A - Toshiba Corporation)

Updater (x32 Version: 2.6.53 - Creative Island Media, LLC)

Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VisualBee for Microsoft PowerPoint (HKCU Version: V4.1 - VisualBee.com)

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden

Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3 - Realtek Semiconductor Corp.)

WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
 

==================== Restore Points  =========================
 

09-01-2014 10:33:40 Uniblue SpeedUpMyPC installation

16-01-2014 17:35:48 Windows Update

21-01-2014 19:55:14 Installed iTunes

26-01-2014 00:58:19 Windows Update
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {00C107C2-027E-4224-83B4-754CDD462CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-08-14] (Toshiba Europe GmbH)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {2807D834-4937-49CF-ABDE-3E9AD3CBDB68} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)

Task: {3C34E352-D102-4B2E-A790-FC5D6226257D} - System32\Tasks\Re-Markable Update => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe [2014-01-03] ()

Task: {411A5387-5618-4EE2-A0D0-8ECC6EF5C97B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {4DEAF078-4D55-4C04-8165-FD15AB799510} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)

Task: {7B4A55C2-0879-44B1-A6BF-1F593C7656A7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)

Task: {84962D8B-E8A6-4638-A2C9-DB0ABE38826C} - \EPUpdater No Task File

Task: {92FA85CF-6EAE-4B68-9422-55CA63A44942} - \Desk 365 RunAsStdUser No Task File

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {F6C11617-6D62-4525-91D5-00D4CDA3557C} - \LaunchApp No Task File

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\Re-Markable Update.job => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-07-18 14:22 - 2010-12-29 12:24 - 00120320 _____ () C:\Program Files (x86)\Free Zip Opener\contmenu_x64.dll

2013-07-07 22:38 - 2013-07-07 22:39 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll

2013-12-07 18:49 - 2013-11-22 12:01 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-11-07 21:27 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00161992 _____ () C:\Program Files (x86)\OpenVPN\bin\liblzo2-2.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00107720 _____ () C:\Program Files (x86)\OpenVPN\bin\libpkcs11-helper-1.dll

2014-01-11 16:37 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

2013-07-11 12:41 - 2014-01-20 23:02 - 36967424 _____ () C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\libcef.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Could not start eventlog service, could not read events.
 

Der angeforderte Dienst wurde bereits gestartet.
 

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 42%

Total physical RAM: 3979.21 MB

Available physical RAM: 2299.75 MB

Total Pagefile: 5963.21 MB

Available Pagefile: 4053.97 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (TI30992300A) (Fixed) (Total:455.29 GB) (Free:220.34 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type

==================== End Of Log ============================

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

BHO: click-n-mark-5 - {11111111-1111-1111-1111-110411511182} - C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho64.dll No File

BHO: Feven 2.2 - {11111111-1111-1111-1111-110411901112} - C:\Program Files (x86)\Feven 2.2\Feven 2.2-bho64.dll No File

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll No File

BHO-x32: Re-Markable - {bd55172e-59c1-4a93-b19c-633f0d7790ad} - C:\Program Files (x86)\Re-Markable\150.dll ()

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml

FF SearchEngineOrder.1: Ask.com

FF Extension: click-n-mark-5 - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com [2014-01-29]

FF Extension: Websteroids - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\support@websteroidsapp.com [2014-01-09]

FF Extension: Amazon 1Button App for Firefox - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\abb@amazon.com.xpi [2013-09-04]

FF Extension: GutscheinCodes.de GutscheinFinder - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi [2013-07-12]

FF Extension: No Name - C:\Program Files (x86)\Re-Markable\150.xpi [2014-01-03]

C:\Program Files (x86)\click-n-mark-5

C:\Program Files (x86)\Feven 2.2

C:\Program Files (x86)\AskPartnerNetwork

C:\Program Files\Conduit

C:\Program Files (x86)\Re-Markable

C:\Users\Holger-PC\Downloads\*.exe

C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhbagplpkkoeifmpmpdaieomnggppmo

C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiiggndjhacnnhnhmaljgbgcaneehld

C:\Program Files (x86)\Re-Markable\150.crx

C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

C:\windows\System32\Tasks\Re-Markable Update

C:\Users\Public\AlexaNSISPlugin.8188.dll

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-01-2014

Ran by Holger-PC at 2014-01-29 16:34:56 Run:1

Running from C:\Users\Holger-PC\Downloads\Desktop

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

BHO: click-n-mark-5 - {11111111-1111-1111-1111-110411511182} - C:\Program Files (x86)\click-n-mark-5\click-n-mark-5-bho64.dll No File

BHO: Feven 2.2 - {11111111-1111-1111-1111-110411901112} - C:\Program Files (x86)\Feven 2.2\Feven 2.2-bho64.dll No File

BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll No File

BHO-x32: Re-Markable - {bd55172e-59c1-4a93-b19c-633f0d7790ad} - C:\Program Files (x86)\Re-Markable\150.dll ()

Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)

Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml

FF SearchEngineOrder.1: Ask.com

FF Extension: click-n-mark-5 - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com [2014-01-29]

FF Extension: Websteroids - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\support@websteroidsapp.com [2014-01-09]

FF Extension: Amazon 1Button App for Firefox - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\abb@amazon.com.xpi [2013-09-04]

FF Extension: GutscheinCodes.de GutscheinFinder - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi [2013-07-12]

FF Extension: No Name - C:\Program Files (x86)\Re-Markable\150.xpi [2014-01-03]

C:\Program Files (x86)\click-n-mark-5

C:\Program Files (x86)\Feven 2.2

C:\Program Files (x86)\AskPartnerNetwork

C:\Program Files\Conduit

C:\Program Files (x86)\Re-Markable

C:\Users\Holger-PC\Downloads\*.exe

C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhbagplpkkoeifmpmpdaieomnggppmo

C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiiggndjhacnnhnhmaljgbgcaneehld

C:\Program Files (x86)\Re-Markable\150.crx

C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork

C:\windows\System32\Tasks\Re-Markable Update

C:\Users\Public\AlexaNSISPlugin.8188.dll

         

*****************
 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411511182} => Key deleted successfully.

HKCR\CLSID\{11111111-1111-1111-1111-110411511182} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411901112} => Key deleted successfully.

HKCR\CLSID\{11111111-1111-1111-1111-110411901112} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7} => Key deleted successfully.

HKCR\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93DBF2BB-A2B3-4683-A92E-57E60751F346} => Key deleted successfully.

HKCR\CLSID\{93DBF2BB-A2B3-4683-A92E-57E60751F346} => Key deleted successfully.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bd55172e-59c1-4a93-b19c-633f0d7790ad} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{bd55172e-59c1-4a93-b19c-633f0d7790ad} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-00A7-7A786E7484D7} => Value deleted successfully.

HKCR\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-00A7-7A786E7484D7} => Value deleted successfully.

HKCR\Wow6432Node\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{41564952-412D-5637-00A7-7A786E7484D7} => Value deleted successfully.

HKCR\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} => Key not found.

HKCR\PROTOCOLS\Filter\application/x-mfe-ipt => Key deleted successfully.

HKCR\CLSID\{3EF5086B-5478-4598-A054-786C45D75692} => Key not found.

HKCR\Wow6432Node\PROTOCOLS\Filter\application/x-mfe-ipt => Key not found.

HKCR\Wow6432Node\CLSID\{3EF5086B-5478-4598-A054-786C45D75692} => Key not found.

C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nation-secure-search.xml => Moved successfully.

Firefox SearchEngineOrder.1 deleted successfully.

C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\7b2e05c3-4f6b-4f31-b7ed-1d6bf9639e5d@33ff3dbe-011c-4bda-9fc4-a47387c00171.com => Moved successfully.

C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\support@websteroidsapp.com => Moved successfully.

C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\abb@amazon.com.xpi => Moved successfully.

C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\Extensions\jid0-hjoQNmABq6jg91jHpQyvgJUouUP@jetpack.xpi => Moved successfully.

C:\Program Files (x86)\Re-Markable\150.xpi => Moved successfully.

"C:\Program Files (x86)\click-n-mark-5" => File/Directory not found.

"C:\Program Files (x86)\Feven 2.2" => File/Directory not found.

C:\Program Files (x86)\AskPartnerNetwork => Moved successfully.

"C:\Program Files\Conduit" => File/Directory not found.

C:\Program Files (x86)\Re-Markable => Moved successfully.

C:\Users\Holger-PC\Downloads\*.exe => Moved successfully.

C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhbagplpkkoeifmpmpdaieomnggppmo => Moved successfully.

C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgiiggndjhacnnhnhmaljgbgcaneehld => Moved successfully.

"C:\Program Files (x86)\Re-Markable\150.crx" => File/Directory not found.

C:\Users\Holger-PC\AppData\Local\AskPartnerNetwork => Moved successfully.

C:\windows\System32\Tasks\Re-Markable Update => Moved successfully.

C:\Users\Public\AlexaNSISPlugin.8188.dll => Moved successfully.
 

==== End of Fixlog ====

Frische FRST Logs büdde :D

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014

Ran by Holger-PC (administrator) on HOLGER on 29-01-2014 16:46:45

Running from C:\Users\Holger-PC\Downloads\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

() C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe

() C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe

(The OpenVPN Project) C:\Program Files (x86)\OpenVPN\bin\openvpn.exe

(Spotify Ltd) C:\Users\Holger-PC\AppData\Roaming\Spotify\spotify.exe

() C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

() C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoViewOnDrive] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKLM\...\Policies\Explorer: [NoFind] 0

HKLM\...\Policies\Explorer: [NoFile] 0

HKLM\...\Policies\Explorer: [HideClock] 0

HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0

HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKLM\...\Policies\Explorer: [NoSetTaskbar] 0

HKLM\...\Policies\Explorer: [NoDeletePrinter] 0

HKLM\...\Policies\Explorer: [NoDFSTab] 0

HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0

HKLM\...\Policies\Explorer: [NoLogoff] 0

HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0

HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0

HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKLM\...\Policies\Explorer: [NoResolveSearch] 0

HKLM\...\Policies\Explorer: [NoSaveSettings] 0

HKLM\...\Policies\Explorer: [NoHardwareTab] 0

HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKLM\...\Policies\Explorer: [NoDesktop] 0

HKCU\...\Run: [Spotify Web Helper] - C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-20] (Spotify Ltd)

HKCU\...\Policies\system: [DisableCMD] 0

HKCU\...\Policies\system: [NoDispAppearancePage] 0

HKCU\...\Policies\system: [NoDispBackgroundPage] 0

HKCU\...\Policies\system: [NoDispSettingsPage] 0

HKCU\...\Policies\Explorer: [NoViewOnDrive] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKCU\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKCU\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000

HKCU\...\Policies\Explorer: [NoFile] 0

HKCU\...\Policies\Explorer: [NoTrayContextMenu] 0

HKCU\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKCU\...\Policies\Explorer: [NoSetTaskbar] 0

HKCU\...\Policies\Explorer: [NoDeletePrinter] 0

HKCU\...\Policies\Explorer: [NoDFSTab] 0

HKCU\...\Policies\Explorer: [NoChangeStartMenu] 0

HKCU\...\Policies\Explorer: [NoWindowsUpdate] 0

HKCU\...\Policies\Explorer: [NoEncryptOnMove] 0

HKCU\...\Policies\Explorer: [NoResolveSearch] 0

HKCU\...\Policies\Explorer: [NoSaveSettings] 0

HKCU\...\Policies\Explorer: [NoHardwareTab] 0

HKCU\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\Administrator\...\Run: [] - [x]

Startup: C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = 

BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 132.231.221.253
 

FireFox:

========

FF ProfilePath: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default

FF SelectedSearchEngine: Google

FF Homepage: www.sz.de

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()

FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( )

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Widget context - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-14]

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-11-26]

FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

FF HKCU\...\Firefox\Extensions: [{cb1bb3bd-8ce0-4d26-98c4-99f6415a6002}] - C:\Program Files (x86)\Re-Markable\150.xpi
 

Chrome: 

=======

CHR Extension: (Widget context) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-14]

CHR HKLM-x32\...\Chrome\Extension: [ejdfidgapfiokiphmcjpmmjbdndepoja] - C:\Program Files (x86)\Re-Markable\150.crx [2014-01-14]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

U2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)

U2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-07-16] (Freemake)

U2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

U2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

U3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)

U3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)

U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

U2 APNMCP; "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe" [x]

U3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [x]
 

==================== Drivers (Whitelisted) ====================
 

U2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)

U1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-22] (Avira Operations GmbH & Co. KG)

U2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-19] (Avira Operations GmbH & Co. KG)

U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

U3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

U3 mbamchameleon; C:\windows\system32\drivers\mbamchameleon.sys [89304 2014-01-21] (Malwarebytes Corporation)

U3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)

U2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

U3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

U3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )

U3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

U3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

U0 SR; 

U2 srservice; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-29 16:02 - 2014-01-29 16:02 - 00000358 _____ C:\windows\PFRO.log

2014-01-29 14:19 - 2014-01-29 14:27 - 00000000 ____D C:\AdwCleaner

2014-01-29 13:04 - 2014-01-29 13:16 - 00023212 _____ C:\windows\WindowsUpdate.log

2014-01-28 00:22 - 2014-01-28 00:24 - 00137180 _____ C:\Users\Holger-PC\Downloads\hosts.zip

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D C:\Program Files (x86)\ESET

2014-01-24 16:02 - 2014-01-24 16:30 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 20:31 - 2014-01-19 08:33 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-21 11:51 - 2014-01-21 16:57 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:17 - 2014-01-21 02:34 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:13 - 2014-01-29 16:46 - 00000000 ____D C:\FRST

2014-01-21 00:13 - 2014-01-21 00:14 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:13 - 2014-01-21 00:14 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-01-17 14:14 - 2014-01-17 14:35 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-15 21:40 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll

2014-01-15 21:40 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\MPSSVC.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\windows\SysWOW64\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mpsdrv.sys

2014-01-15 21:40 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll

2014-01-15 21:40 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll

2014-01-15 21:40 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys

2014-01-15 21:40 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2014-01-15 21:40 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2014-01-15 21:40 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2014-01-15 21:40 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 19:20 - 2014-01-20 22:52 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-09 11:33 - 2014-01-20 22:30 - 00000000 ____D C:\ProgramData\Updater

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-07 21:06 - 2014-01-09 18:49 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-07 20:39 - 2014-01-10 19:57 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-03 14:58 - 2014-01-29 16:03 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:19 - 2013-12-30 18:20 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
 

==================== One Month Modified Files and Folders =======
 

2014-01-29 16:46 - 2014-01-21 00:13 - 00000000 ____D C:\FRST

2014-01-29 16:32 - 2013-07-11 12:40 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Spotify

2014-01-29 16:25 - 2013-09-30 09:30 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2014-01-29 16:03 - 2014-01-03 14:58 - 00000416 _____ C:\windows\Tasks\Re-Markable Update.job

2014-01-29 16:03 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT

2014-01-29 16:02 - 2014-01-29 16:02 - 00000358 _____ C:\windows\PFRO.log

2014-01-29 16:02 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI

2014-01-29 16:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru

2014-01-29 14:27 - 2014-01-29 14:19 - 00000000 ____D C:\AdwCleaner

2014-01-29 13:16 - 2014-01-29 13:04 - 00023212 _____ C:\windows\WindowsUpdate.log

2014-01-28 00:24 - 2014-01-28 00:22 - 00137180 _____ C:\Users\Holger-PC\Downloads\hosts.zip

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D C:\Program Files (x86)\ESET

2014-01-26 19:33 - 2013-07-11 12:41 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\Spotify

2014-01-26 01:58 - 2013-07-11 11:48 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2413837752-2537467696-3434217499-1001

2014-01-26 01:44 - 2013-07-11 10:29 - 00001014 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-01-24 16:30 - 2014-01-24 16:02 - 109707566 _____ C:\Users\Holger-PC\Downloads\84193937629346864.rar

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iTunes

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D C:\Program Files\iPod

2014-01-23 18:29 - 2013-07-18 13:49 - 00000000 ____D C:\ProgramData\Apple

2014-01-22 14:33 - 2014-01-22 14:33 - 00000000 ____D C:\windows\ERUNT

2014-01-21 16:57 - 2014-01-21 11:51 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-21 02:34 - 2014-01-21 02:17 - 133162906 _____ C:\Users\Holger-PC\Downloads\A_AP_R-LongLi-Del_Edi.rar

2014-01-21 00:23 - 2013-07-11 10:24 - 00000000 ____D C:\Users\Holger-PC

2014-01-21 00:14 - 2014-01-21 00:13 - 00042225 _____ C:\Users\Holger-PC\Downloads\FRST.txt

2014-01-21 00:14 - 2014-01-21 00:13 - 00016048 _____ C:\Users\Holger-PC\Downloads\Addition.txt

2014-01-21 00:00 - 2014-01-21 00:00 - 00000480 _____ C:\Users\Holger-PC\Downloads\defogger_disable.log

2014-01-21 00:00 - 2014-01-21 00:00 - 00000000 _____ C:\Users\Holger-PC\defogger_reenable

2014-01-20 22:52 - 2014-01-11 19:20 - 00000000 ____D C:\Program Files (x86)\AmiExt

2014-01-20 22:30 - 2014-01-09 11:33 - 00000000 ____D C:\ProgramData\Updater

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-19 08:33 - 2014-01-21 20:31 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-17 14:59 - 2013-10-27 12:18 - 00768688 _____ C:\windows\system32\perfh019.dat

2014-01-17 14:59 - 2013-10-27 12:18 - 00157826 _____ C:\windows\system32\perfc019.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat

2014-01-17 14:59 - 2012-07-26 08:28 - 02671956 _____ C:\windows\system32\PerfStringBackup.INI

2014-01-17 14:35 - 2014-01-17 14:14 - 105901979 _____ C:\Users\Holger-PC\Downloads\Dinosaur_Jr__-_I_Bet_On_Sky_(2012)_320.part1.rar

2014-01-16 19:47 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache

2014-01-16 18:53 - 2013-08-09 14:37 - 00000000 ____D C:\windows\system32\MRT

2014-01-16 18:53 - 2012-07-26 09:12 - 00000000 ____D C:\windows\WinStore

2014-01-16 18:51 - 2013-07-12 21:14 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-01-14 20:28 - 2013-07-11 10:30 - 00000000 ___RD C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-13 16:21 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent

2014-01-13 13:44 - 2013-10-04 15:05 - 00000000 ____D C:\Users\Holger-PC\Music\Documents\Studium

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-11 16:37 - 2013-12-12 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2014-01-10 19:57 - 2014-01-07 20:39 - 00000594 _____ C:\Users\Holger-PC\daemonprocess.txt

2014-01-10 14:49 - 2013-12-19 05:49 - 00000082 _____ C:\Users\Holger-PC\AppData\Roaming\WB.CFG

2014-01-09 18:49 - 2014-01-07 21:06 - 00004393 _____ C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-09 09:02 - 2013-11-14 18:05 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-01-09 09:02 - 2013-11-14 18:05 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D C:\Users\Holger-PC\SyncFolder

2014-01-07 20:15 - 2012-11-07 21:48 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games

2014-01-07 19:52 - 2013-08-09 18:16 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\WildTangent

2014-01-07 19:52 - 2012-11-07 21:48 - 00000000 ____D C:\ProgramData\WildTangent

2014-01-03 14:58 - 2014-01-03 14:58 - 00001240 _____ C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk

2013-12-30 18:21 - 2013-10-02 14:36 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

2013-12-30 18:20 - 2013-12-30 18:20 - 00001451 _____ C:\Users\Public\Desktop\Free YouTube Download.lnk

2013-12-30 18:20 - 2013-12-30 18:20 - 00001254 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Users\Holger-PC\AppData\Roaming\DVDVideoSoft

2013-12-30 18:20 - 2013-12-30 18:19 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
 

Some content of TEMP:

====================

C:\Users\Holger-PC\AppData\Local\Temp\avgnt.exe

C:\Users\Holger-PC\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-27 20:22
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014

Ran by Holger-PC at 2014-01-29 16:47:07

Running from C:\Users\Holger-PC\Downloads\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC) Hidden

Apple Application Support (x32 Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)

AVG 2014 (Version: 14.0.3604 - AVG Technologies) Hidden

Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)

Avira SearchFree Toolbar (x32 Version: 12.10.0.2949 - APN, LLC)

AVS Audio Converter 7 (x32 Version: 7.2.1.528 - Online Media Technologies Ltd.)

Bonjour (Version: 3.0.0.10 - Apple Inc.)

CCleaner (Version: 4.08 - Piriform)

Citavi 4 (x32 Version: 4.2.0.11 - Swiss Academic Software)

DMUninstaller (x32 Version:  - )

ESET Online Scanner v3 (x32 Version:  - )

Exact Audio Copy 1.0beta3 (x32 Version: 1.0beta3 - Andre Wiethoff)

Free YouTube Download version 3.2.19.1219 (x32 Version: 3.2.19.1219 - DVDVideoSoft Ltd.)

Free Zip Opener (x32 Version: 1.0 - Tripro Limited)

Freemake Audio Converter Version 1.1.0 (x32 Version: 1.1.0 - Ellora Assets Corporation)

Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION

Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)

Intel AppUp(SM) center (x32 Version: 3.6.1.33268.15 - Intel)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION

iTunes (Version: 11.1.4.62 - Apple Inc.)

Lightspark 0.5.3-git (x32 Version: 0.5.3-git - Lightspark Team)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft Office (x32 Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft Silverlight (x32 Version: 4.0.60310.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

Nero 12 Essentials Toshiba (x32 Version: 12.0.00400 - Nero AG)

Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden

Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)

OpenVPN 2.3.2 UniPassau (x32 Version: 2.3.2 - )

PC Speed Maximizer v3.1 (x32 Version: 3.1 - Smart PC Solutions)

Premium Sound HD (Version: 1.12.4600 - SRS Labs, Inc.)

Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp) Hidden

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6687 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (x32 Version: 2.00.0020 - REALTEK Semiconductor Corp.)

Re-Markable (x32 Version:  - Re-Markable Software)

Shared C Run-time for x64 (Version: 10.0.0 - McAfee)

Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)

Synaptics Pointing Device Driver (Version: 16.2.10.3 - Synaptics Incorporated)

TAP-Windows 9.9.2 (Version: 9.9.2 - )

TOSHIBA Desktop Assist (Version: 1.00.0007.00002 - Toshiba Corporation)

TOSHIBA eco Utility (Version: 2.0.0.6415 - Toshiba Corporation)

TOSHIBA Function Key (Version: 1.00.6425 - Toshiba Corporation)

TOSHIBA Manuals (x32 Version: 10.10 - TOSHIBA)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden

TOSHIBA PC Health Monitor (Version: 1.8.17.640104 - Toshiba Corporation)

Toshiba Places Icon Utility (Version: 2.1.1 - TOSHIBA)

TOSHIBA Recovery Media Creator (x32 Version: 2.2.0.54043005 - Toshiba Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00 - TOSHIBA Corporation)

TOSHIBA Service Station (Version: 2.4.4 - TOSHIBA)

TOSHIBA System Driver (x32 Version: 1.00.0012 - Toshiba Corporation)

TOSHIBA System Settings (x32 Version: 1.00.0002.32002 - Toshiba Corporation)

Toshiba TEMPRO (x32 Version: 4.2.1 - Toshiba Europe GmbH)

TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A - Toshiba Corporation)

Updater (x32 Version: 2.6.53 - Creative Island Media, LLC)

Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VisualBee for Microsoft PowerPoint (HKCU Version: V4.1 - VisualBee.com)

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden

Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3 - Realtek Semiconductor Corp.)

WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
 

==================== Restore Points  =========================
 

09-01-2014 10:33:40 Uniblue SpeedUpMyPC installation

16-01-2014 17:35:48 Windows Update

21-01-2014 19:55:14 Installed iTunes

26-01-2014 00:58:19 Windows Update
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {00C107C2-027E-4224-83B4-754CDD462CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-08-14] (Toshiba Europe GmbH)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {2807D834-4937-49CF-ABDE-3E9AD3CBDB68} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)

Task: {3C34E352-D102-4B2E-A790-FC5D6226257D} - \Re-Markable Update No Task File

Task: {411A5387-5618-4EE2-A0D0-8ECC6EF5C97B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {4DEAF078-4D55-4C04-8165-FD15AB799510} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)

Task: {7B4A55C2-0879-44B1-A6BF-1F593C7656A7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)

Task: {84962D8B-E8A6-4638-A2C9-DB0ABE38826C} - \EPUpdater No Task File

Task: {92FA85CF-6EAE-4B68-9422-55CA63A44942} - \Desk 365 RunAsStdUser No Task File

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {F6C11617-6D62-4525-91D5-00D4CDA3557C} - \LaunchApp No Task File

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\Re-Markable Update.job => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-07-18 14:22 - 2010-12-29 12:24 - 00120320 _____ () C:\Program Files (x86)\Free Zip Opener\contmenu_x64.dll

2013-07-07 22:38 - 2013-07-07 22:39 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll

2013-12-07 18:49 - 2013-11-22 12:01 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-11-07 21:27 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00161992 _____ () C:\Program Files (x86)\OpenVPN\bin\liblzo2-2.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00107720 _____ () C:\Program Files (x86)\OpenVPN\bin\libpkcs11-helper-1.dll

2013-07-11 12:41 - 2014-01-20 23:02 - 36967424 _____ () C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\libcef.dll

2014-01-11 16:37 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Could not start eventlog service, could not read events.
 

Der angeforderte Dienst wurde bereits gestartet.
 

Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 2182 eingeben.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 38%

Total physical RAM: 3979.21 MB

Available physical RAM: 2449.29 MB

Total Pagefile: 5963.21 MB

Available Pagefile: 4088.12 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (TI30992300A) (Fixed) (Total:455.29 GB) (Free:220.32 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type

==================== End Of Log ============================

Besser :daumenhoc
Rechner nun ok?

Ich glaube schon! Vielen, vielen Dank schonmal. Aber ich möchte, das mir sowas nicht nochmal passiert, also noch die Frage, was ich noch machen kann ausser des mit den Host files um so etwas zu verhindern ;)

Die Hostsdatei verhindert sowas auch nicht!
In erster Linie musst du mitdenken und nicht einfach wahllos einfach von irgendwo oder dem erstbesten Sichergebnis die gesuchte Software runterladen! Und niemals bei Programmsetups die Expressmethode wählen, IMMER beneutzerdefniert, damit du Müll wie Toolbars und anderes Schrott abwählen kannst!

Dann wären wir durch! :daumenhoc

Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden.

Helfen kann dir dabei delfix:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

ok, da sind auch unbekannte Plugins bei. Löschen oder suchen?

Und anscheinend ist da noch immer was. Es ist zwar nicht mehr viel, aber es öffnet sich immer noch ein bisl Werbung. Oh man sry :/

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014

Ran by Holger-PC (administrator) on HOLGER on 05-02-2014 17:37:32

Running from C:\Users\Holger-PC\Downloads\Desktop

Windows 8 (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

() C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe

(The OpenVPN Project) C:\Program Files (x86)\OpenVPN\bin\openvpn.exe

(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe

(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [X]

HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()

HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.)

HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba)

HKLM-x32\...\Run: [TPUReg(x86)] - "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes

HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation)

HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoViewOnDrive] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKLM\...\Policies\Explorer: [NoFind] 0

HKLM\...\Policies\Explorer: [NoFile] 0

HKLM\...\Policies\Explorer: [HideClock] 0

HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0

HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKLM\...\Policies\Explorer: [NoSetTaskbar] 0

HKLM\...\Policies\Explorer: [NoDeletePrinter] 0

HKLM\...\Policies\Explorer: [NoDFSTab] 0

HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0

HKLM\...\Policies\Explorer: [NoLogoff] 0

HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0

HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0

HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0

HKLM\...\Policies\Explorer: [NoResolveSearch] 0

HKLM\...\Policies\Explorer: [NoSaveSettings] 0

HKLM\...\Policies\Explorer: [NoHardwareTab] 0

HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKLM\...\Policies\Explorer: [NoDesktop] 0

HKU\.DEFAULT\...\Policies\system: [DisableCMD] 0

HKU\.DEFAULT\...\Policies\system: [NoDispAppearancePage] 0

HKU\.DEFAULT\...\Policies\system: [NoDispBackgroundPage] 0

HKU\.DEFAULT\...\Policies\system: [NoDispSettingsPage] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoViewOnDrive] 0

HKU\.DEFAULT\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKU\.DEFAULT\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKU\.DEFAULT\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKU\.DEFAULT\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoFile] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoTrayContextMenu] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoSetTaskbar] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoDeletePrinter] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoDFSTab] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoChangeStartMenu] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoWindowsUpdate] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoEncryptOnMove] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoResolveSearch] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoSaveSettings] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoHardwareTab] 0

HKU\.DEFAULT\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\S-1-5-19\...\Policies\system: [DisableCMD] 0

HKU\S-1-5-19\...\Policies\system: [NoDispAppearancePage] 0

HKU\S-1-5-19\...\Policies\system: [NoDispBackgroundPage] 0

HKU\S-1-5-19\...\Policies\system: [NoDispSettingsPage] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoViewOnDrive] 0

HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoFile] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoTrayContextMenu] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoSetTaskbar] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoDeletePrinter] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoDFSTab] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoChangeStartMenu] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoWindowsUpdate] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoEncryptOnMove] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoResolveSearch] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoSaveSettings] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoHardwareTab] 0

HKU\S-1-5-19\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\S-1-5-20\...\Policies\system: [DisableCMD] 0

HKU\S-1-5-20\...\Policies\system: [NoDispAppearancePage] 0

HKU\S-1-5-20\...\Policies\system: [NoDispBackgroundPage] 0

HKU\S-1-5-20\...\Policies\system: [NoDispSettingsPage] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoViewOnDrive] 0

HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoFile] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoTrayContextMenu] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoSetTaskbar] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoDeletePrinter] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoDFSTab] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoChangeStartMenu] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoWindowsUpdate] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoEncryptOnMove] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoResolveSearch] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoSaveSettings] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoHardwareTab] 0

HKU\S-1-5-20\...\Policies\Explorer: [NoStartMenuSubFolders] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Run: [Spotify Web Helper] - C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-20] (Spotify Ltd)

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\system: [DisableCMD] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\system: [NoDispAppearancePage] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\system: [NoDispBackgroundPage] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\system: [NoDispSettingsPage] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoViewOnDrive] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [DisableLocalMachineRun] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [DisableCurrentUserRun] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoFile] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoTrayContextMenu] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoDevMgrUpdate] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoSetTaskbar] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoDeletePrinter] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoDFSTab] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoChangeStartMenu] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoWindowsUpdate] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoEncryptOnMove] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoResolveSearch] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoSaveSettings] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoHardwareTab] 0

HKU\S-1-5-21-2413837752-2537467696-3434217499-1001\...\Policies\Explorer: [NoStartMenuSubFolders] 0

Startup: C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
 

==================== Internet (Whitelisted) ====================
 

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 

SearchScopes: HKLM - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKLM-x32 - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS

SearchScopes: HKCU - {02BDC8D2-198F-4D6D-B4F0-274AA878B635} URL = 

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File

BHO-x32: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 132.231.51.4 132.231.1.24
 

FireFox:

========

FF ProfilePath: C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default

FF SelectedSearchEngine: Google

FF Homepage: www.sz.de

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( )

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: Widget context - C:\Users\Holger-PC\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-14]

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013-11-26]

FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff

FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []

FF HKCU\...\Firefox\Extensions: [{cb1bb3bd-8ce0-4d26-98c4-99f6415a6002}] - C:\Program Files (x86)\Re-Markable\150.xpi
 

Chrome: 

=======

CHR Extension: (Widget context) - C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-14]

CHR HKLM-x32\...\Chrome\Extension: [ejdfidgapfiokiphmcjpmmjbdndepoja] - C:\Program Files (x86)\Re-Markable\150.crx [2014-01-14]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-22] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)

R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-07-16] (Freemake)

R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)

S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [32568 2013-08-22] (The OpenVPN Project)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-08-14] (Toshiba Europe GmbH)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

S2 APNMCP; "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe" [X]

S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-22] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [84720 2013-12-19] (Avira Operations GmbH & Co. KG)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

S3 mbamchameleon; C:\windows\system32\drivers\mbamchameleon.sys [89304 2014-01-21] (Malwarebytes Corporation)

S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwNe64.sys [11400192 2012-06-02] (Intel Corporation)

R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)

R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1496720 2012-08-13] (Realtek Semiconductor Corporation                           )

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)

S0 SR; 

S2 srservice; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-02-05 17:37 - 2014-02-05 17:37 - 00000000 ____D () C:\FRST

2014-01-30 13:59 - 2014-01-30 13:59 - 00000000 _____ () C:\Users\Holger-PC\Downloads\Archive_Sitzung__am_27.01.2014.zip

2014-01-29 18:35 - 2014-01-29 18:34 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe

2014-01-29 18:35 - 2014-01-29 18:34 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe

2014-01-29 18:35 - 2014-01-29 18:34 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe

2014-01-29 18:35 - 2014-01-29 18:34 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll

2014-01-29 18:34 - 2014-01-29 18:34 - 00000000 ____D () C:\Program Files\Java

2014-01-29 18:29 - 2014-01-29 18:35 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-29 18:17 - 2014-01-29 18:17 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-01-29 18:17 - 2014-01-29 18:17 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-01-29 18:04 - 2014-01-29 18:04 - 00000000 ____D () C:\Program Files\Tracker Software

2014-01-29 17:48 - 2014-01-29 17:50 - 00001416 _____ () C:\DelFix.txt

2014-01-29 16:02 - 2014-01-29 16:02 - 00000358 _____ () C:\windows\PFRO.log

2014-01-29 13:04 - 2014-02-05 14:28 - 00502488 _____ () C:\windows\WindowsUpdate.log

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D () C:\Program Files\iTunes

2014-01-23 18:32 - 2014-01-23 18:33 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D () C:\Program Files\iPod

2014-01-22 14:33 - 2014-01-29 17:48 - 00000000 ____D () C:\windows\ERUNT

2014-01-21 20:31 - 2014-01-19 08:33 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-21 11:51 - 2014-01-21 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D () C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-20 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-01-15 21:40 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll

2014-01-15 21:40 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll

2014-01-15 21:40 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\MPSSVC.dll

2014-01-15 21:40 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\windows\SysWOW64\FirewallAPI.dll

2014-01-15 21:40 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mpsdrv.sys

2014-01-15 21:40 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll

2014-01-15 21:40 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll

2014-01-15 21:40 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\disk.sys

2014-01-15 21:40 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2014-01-15 21:40 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2014-01-15 21:40 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2014-01-15 21:40 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D () C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 19:20 - 2014-01-20 22:52 - 00000000 ____D () C:\Program Files (x86)\AmiExt

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-09 11:33 - 2014-01-20 22:30 - 00000000 ____D () C:\ProgramData\Updater

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D () C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-07 21:06 - 2014-01-09 18:49 - 00004393 _____ () C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-07 20:39 - 2014-01-10 19:57 - 00000594 _____ () C:\Users\Holger-PC\daemonprocess.txt

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D () C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D () C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D () C:\Users\Holger-PC\SyncFolder
 

==================== One Month Modified Files and Folders =======
 

2014-02-05 17:37 - 2014-02-05 17:37 - 00000000 ____D () C:\FRST

2014-02-05 17:33 - 2013-07-11 11:48 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2413837752-2537467696-3434217499-1001

2014-02-05 17:28 - 2014-01-03 14:58 - 00000416 _____ () C:\windows\Tasks\Re-Markable Update.job

2014-02-05 17:28 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\sru

2014-02-05 16:35 - 2013-07-11 12:40 - 00000000 ____D () C:\Users\Holger-PC\AppData\Roaming\Spotify

2014-02-05 16:25 - 2013-09-30 09:30 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job

2014-02-05 15:54 - 2013-07-11 12:41 - 00000000 ____D () C:\Users\Holger-PC\AppData\Local\Spotify

2014-02-05 14:28 - 2014-01-29 13:04 - 00502488 _____ () C:\windows\WindowsUpdate.log

2014-02-05 12:57 - 2012-07-26 08:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-02-05 12:57 - 2012-07-26 06:26 - 00262144 ___SH () C:\windows\system32\config\BBI

2014-02-04 20:25 - 2013-09-30 09:30 - 00003772 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater

2014-02-04 17:00 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\AUInstallAgent

2014-02-02 12:00 - 2013-10-04 15:05 - 00000000 ____D () C:\Users\Holger-PC\Music\Documents\Studium

2014-01-30 22:10 - 2013-11-14 18:05 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2014-01-30 22:10 - 2013-11-14 18:05 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-01-30 13:59 - 2014-01-30 13:59 - 00000000 _____ () C:\Users\Holger-PC\Downloads\Archive_Sitzung__am_27.01.2014.zip

2014-01-29 18:35 - 2014-01-29 18:29 - 00000000 ____D () C:\ProgramData\Oracle

2014-01-29 18:34 - 2014-01-29 18:35 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe

2014-01-29 18:34 - 2014-01-29 18:35 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe

2014-01-29 18:34 - 2014-01-29 18:35 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe

2014-01-29 18:34 - 2014-01-29 18:35 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll

2014-01-29 18:34 - 2014-01-29 18:34 - 00000000 ____D () C:\Program Files\Java

2014-01-29 18:17 - 2014-01-29 18:17 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-01-29 18:17 - 2014-01-29 18:17 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-01-29 18:15 - 2013-07-11 14:07 - 00000000 ____D () C:\Users\Holger-PC\AppData\Local\Adobe

2014-01-29 18:04 - 2014-01-29 18:04 - 00000000 ____D () C:\Program Files\Tracker Software

2014-01-29 17:50 - 2014-01-29 17:48 - 00001416 _____ () C:\DelFix.txt

2014-01-29 17:48 - 2014-01-22 14:33 - 00000000 ____D () C:\windows\ERUNT

2014-01-29 17:47 - 2013-07-11 10:24 - 00000000 ____D () C:\Users\Holger-PC

2014-01-29 16:02 - 2014-01-29 16:02 - 00000358 _____ () C:\windows\PFRO.log

2014-01-27 12:17 - 2014-01-27 12:17 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-01-26 01:44 - 2013-07-11 10:29 - 00001014 _____ () C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-01-23 18:33 - 2014-01-23 18:33 - 00001754 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D () C:\Program Files\iTunes

2014-01-23 18:33 - 2014-01-23 18:32 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-01-23 18:32 - 2014-01-23 18:32 - 00000000 ____D () C:\Program Files\iPod

2014-01-23 18:29 - 2013-07-18 13:49 - 00000000 ____D () C:\ProgramData\Apple

2014-01-21 16:57 - 2014-01-21 11:51 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-21 10:58 - 2014-01-21 10:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-01-20 22:52 - 2014-01-11 19:20 - 00000000 ____D () C:\Program Files (x86)\AmiExt

2014-01-20 22:30 - 2014-01-09 11:33 - 00000000 ____D () C:\ProgramData\Updater

2014-01-20 20:39 - 2014-01-20 20:39 - 00000000 ____D () C:\Users\Holger-PC\AppData\Roaming\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00001084 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-01-20 20:38 - 2014-01-20 20:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-01-19 08:33 - 2014-01-21 20:31 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

2014-01-17 14:59 - 2013-10-27 12:18 - 00768688 _____ () C:\windows\system32\perfh019.dat

2014-01-17 14:59 - 2013-10-27 12:18 - 00157826 _____ () C:\windows\system32\perfc019.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00753134 _____ () C:\windows\system32\perfh007.dat

2014-01-17 14:59 - 2012-08-01 17:38 - 00155826 _____ () C:\windows\system32\perfc007.dat

2014-01-17 14:59 - 2012-07-26 08:28 - 02671956 _____ () C:\windows\system32\PerfStringBackup.INI

2014-01-16 19:47 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\rescache

2014-01-16 18:53 - 2013-08-09 14:37 - 00000000 ____D () C:\windows\system32\MRT

2014-01-16 18:53 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\WinStore

2014-01-16 18:51 - 2013-07-12 21:14 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-01-14 20:28 - 2013-07-11 10:30 - 00000000 ___RD () C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-01-11 19:21 - 2014-01-11 19:21 - 00000000 ____D () C:\Program Files (x86)\Lightspark 0.5.3-git

2014-01-11 16:37 - 2014-01-11 16:37 - 00001122 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-01-11 16:37 - 2014-01-11 16:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-01-11 16:37 - 2013-12-12 15:20 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-01-10 19:57 - 2014-01-07 20:39 - 00000594 _____ () C:\Users\Holger-PC\daemonprocess.txt

2014-01-10 14:49 - 2013-12-19 05:49 - 00000082 _____ () C:\Users\Holger-PC\AppData\Roaming\WB.CFG

2014-01-09 18:49 - 2014-01-07 21:06 - 00004393 _____ () C:\Users\Holger-PC\AppData\Local\Citavi Picker Internet Explorer Protocol.txt

2014-01-09 11:33 - 2014-01-09 11:33 - 00000000 ____D () C:\Users\Holger-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D () C:\Users\Holger-PC\AppData\Local\cache

2014-01-07 20:39 - 2014-01-07 20:39 - 00000000 ____D () C:\Users\Holger-PC\.android

2014-01-07 20:23 - 2014-01-07 20:23 - 00000000 ____D () C:\Users\Holger-PC\SyncFolder

2014-01-07 20:15 - 2012-11-07 21:48 - 00000000 ____D () C:\Program Files (x86)\TOSHIBA Games

2014-01-07 19:52 - 2013-08-09 18:16 - 00000000 ____D () C:\Users\Holger-PC\AppData\Roaming\WildTangent

2014-01-07 19:52 - 2012-11-07 21:48 - 00000000 ____D () C:\ProgramData\WildTangent
 

Some content of TEMP:

====================

C:\Users\Holger-PC\AppData\Local\Temp\avgnt.exe

C:\Users\Holger-PC\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-27 20:22
 

==================== End Of Log ============================

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2014

Ran by Holger-PC at 2014-02-05 17:38:26

Running from C:\Users\Holger-PC\Downloads\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 3.8.0.1430 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC)

Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC) Hidden

Apple Application Support (x32 Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)

AVG 2014 (Version: 14.0.3604 - AVG Technologies) Hidden

Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)

Avira SearchFree Toolbar (x32 Version: 12.10.0.2949 - APN, LLC)

AVS Audio Converter 7 (x32 Version: 7.2.1.528 - Online Media Technologies Ltd.)

Bonjour (Version: 3.0.0.10 - Apple Inc.)

CCleaner (Version: 4.08 - Piriform)

Citavi 4 (x32 Version: 4.2.0.11 - Swiss Academic Software)

DMUninstaller (x32 Version:  - )

ESET Online Scanner v3 (x32 Version:  - )

Exact Audio Copy 1.0beta3 (x32 Version: 1.0beta3 - Andre Wiethoff)

Free YouTube Download version 3.2.19.1219 (x32 Version: 3.2.19.1219 - DVDVideoSoft Ltd.)

Free Zip Opener (x32 Version: 1.0 - Tripro Limited)

Freemake Audio Converter Version 1.1.0 (x32 Version: 1.1.0 - Ellora Assets Corporation)

Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION

Happy Cloud Client (HKCU Version: 3.41 - Happy Cloud, Inc.)

Intel AppUp(SM) center (x32 Version: 3.6.1.33268.15 - Intel)

Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)

Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)

Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001 - Intel Corporation)

Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)

Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden

Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION

iTunes (Version: 11.1.4.62 - Apple Inc.)

Java 7 Update 51 (64-bit) (Version: 7.0.510 - Oracle)

Lightspark 0.5.3-git (x32 Version: 0.5.3-git - Lightspark Team)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft Office (x32 Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)

Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)

Nero 12 Essentials Toshiba (x32 Version: 12.0.00400 - Nero AG)

Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden

Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden

Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden

Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden

Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden

Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden

Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden

Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden

Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden

Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden

Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden

Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden

Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden

OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)

OpenVPN 2.3.2 UniPassau (x32 Version: 2.3.2 - )

PC Speed Maximizer v3.1 (x32 Version: 3.1 - Smart PC Solutions)

PDF-Viewer (Version: 2.5.214.0 - Tracker Software Products Ltd)

Premium Sound HD (Version: 1.12.4600 - SRS Labs, Inc.)

Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp)

Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp) Hidden

Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6687 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (x32 Version: 2.00.0020 - REALTEK Semiconductor Corp.)

Re-Markable (x32 Version:  - Re-Markable Software)

Shared C Run-time for x64 (Version: 10.0.0 - McAfee)

Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)

Synaptics Pointing Device Driver (Version: 16.2.10.3 - Synaptics Incorporated)

TAP-Windows 9.9.2 (Version: 9.9.2 - )

TOSHIBA Desktop Assist (Version: 1.00.0007.00002 - Toshiba Corporation)

TOSHIBA eco Utility (Version: 2.0.0.6415 - Toshiba Corporation)

TOSHIBA Function Key (Version: 1.00.6425 - Toshiba Corporation)

TOSHIBA Manuals (x32 Version: 10.10 - TOSHIBA)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation)

Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden

TOSHIBA PC Health Monitor (Version: 1.8.17.640104 - Toshiba Corporation)

Toshiba Places Icon Utility (Version: 2.1.1 - TOSHIBA)

TOSHIBA Recovery Media Creator (x32 Version: 2.2.0.54043005 - Toshiba Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00 - TOSHIBA Corporation)

TOSHIBA Service Station (Version: 2.4.4 - TOSHIBA)

TOSHIBA System Driver (x32 Version: 1.00.0012 - Toshiba Corporation)

TOSHIBA System Settings (x32 Version: 1.00.0002.32002 - Toshiba Corporation)

Toshiba TEMPRO (x32 Version: 4.2.1 - Toshiba Europe GmbH)

TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A - Toshiba Corporation)

Updater (x32 Version: 2.6.53 - Creative Island Media, LLC)

Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VisualBee for Microsoft PowerPoint (HKCU Version: V4.1 - VisualBee.com)

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden

Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3 - Realtek Semiconductor Corp.)

WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
 

==================== Restore Points  =========================
 

29-01-2014 16:49:28 Ende der Bereinigung

05-02-2014 11:55:46 Windows Update
 

==================== Hosts content: ==========================
 

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {00C107C2-027E-4224-83B4-754CDD462CF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-11-22] (Piriform Ltd)

Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-08-14] (Toshiba Europe GmbH)

Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask

Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {2807D834-4937-49CF-ABDE-3E9AD3CBDB68} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated)

Task: {3C34E352-D102-4B2E-A790-FC5D6226257D} - \Re-Markable Update No Task File

Task: {411A5387-5618-4EE2-A0D0-8ECC6EF5C97B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {4DEAF078-4D55-4C04-8165-FD15AB799510} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)

Task: {7B4A55C2-0879-44B1-A6BF-1F593C7656A7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-04] (Adobe Systems Incorporated)

Task: {84962D8B-E8A6-4638-A2C9-DB0ABE38826C} - \EPUpdater No Task File

Task: {92FA85CF-6EAE-4B68-9422-55CA63A44942} - \Desk 365 RunAsStdUser No Task File

Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing

Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState

Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask

Task: {F6C11617-6D62-4525-91D5-00D4CDA3557C} - \LaunchApp No Task File

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\Re-Markable Update.job => C:\Program Files (x86)\Re-Markable\ReMarkableup.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-07-18 14:22 - 2010-12-29 12:24 - 00120320 _____ () C:\Program Files (x86)\Free Zip Opener\contmenu_x64.dll

2013-07-07 22:38 - 2013-07-07 22:39 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll

2013-12-07 18:49 - 2013-11-22 12:01 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2012-11-07 21:27 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00161992 _____ () C:\Program Files (x86)\OpenVPN\bin\liblzo2-2.dll

2013-08-22 14:10 - 2013-08-22 14:10 - 00107720 _____ () C:\Program Files (x86)\OpenVPN\bin\libpkcs11-helper-1.dll

2014-01-11 16:37 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/05/2014 04:24:06 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x5b4

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/05/2014 04:00:12 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x11b0

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/05/2014 03:55:46 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x6dc

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/05/2014 00:55:24 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273

Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0014e1a8

ID des fehlerhaften Prozesses: 0xcc

Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0

Pfad der fehlerhaften Anwendung: firefox.exe1

Pfad des fehlerhaften Moduls: firefox.exe2

Berichtskennung: firefox.exe3

Vollständiger Name des fehlerhaften Pakets: firefox.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: firefox.exe5
 

Error: (02/05/2014 00:40:56 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x1568

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/05/2014 00:20:03 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x9d0

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/05/2014 00:19:55 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x110c

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/04/2014 08:18:08 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0xe28

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/04/2014 08:17:48 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x2fa0

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 

Error: (02/04/2014 08:17:33 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SpotifyHelper.exe, Version: 0.0.0.0, Zeitstempel: 0x52aad71c

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16578, Zeitstempel: 0x515fac6e

Ausnahmecode: 0xc0000374

Fehleroffset: 0x000daa3c

ID des fehlerhaften Prozesses: 0x2dbc

Startzeit der fehlerhaften Anwendung: 0xSpotifyHelper.exe0

Pfad der fehlerhaften Anwendung: SpotifyHelper.exe1

Pfad des fehlerhaften Moduls: SpotifyHelper.exe2

Berichtskennung: SpotifyHelper.exe3

Vollständiger Name des fehlerhaften Pakets: SpotifyHelper.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: SpotifyHelper.exe5
 
 

System errors:

=============

Error: (02/05/2014 03:22:19 PM) (Source: Schannel) (User: Holger)

Description: Das vom Remoteserver erhaltene Zertifikat enthält nicht den erwarteten Namen. Es ist daher nicht möglich festzustellen, ob eine Verbindung mit dem richtigen Server hergestellt wird. Der erwartete Servername lautet client.wns.windows.com. Fehler bei der SSL-Verbindungsanforderung. Die angehängten Daten enthalten das Serverzertifikat.
 

Error: (02/05/2014 03:22:19 PM) (Source: Schannel) (User: Holger)

Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 43. Der Windows-SChannel-Fehlerstatus lautet: 552.
 

Error: (02/05/2014 03:22:10 PM) (Source: Schannel) (User: Holger)

Description: Das vom Remoteserver erhaltene Zertifikat enthält nicht den erwarteten Namen. Es ist daher nicht möglich festzustellen, ob eine Verbindung mit dem richtigen Server hergestellt wird. Der erwartete Servername lautet client.wns.windows.com. Fehler bei der SSL-Verbindungsanforderung. Die angehängten Daten enthalten das Serverzertifikat.
 

Error: (02/05/2014 03:22:10 PM) (Source: Schannel) (User: Holger)

Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 43. Der Windows-SChannel-Fehlerstatus lautet: 552.
 

Error: (02/05/2014 03:21:56 PM) (Source: Schannel) (User: Holger)

Description: Das vom Remoteserver erhaltene Zertifikat enthält nicht den erwarteten Namen. Es ist daher nicht möglich festzustellen, ob eine Verbindung mit dem richtigen Server hergestellt wird. Der erwartete Servername lautet client.wns.windows.com. Fehler bei der SSL-Verbindungsanforderung. Die angehängten Daten enthalten das Serverzertifikat.
 

Error: (02/05/2014 03:21:56 PM) (Source: Schannel) (User: Holger)

Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 43. Der Windows-SChannel-Fehlerstatus lautet: 552.
 

Error: (02/05/2014 03:21:45 PM) (Source: Schannel) (User: Holger)

Description: Das vom Remoteserver erhaltene Zertifikat enthält nicht den erwarteten Namen. Es ist daher nicht möglich festzustellen, ob eine Verbindung mit dem richtigen Server hergestellt wird. Der erwartete Servername lautet client.wns.windows.com. Fehler bei der SSL-Verbindungsanforderung. Die angehängten Daten enthalten das Serverzertifikat.
 

Error: (02/05/2014 03:21:45 PM) (Source: Schannel) (User: Holger)

Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 43. Der Windows-SChannel-Fehlerstatus lautet: 552.
 

Error: (02/05/2014 03:21:35 PM) (Source: Schannel) (User: Holger)

Description: Das vom Remoteserver erhaltene Zertifikat enthält nicht den erwarteten Namen. Es ist daher nicht möglich festzustellen, ob eine Verbindung mit dem richtigen Server hergestellt wird. Der erwartete Servername lautet client.wns.windows.com. Fehler bei der SSL-Verbindungsanforderung. Die angehängten Daten enthalten das Serverzertifikat.
 

Error: (02/05/2014 03:21:35 PM) (Source: Schannel) (User: Holger)

Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 43. Der Windows-SChannel-Fehlerstatus lautet: 552.
 
 

Microsoft Office Sessions:

=========================

Error: (02/05/2014 04:24:06 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c5b401cf22864e94c088C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll8c866484-8e79-11e3-bec3-2016d8065076
 

Error: (02/05/2014 04:00:12 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c11b001cf2282f7f35d08C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll35e4cd4d-8e76-11e3-bec3-2016d8065076
 

Error: (02/05/2014 03:55:46 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c6dc01cf2282578965d2C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll9747c316-8e75-11e3-bec3-2016d8065076
 

Error: (02/05/2014 00:55:24 PM) (Source: Application Error)(User: )

Description: firefox.exe26.0.0.508752a0d273xul.dll26.0.0.508752a0d20ac00000050014e1a8cc01cf226121ac6356C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll64fafa3d-8e5c-11e3-bec2-2016d8065076
 

Error: (02/05/2014 00:40:56 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c156801cf226721b12a3cC:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll5fa0eda0-8e5a-11e3-bec2-2016d8065076
 

Error: (02/05/2014 00:20:03 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c9d001cf226436bfdd4cC:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll749ae2d4-8e57-11e3-bec2-2016d8065076
 

Error: (02/05/2014 00:19:55 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c110c01cf22642fb9cc63C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll70395f1e-8e57-11e3-bec2-2016d8065076
 

Error: (02/04/2014 08:18:08 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3ce2801cf21ddd5e5ee39C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll13cb7430-8dd1-11e3-bec1-2016d8065076
 

Error: (02/04/2014 08:17:48 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c2fa001cf21ddc9fafd95C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dll07df4b12-8dd1-11e3-bec1-2016d8065076
 

Error: (02/04/2014 08:17:33 PM) (Source: Application Error)(User: )

Description: SpotifyHelper.exe0.0.0.052aad71cntdll.dll6.2.9200.16578515fac6ec0000374000daa3c2dbc01cf21ddbdd6c404C:\Users\Holger-PC\AppData\Roaming\Spotify\Data\SpotifyHelper.exeC:\windows\SYSTEM32\ntdll.dllff1bf93a-8dd0-11e3-bec1-2016d8065076
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-01-18 15:29:49.498

  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe with signing level Unsigned while the system requires signing level 6 or better to load.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 38%

Total physical RAM: 3979.21 MB

Available physical RAM: 2444.83 MB

Total Pagefile: 6155.21 MB

Available Pagefile: 4316.54 MB

Total Virtual: 8192 MB

Available Virtual: 8191.76 MB
 

==================== Drives ================================
 

Drive c: (TI30992300A) (Fixed) (Total:455.29 GB) (Free:271.95 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 466 GB) (Disk ID: 00000000)
 

Partition: GPT Partition Type

==================== End Of Log ============================

Ich seh da so nix...lad mal JRT und adwCleaner neu runter und führ beide nacheinander aus

Code:

# AdwCleaner v3.018 - Bericht erstellt am 06/02/2014 um 11:10:12

# Updated 28/01/2014 von Xplode

# Betriebssystem : Windows 8  (64 bits)

# Benutzername : Holger-PC - HOLGER

# Gestartet von : C:\Users\Holger-PC\Downloads\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v10.0.9200.16537
 
 

-\\ Mozilla Firefox v26.0 (de)
 

[ Datei : C:\Users\Holger-PC\AppData\Roaming\Mozilla\Firefox\Profiles\h4i2gq0u.default\prefs.js ]
 
 

-\\ Google Chrome v
 

[ Datei : C:\Users\Holger-PC\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [908 octets] - [06/02/2014 11:09:41]

AdwCleaner[S0].txt - [830 octets] - [06/02/2014 11:10:12]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [889 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.1 (02.04.2014:1)

OS: Windows 8 x64

Ran by Holger-PC on 06.02.2014 at 11:17:03,72

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Holger-PC\AppData\Roaming\mozilla\firefox\profiles\h4i2gq0u.default\minidumps [16 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 06.02.2014 at 11:21:07,72

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Erstell dir mal ein neues Profil und teste => Firefox-Profile erstellen und löschen | Hilfe zu Firefox

Ok habe ich gemacht, ich gebe dann die Tage nochmal Auskunft, ob es was gebracht hat;) Danke

So, ich glaube jetzt ists wirklich geschafft. Ich denke du kannst den Thread jetzt schließen. Vielen Dank für deine Geduld!