Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bankdaten ausgespät, Trojaner entfernen (https://www.trojaner-board.de/155010-bankdaten-ausgespaet-trojaner-entfernen.html)

jemgumeranke 10.06.2014 13:02
Bankdaten ausgespät, Trojaner entfernen
 
Hallo, am Samstag wurde mir durch meine Bank mitgeteilt, das ich einen Trojaner auf meinem Laptop haben soll und daraufhin mein Online-Banking gesperrt. Ich solle den Trojaner entfernen bzw. entfernen lassen. Leider habe ich keinen Zugriff mehr auf Antivir.
Meldung: Dieses Programm wurde durch eine Gruppenrichtlinie blockiert. Weitere Infos erhalten Sie vom Systemadmin. (Bin selbst als Admin eingetragen.) Deinstallieren ist nicht möglich, dort kommt folgende Meldung:
Sie verfügen nicht über ausreichnende Berechtigungen, Um Avira zu deinstallieren. Wenden Sie sich an den Systemadministrator.

Habe Defogger, FRST und Gmer durchgeführt und hänge diese jetzt an. Defogger hat keine Log erstellt:
Zitat:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03
Ran by Anke (administrator) on ANKE-PC on 10-06-2014 13:10:10
Running from C:\Users\Anke\Downloads
Platform: Microsoft Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
() C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
() C:\Users\Anke\Downloads\Defogger (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] ()
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor)
HKLM\...\Run: [Ocs_SM] => C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-08-10] (OCS)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [Facebook Update] => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-12-05] (Google Inc.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [AfnuWquk] => regsvr32.exe "C:\ProgramData\AfnuWquk.dat"
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e2fa-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e33a-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e37d-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {6d985358-73cd-11e3-a05a-002454e4b71c} - F:\SETUP.EXE
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e64919-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e6494c-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1004\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-12-05] (Google Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://www.facebook.com/
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D4945385352 43&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6963712E636F6D2F7365617263682F726573756C74732E7068703F713D7B7365617263685465726D737D2663685F69643D6F7364&st={sea rchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E677561 67657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&s t={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com.anonymize-me.de/?anonymto=687474703A2F2F6474732E7365617263682D726573756C74732E636F6D2F73723F7372633D6965622661707069643D3130312673797374656D69643D3430362673723D302671 3D7B7365617263685465726D737D&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können. - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO: ICQ Sparberater - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - No File
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} - No File
Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
FF user.js: detected! => C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\user.js
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\toolbar@ask.com [2012-10-16]
FF Extension: toolplugin - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com [2011-11-02]
FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-03-23]
FF Extension: ICQ Toolbar - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012-07-28]
FF Extension: ICQ Sparberater - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\ciuvo-extension@icq.de.xpi [2011-10-05]
FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10]
FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27]
FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02]
CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02]
CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02]
CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22]
CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2011-07-13]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 SearchAnonymizer; C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-08-10] () [File not signed]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-01-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [69240 2014-01-07] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd)
R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.)
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2014-01-07] (Avira GmbH)
S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 MpKsl30dde60d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A0C6630D-0785-4826-B277-8B6B5DB9F92F}\MpKsl30dde60d.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-10 13:10 - 2014-06-10 13:10 - 00033292 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-10 13:10 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST
2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00000540 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo!
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe
2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-10 12:58 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google
2014-06-10 12:57 - 2014-06-10 13:04 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp
2014-06-10 12:57 - 2014-06-10 13:02 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk
2014-06-10 12:57 - 2014-06-10 13:02 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk
2014-06-10 12:57 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-10 12:57 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf
2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore
2014-06-10 12:57 - 2010-11-10 23:25 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Microsoft Help
2014-06-10 12:57 - 2010-04-24 15:55 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam
2014-06-10 12:57 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-06-10 12:57 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-05-23 19:05 - 2014-06-06 14:43 - 00258193 _____ (Microsoft Corporation) C:\ProgramData\AfnuWquk.dat
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER

==================== One Month Modified Files and Folders =======

2014-06-10 13:10 - 2014-06-10 13:10 - 00033292 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-10 13:10 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST
2014-06-10 13:10 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Local\Temp
2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-10 13:09 - 2009-12-05 04:40 - 01343113 _____ () C:\windows\WindowsUpdate.log
2014-06-10 13:08 - 2014-06-10 13:08 - 00000540 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\defogger_reenable
2014-06-10 13:08 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 13:04 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp
2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo!
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe
2014-06-10 13:02 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google
2014-06-10 13:02 - 2014-06-10 12:57 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk
2014-06-10 13:02 - 2014-06-10 12:57 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk
2014-06-10 13:02 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-10 13:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-10 12:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf
2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore
2014-06-10 12:57 - 2012-12-03 11:05 - 00018439 _____ () C:\windows\setupact.log
2014-06-10 12:57 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-10 12:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-10 12:23 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
2014-06-10 12:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-09 12:34 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics
2014-06-09 12:33 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-09 12:32 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-06 14:43 - 2014-05-23 19:05 - 00258193 _____ (Microsoft Corporation) C:\ProgramData\AfnuWquk.dat
2014-05-16 11:10 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-16 11:08 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT
2014-05-16 11:02 - 2010-04-27 20:46 - 90547776 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\ProgramData\AfnuWquk.dat


Some content of TEMP:
====================
C:\Users\Anke\AppData\Local\Temp\avgnt.exe
C:\Users\Anke\AppData\Local\Temp\COMPUTERBILD Vorteil-Center-Installation.exe
C:\Users\Anke\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Anke\AppData\Local\Temp\ose00000.exe
C:\Users\Anke\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Anke\AppData\Local\Temp\_is6E7B.exe


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-08 13:56

==================== End Of Log ============================
Zitat:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:09-06-2014 03
Ran by Anke at 2014-06-10 13:11:11
Running from C:\Users\Anke\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
32 Bit HP CIO Components Installer (Version: 6.1.2 - Hewlett-Packard) Hidden
32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.05 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Air Strike 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110186437}) (Version: - Oberon Media)
AirStrike II FREE (HKLM\...\AirStrike II FREE) (Version: - )
Alice Greenfingers (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version: - Oberon Media)
AnyPC Client (HKLM\...\{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}) (Version: 1.0.0.23 - Doctorsoft)
Ask Toolbar (HKLM\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.26.0 - Ask.com) <==== ATTENTION
Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.1.0805 - Atheros)
Avanquest update (HKLM\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.28 - Avanquest Software)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
AXIS Media Control Embedded (HKLM\...\AXIS Media Control Embedded) (Version: - )
Azgard Defence (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11494470}) (Version: - Oberon Media)
BatteryLifeExtender (HKLM\...\{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}) (Version: 1.0.1 - Samsung)
BufferChm (Version: 140.0.212.000 - Hewlett-Packard) Hidden
C4700 (Version: 140.0.690.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.20 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
COMPUTERBILD Vorteil-Center (HKLM\...\{D6BFE154-5759-4BCF-87BD-F304F3B8F8E5}) (Version: 1.2.0 - J3S)
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.)
CyberLink DVD Suite (Version: 6.0.2806 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink LabelPrint (Version: 2.5.1916 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108a - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.3108a - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3213 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.3213 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815b - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2815b - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1812 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1812 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3304 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.3304 - CyberLink Corp.) Hidden
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Dairy Dash (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version: - Oberon Media)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{349F73CA-653A-43A6-AE77-970B07D6EDA0}) (Version: - Microsoft)
Desktop Icon für Amazon (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 (de) - )
Destinations (Version: 140.0.77.000 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Dreamload (HKCU\...\958610902.www.dreamload.com) (Version: - www.dreamload.com)
Dreamload Classic Client (HKLM\...\Dreamload Classic Client) (Version: 1.65 - Dreamload LLC)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{A5675A9E-F073-414A-9A04-F9BCD50459D7}) (Version: 4.2.6 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 3.0.0.5 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.3 - Samsung)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Farm Frenzy 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version: - Oberon Media)
FlexPoints 2.01 (HKLM\...\{B727BD4D-0C42-43F7-AC60-4AFBDDC732BD}) (Version: 2.01.0000 - Weight Watchers)
Game Pack (HKLM\...\{63eafc52-b963-4297-a7eb-d412944e7065}_is1) (Version: 5.3.0.10 - Oberon Media, Inc.)
Go-Go Gourmet (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}) (Version: - Oberon Media)
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
GPBaseService2 (Version: 140.0.211.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Photosmart C4700 All-in-One Driver Software 14.0 Rel. 6 (HKLM\...\{68550918-63B5-4762-85CB-3C160AA4B213}) (Version: 14.0 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM\...\{74DC0593-6BC6-4001-AD5F-D810AFB68D86}) (Version: 5.002.002.002 - Hewlett-Packard)
HPPhotoGadget (Version: 140.0.524.000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 140.0.212.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 140.0.211.000 - Hewlett-Packard) Hidden
ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2104 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.2104 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java Auto Updater (Version: 2.0.6.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 30 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.300 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
LibreOffice 4.1.4.2 (HKLM\...\{94E11973-ED58-47A0-907C-ABF6D95C5DD8}) (Version: 4.1.4.2 - The Document Foundation)
MarketResearch (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell)
Mein Gutscheincode Finder 1.0.0.0 (HKLM\...\{1E05CF2E-BF5F-4A43-9147-2CCBBE57BC3C}_is1) (Version: 1.0.0.0 - Conversion One GmbH)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 27.0.1 (x86 de) (HKLM\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 24.3.0 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )
MyPhoneExplorer (HKLM\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
NASA World Wind 1.4 (HKLM\...\NASA World Wind 1.4) (Version: - )
Network (Version: 140.0.215.000 - Hewlett-Packard) Hidden
Netzmanager (Version: 1.071 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden
Octoshape add-in for Adobe Flash Player (HKCU\...\Octoshape add-in for Adobe Flash Player) (Version: - )
OpenAL (HKLM\...\OpenAL) (Version: - )
Pro Pinball: Big Race USA (Kickstarter 1998 Edition) version 1.20 (HKLM\...\Pro Pinball: Big Race USA (Kickstarter 1998 Edition)_is1) (Version: 1.20 - )
PS_AIO_06_C4700_SW_Min (Version: 140.0.690.000 - Hewlett-Packard) Hidden
Putt Mania (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112028410}) (Version: - Oberon Media)
QuickTransfer (Version: 140.0.98.000 - Hewlett-Packard) Hidden
Ralink RT2870 Wireless LAN Card (HKLM\...\{28DA7D8B-F9A4-4F18-8AA0-551B1E084D0D}) (Version: 1.5.11.0 - Ralink)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6003 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.0.13064_2 - Samsung Electronics Co., Ltd.) Hidden
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung New PC Studio USB Driver Installer (HKLM\...\InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio USB Driver Installer (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung)
Samsung Story Album Viewer (HKLM\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
Samsung Support Center (HKLM\...\{CCC2B140-B47A-45FA-AAE3-BD60DA41AE00}) (Version: 1.0.21 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
SamsungConnectivityCableDriver (HKLM\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung)
Scan (Version: 140.0.80.000 - Hewlett-Packard) Hidden
SearchAnonymizer (HKLM\...\SearchAnonymizer) (Version: 1.0.1 (de) - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version: - Microsoft) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Smart Viewer (HKLM\...\Smart Viewer) (Version: - )
SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 140.0.213.000 - Hewlett-Packard) Hidden
SopCast 3.4.0 (HKLM\...\SopCast) (Version: 3.4.0 - www.sopcast.com)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Status (Version: 140.0.212.000 - Hewlett-Packard) Hidden
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.10.0 - Synaptics Incorporated)
Timeless The Forgotten Town (HKLM\...\510006279) (Version: - Oberon Media)
Toolbox (Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM\...\{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{4B93560B-F33D-4A67-A224-F5E1C329BD22}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft Office Word 2007 (KB974631) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{052CA271-6C3E-4B8F-9EEE-CEA84BC901DC}) (Version: - Microsoft)
Update for Microsoft Office Word 2007 (KB974631) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CA2F3DF8-C8AE-4933-92F1-FE482442F6E6}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
Veetle TV (HKLM\...\Veetle TV) (Version: 0.9.18 - Veetle, Inc)
VLC media player 1.1.4 (HKLM\...\VLC media player) (Version: 1.1.4 - VideoLAN)
WEB.DE Desktop Icons (HKLM\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)
WEB.DE Softwareaktualisierung (HKLM\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
WebReg (Version: 140.0.212.017 - Hewlett-Packard) Hidden
Weight Watchers FlexPoints (HKLM\...\Weight Watchers FlexPoints) (Version: 2005.0.0.0 - nullsiebenelf GmbH)
Windows 7 USB/DVD Download Tool (HKLM\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinRAR 4.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
Yahoo! BrowserPlus 2.9.8 (HKCU\...\Yahoo! BrowserPlus) (Version: - Yahoo! Inc.)
Yahoo! Toolbar (HKLM\...\Yahoo! Companion) (Version: - )

==================== Restore Points =========================

30-05-2014 09:15:50 Windows Update
31-05-2014 08:23:23 Windows Update
01-06-2014 12:24:55 Windows Update
02-06-2014 08:16:42 Windows Update
03-06-2014 07:50:53 Windows Update
04-06-2014 10:49:21 Windows Update
05-06-2014 08:12:05 Windows Update
06-06-2014 07:26:08 Windows Update
07-06-2014 11:39:48 Windows Update
08-06-2014 11:31:29 Windows Update
09-06-2014 10:38:06 Windows Update
10-06-2014 09:47:08 Windows Update
10-06-2014 09:57:17 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {16C6248D-5F07-4551-A7A1-F5C4C44656F1} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {210FA61D-92F6-4FEE-B312-06AF7D4D93D5} - System32\Tasks\APSchedulerC => C:\Program Files\AnyPC Client\APLanMgrC.exe [2009-10-20] (DoctorSoft)
Task: {2D577A20-059C-43FE-B6C0-1FB82EC956F8} - System32\Tasks\BatteryLifeExtender => C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2009-11-19] (Samsung Electronics. Co. Ltd.)
Task: {3478472F-7FA4-4AF5-BCBF-EE95B8EB2649} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated)
Task: {48A6287D-9267-44E7-99FD-21FCA0982FF8} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2010-04-20] ()
Task: {4BA99CBA-779D-430A-AD58-F36782836748} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09] (Sun Microsystems, Inc.)
Task: {5CE4AD0A-A3DB-4DF5-86D7-1CA86E21452A} - System32\Tasks\PC Rambazamba => C:\Program Files\Langmeier Software\PC Rambazamba\pcrambazamba.exe
Task: {88A49655-48B3-4C5D-8CD2-9B43A4A79D2F} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-11-04] (Samsung Electronics Co., Ltd.)
Task: {8D4D5684-8FAB-4077-95EB-C9C0BBB68E80} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-10-13] (Samsung Electronics Co., Ltd.)
Task: {98148909-93A1-4342-8842-32378E53B983} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-15] (Facebook Inc.)
Task: {9A171F4D-432A-42AF-A3CC-EBCB4A1C5430} - System32\Tasks\SamsungSupportCenter => C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe [2009-10-26] (SAMSUNG Electronics)
Task: {9BBE3F17-85EA-4EFC-A181-42FBC9E26551} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-04-24] (Google Inc.)
Task: {A3010205-2F25-460D-B036-A7F85F296853} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-04-24] (Google Inc.)
Task: {A577FCDA-9AA7-4171-A0ED-E56AFE161559} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-15] (Facebook Inc.)
Task: {AD271B14-084C-425B-BC4E-8F37E1D6B421} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-06-22] (Piriform Ltd)
Task: {ADC0B50E-2258-4173-A4F2-C76927DB97A0} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2009-11-18] (Hewlett-Packard)
Task: {AFB658C2-1A9E-441E-A908-4C3CFB274F11} - System32\Tasks\advSRS4 => C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2010-01-19] (SEC)
Task: {CBC0F81E-2DA7-44E8-9EBB-A2F11440EEED} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {CC0D875C-93E1-46F8-B7B7-80E0B3BCFA41} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2009-10-16] (SAMSUNG Electronics co., LTD.)
Task: {E26E63F5-ECF1-4EB2-98C7-9FFAC2F51F06} - System32\Tasks\Registration 1und1 Task => C:\Program Files\1und1Softwareaktualisierung\cdsupdclient.exe [2013-06-18] (1&1 Mail & Media GmbH)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2011-12-10 22:36 - 2011-05-28 23:04 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll
2010-04-24 15:40 - 2009-08-13 21:58 - 00044312 _____ () C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
2009-12-05 04:50 - 2009-07-07 20:23 - 00247152 ____N () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2012-08-10 20:43 - 2012-08-10 20:43 - 00040960 _____ () C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe
2009-12-05 04:45 - 2010-04-20 14:26 - 00300912 _____ () C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
2009-12-05 04:45 - 2010-04-16 14:11 - 00155648 _____ () C:\Program Files\Samsung\Samsung Update Plus\HMXML.dll
2009-12-05 04:54 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-12-05 05:02 - 2010-04-26 17:44 - 00137792 _____ () C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe
2013-12-07 15:53 - 2010-12-30 16:46 - 01033568 _____ () C:\Program Files\Ralink\Common\RaWLAPI.dll
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
AlternateDataStreams: C:\ProgramData\Temp:532B5694
AlternateDataStreams: C:\ProgramData\Temp:8617D2A3
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:BB24555F
AlternateDataStreams: C:\ProgramData\Temp:C99F6ECA
AlternateDataStreams: C:\ProgramData\Temp:D6A1EE83

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: MpKsl30dde60d
Description: MpKsl30dde60d
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKsl30dde60d
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C4700 series
Description: Photosmart C4700 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/10/2014 11:58:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16476, Zeitstempel: 0x5126e7ac
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001754a5
ID des fehlerhaften Prozesses: 0x4d0
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (06/09/2014 00:44:11 PM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Fehler beim Bestimmen des Bibliothekenspeicherorts eines der in die Scherung eingeschlossenen Benutzer durch die Windows-Sicherung. (0x81000031)"

Error: (06/09/2014 00:43:54 PM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Fehler beim Bestimmen des Bibliothekenspeicherorts eines der in die Scherung eingeschlossenen Benutzer durch die Windows-Sicherung. (0x81000031)"

Error: (06/09/2014 00:43:07 PM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Fehler beim Bestimmen des Bibliothekenspeicherorts eines der in die Scherung eingeschlossenen Benutzer durch die Windows-Sicherung. (0x81000031)"

Error: (06/09/2014 00:40:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16476, Zeitstempel: 0x5126e7ac
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x015a54a5
ID des fehlerhaften Prozesses: 0x670
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (06/08/2014 02:49:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16476, Zeitstempel: 0x5126e7ac
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x017654a5
ID des fehlerhaften Prozesses: 0x12b4
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (06/07/2014 05:04:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16476, Zeitstempel: 0x5126e7ac
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x011554a5
ID des fehlerhaften Prozesses: 0x1780
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (06/07/2014 05:03:33 PM) (Source: OberonGameConsoleService) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen

Error: (06/07/2014 02:07:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16476, Zeitstempel: 0x5126e7ac
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x012b54a5
ID des fehlerhaften Prozesses: 0x1d8c
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (06/07/2014 01:37:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16476, Zeitstempel: 0x5126e7ac
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x002954a5
ID des fehlerhaften Prozesses: 0x1564
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3


System errors:
=============
Error: (06/10/2014 00:57:40 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (06/10/2014 00:57:39 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (06/10/2014 00:56:41 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30
registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.

Error: (06/10/2014 11:59:46 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (06/10/2014 11:58:39 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (06/10/2014 11:48:00 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (06/10/2014 11:46:52 AM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (06/09/2014 08:46:11 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (06/09/2014 08:46:02 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.

Error: (06/09/2014 02:30:55 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "ANKE-PC :20" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.30
registriert werden. Der Computer mit IP-Adresse 169.254.27.170 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 50%
Total physical RAM: 3032.61 MB
Available physical RAM: 1513.21 MB
Total Pagefile: 6061.44 MB
Available Pagefile: 4190.43 MB
Total Virtual: 2047.88 MB
Available Virtual: 1870.05 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:141.49 GB) (Free:68.72 GB) NTFS
Drive d: () (Fixed) (Total:141.5 GB) (Free:65.93 GB) NTFS
Drive g: (USB DISK) (Removable) (Total:7.47 GB) (Free:1.54 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 0E0EF5DF)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=141 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=141 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Zitat:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-10 13:46:38
Windows 6.1.7600 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0 298,09GB
Running: nhmwyhxd.exe; Driver: C:\Users\Anke\AppData\Local\Temp\kxldrpow.sys


---- System - GMER 2.1 ----

SSDT 8EED1076 ZwCreateSection
SSDT 8EED1080 ZwRequestWaitReplyPort
SSDT 8EED107B ZwSetContextThread
SSDT 8EED1085 ZwSetSecurityObject
SSDT 8EED108A ZwSystemDebugControl
SSDT 8EED1017 ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text ntoskrnl.exe!ZwRollbackTransaction + 13F5 834508A9 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 83470302 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 14B7 83477684 4 Bytes [76, 10, ED, 8E]
.text ntoskrnl.exe!KeRemoveQueueEx + 1813 834779E0 4 Bytes [80, 10, ED, 8E]
.text ntoskrnl.exe!KeRemoveQueueEx + 1857 83477A24 4 Bytes [7B, 10, ED, 8E]
.text ntoskrnl.exe!KeRemoveQueueEx + 18D3 83477AA0 4 Bytes [85, 10, ED, 8E]
.text ntoskrnl.exe!KeRemoveQueueEx + 1927 83477AF4 4 Bytes [8A, 10, ED, 8E]
.text ...

---- User code sections - GMER 2.1 ----

.text C:\windows\Explorer.EXE[1952] kernel32.dll!CreateProcessW 7748202D 5 Bytes JMP 08C5887E
.text C:\windows\Explorer.EXE[1952] kernel32.dll!CreateProcessA 77482062 5 Bytes JMP 08C58927
.text C:\windows\Explorer.EXE[1952] ADVAPI32.dll!CreateProcessAsUserW 76EEBBDB 5 Bytes JMP 08C589CC
.text C:\windows\Explorer.EXE[1952] ADVAPI32.dll!CreateProcessAsUserA 76F214FD 5 Bytes JMP 08C58A78
.text C:\windows\Explorer.EXE[1952] CRYPT32.dll!PFXImportCertStore 758312B0 5 Bytes JMP 08C5744E

---- Devices - GMER 2.1 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys

---- Disk sectors - GMER 2.1 ----

Disk \Device\Harddisk0\DR0 unknown MBR code

---- EOF - GMER 2.1 ----

schrauber 10.06.2014 13:36
hi,


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307



Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Adware & Co. deinstallieren

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:





Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

jemgumeranke 10.06.2014 14:44
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-06-2014 03
Ran by Anke (administrator) on ANKE-PC on 10-06-2014 14:59:00
Running from C:\Users\Anke\Downloads
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
() C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
() C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] ()
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor)
HKLM\...\Run: [Ocs_SM] => C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-08-10] (OCS)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [Facebook Update] => C:\Users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-12-05] (Google Inc.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e2fa-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e33a-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {1239e37d-b05f-11e0-9ffc-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {6d985358-73cd-11e3-a05a-002454e4b71c} - F:\SETUP.EXE
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e64919-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\MountPoints2: {a8e6494c-ae4a-11e0-aafd-002454e4b71c} - F:\AutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://www.facebook.com/
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  No File
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6963712E636F6D2F7365617263682F726573756C74732E7068703F713D7B7365617263685465726D737D2663685F69643D6F7364&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com.anonymize-me.de/?anonymto=687474703A2F2F6474732E7365617263682D726573756C74732E636F6D2F73723F7372633D6965622661707069643D3130312673797374656D69643D3430362673723D3026713D7B7365617263685465726D737D&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können. - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO: ICQ Sparberater - {FE163F11-1919-4257-A280-FF5AF8DAEECB} -  No File
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-89AF-189327213627} -  No File
Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
FF user.js: detected! => C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\user.js
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\toolbar@ask.com [2012-10-16]
FF Extension: toolplugin - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com [2011-11-02]
FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-03-23]
FF Extension: ICQ Toolbar - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012-07-28]
FF Extension: ICQ Sparberater - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\ciuvo-extension@icq.de.xpi [2011-10-05]
FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10]
FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27]
FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-13]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02]
CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02]
CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02]
CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22]
CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2011-07-13]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1039952 2014-05-22] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed]
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 SearchAnonymizer; C:\Users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-08-10] () [File not signed]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2014-01-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [69240 2014-01-07] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd)
R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-10] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.)
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2014-01-07] (Avira GmbH)
S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 MpKslabc952c6; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKslabc952c6.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:05 - 2014-06-10 14:53 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:10 - 2014-06-10 14:59 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-10 13:10 - 2014-06-10 14:59 - 00000000 ____D () C:\FRST
2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo!
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe
2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-10 12:58 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google
2014-06-10 12:57 - 2014-06-10 13:04 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp
2014-06-10 12:57 - 2014-06-10 13:02 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk
2014-06-10 12:57 - 2014-06-10 13:02 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk
2014-06-10 12:57 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-10 12:57 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf
2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore
2014-06-10 12:57 - 2010-11-10 23:25 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Microsoft Help
2014-06-10 12:57 - 2010-04-24 15:55 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink YouCam
2014-06-10 12:57 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-06-10 12:57 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER

==================== One Month Modified Files and Folders =======

2014-06-10 14:59 - 2014-06-10 13:10 - 00033479 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-10 14:59 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST
2014-06-10 14:59 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Local\Temp
2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:53 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-10 14:52 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics
2014-06-10 14:52 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-10 14:50 - 2012-12-03 11:05 - 00018495 _____ () C:\windows\setupact.log
2014-06-10 14:50 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-10 14:50 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-10 14:49 - 2012-12-16 11:56 - 04194830 _____ () C:\windows\PFRO.log
2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME
2014-06-10 14:48 - 2009-12-05 04:40 - 01352990 _____ () C:\windows\WindowsUpdate.log
2014-06-10 14:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 14:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:23 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:19 - 2014-06-10 13:19 - 00042947 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:09 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 13:04 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Temp
2014-06-10 13:02 - 2014-06-10 13:02 - 00139752 _____ () C:\Users\Rolf\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Yahoo!
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Macromedia
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Google
2014-06-10 13:02 - 2014-06-10 13:02 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Adobe
2014-06-10 13:02 - 2014-06-10 12:58 - 00000000 ____D () C:\Users\Rolf\AppData\Local\Google
2014-06-10 13:02 - 2014-06-10 12:57 - 00001130 _____ () C:\Users\Rolf\Desktop\CyberLink DVD Suite.lnk
2014-06-10 13:02 - 2014-06-10 12:57 - 00001079 _____ () C:\Users\Rolf\Desktop\CyberLink YouCam.lnk
2014-06-10 13:02 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-10 13:01 - 2014-06-10 13:01 - 00001373 _____ () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-10 12:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf
2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-10 12:57 - 2014-06-10 12:57 - 00000020 ___SH () C:\Users\Rolf\ntuser.ini
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Startmenü
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Netzwerkumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Druckumgebung
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Musik
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\Documents\Eigene Bilder
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 _SHDL () C:\Users\Rolf\AppData\Local\Verlauf
2014-06-10 12:57 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf\AppData\Local\VirtualStore
2014-06-10 12:23 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
2014-06-10 12:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-09 12:41 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-16 11:10 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-16 11:08 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT
2014-05-16 11:02 - 2010-04-27 20:46 - 90547776 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 07:26 - 2014-06-10 14:05 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-10 14:05 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:25 - 2014-06-10 14:05 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

Some content of TEMP:
====================
C:\Users\Anke\AppData\Local\Temp\avgnt.exe
C:\Users\Anke\AppData\Local\Temp\COMPUTERBILD Vorteil-Center-Installation.exe
C:\Users\Anke\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Anke\AppData\Local\Temp\ose00000.exe
C:\Users\Anke\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Anke\AppData\Local\Temp\_is6E7B.exe


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-08 13:56

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Hy Combofix, läuft nicht bis zum Ende durch, da ich weder Antivir noch Windows Security Essentials, sowohl als Antivir als auch als Antispy nicht beenden kann, da auch hier die Meldung erscheint, Zugriff verweigert...

Code:
omboFix 14-06-10.01 - Anke 10.06.2014  15:24:08.1.2 - x86
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.3033.1868 [GMT 2:00]
ausgeführt von:: c:\users\Anke\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Avira Desktop *Enabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1CD0CB2B-84B4-452D-8919-DC503DF260AE}.xps
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B963BFB0-1472-45CF-A74B-539404A932F2}.xps
c:\users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EBE21F1F-1356-43F5-B73D-C893A24EBEA0}.xps
c:\users\Anke\AppData\Roaming\.#
c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572760.###
c:\users\Anke\AppData\Roaming\.#\MBX@C3C@1572790.###
c:\users\Anke\AppData\Roaming\Kysea
c:\users\Anke\AppData\Roaming\Kysea\liyhe.eqo
c:\users\Anke\ia_remove.sh4401.tmp
c:\users\Anke\ia_remove.sh6433.tmp
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-05-10 bis 2014-06-10  ))))))))))))))))))))))))))))))
.
.
2014-06-10 13:39 . 2014-06-10 13:40        --------        d-----w-        c:\users\Anke\AppData\Local\temp
2014-06-10 13:39 . 2014-06-10 13:39        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-06-10 13:14 . 2014-06-10 13:14        39464        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys
2014-06-10 13:02 . 2014-06-10 13:02        --------        d-----w-        c:\program files\VS Revo Group
2014-06-10 12:05 . 2014-06-10 12:53        110296        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-10 12:05 . 2014-06-10 12:05        --------        d-----w-        c:\program files\Malwarebytes Anti-Malware
2014-06-10 12:05 . 2014-06-10 12:05        --------        d-----w-        c:\programdata\Malwarebytes
2014-06-10 12:05 . 2014-05-12 05:26        51928        ----a-w-        c:\windows\system32\drivers\mwac.sys
2014-06-10 12:05 . 2014-05-12 05:25        74456        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2014-06-10 12:05 . 2014-05-12 05:25        23256        ----a-w-        c:\windows\system32\drivers\mbam.sys
2014-06-10 12:05 . 2014-06-10 12:05        --------        d-----w-        c:\users\Anke\AppData\Local\Programs
2014-06-10 11:10 . 2014-06-10 13:02        --------        d-----w-        C:\FRST
2014-06-10 11:07 . 2014-04-30 23:37        8073384        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\mpengine.dll
2014-06-10 10:57 . 2014-06-10 10:58        --------        d-----w-        c:\users\Rolf
2014-06-09 10:44 . 2014-04-30 23:37        8073384        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-06-05 11:40 . 2014-05-02 11:27        765968        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C13CC024-D0E5-4524-915C-1EE8839D22E6}\gapaengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-15 10:01 . 2012-05-03 11:10        692400        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2014-05-15 10:01 . 2011-07-24 19:59        70832        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-02 11:27 . 2014-03-14 14:59        765968        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-04-29 08:37 . 2014-01-07 10:10        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2014-04-29 08:37 . 2014-01-07 10:10        93528        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2014-04-15 00:34 . 2014-04-15 00:34        1070232        ----a-w-        c:\windows\system32\MSCOMCTL.OCX
2010-06-11 14:24 . 2010-06-11 14:24        6        ----a-w-        c:\program files\Common Files\UnInstallCompleted.tmp
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-05 39408]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2013-07-26 844656]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2013-07-26 1564016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"fsn"="c:\program files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe" [2010-04-26 137792]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-22 175640]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-22 141848]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-14 8120864]
"Ocs_SM"="c:\users\Anke\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2012-08-10 106496]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2013-07-26 311152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-05-22 737872]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe -s [2013-12-7 11474272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Facebook Update"="c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
"KiesPDLR"=c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
"AutoStartNPSAgent"=c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe"
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe"
"Persistence"=c:\windows\system32\igfxpers.exe
"KiesTrayAgent"=c:\program files\Samsung\Kies\KiesTrayAgent.exe
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-05-12 1809720]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2014-05-12 860472]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-12-08 30312]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-05-12 23256]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-05-12 51928]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-01-07 37352]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2014-01-02 243128]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-05-22 430160]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2014-05-22 1039952]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2014-01-07 69240]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-29 238952]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-01-08 126976]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - MPKSL80F46909
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
HPService        REG_MULTI_SZ          HPSLPSVC
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-22 08:27        1091912        ----a-w-        c:\program files\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-03 10:01]
.
2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
- c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13]
.
2014-06-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
- c:\users\Anke\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-16 10:13]
.
2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55]
.
2014-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 14:55]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = <local>
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\05C6169637965627: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{036B15BC-BB13-470C-8C65-65E248313D7E}\75C414E4D2832353239383: DhcpNameServer = 192.168.2.1 192.168.2.1
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} - hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
FF - ProfilePath - c:\users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.flightradar24.com/53.27,7.18/10|https://www.google.de/
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{FE163F11-1919-4257-A280-FF5AF8DAEECB} - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-{43B74FAB-FB58-447D-8D3A-5F638AF36FD1} - c:\programdata\{87B61FE8-334F-4066-B7AA-68DC81782D4D}\Netzmanager1.071.0301_120720a.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-958610902.www.dreamload.com - c:\program files\Microsoft Silverlight\5.1.20913.0\Silverlight.Configuration.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-10  15:42:58
ComboFix-quarantined-files.txt  2014-06-10 13:42
.
Vor Suchlauf: 10 Verzeichnis(se), 73.167.224.832 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 76.034.895.872 Bytes frei
.
- - End Of File - - 0063E1D5C36869DF2EA37C9EB60BADC7
2E5DEBB2116B3417023E0D6562D7ED07

schrauber 11.06.2014 08:26
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

jemgumeranke 11.06.2014 15:36
Ja, habe die 3 Programme durchgeführt. Hier die Logs:
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org


Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malware Protection, Starting,
Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malware Protection, Started,
Protection, 11.06.2014 15:42:34, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting,
Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malware Protection, Starting,
Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malware Protection, Started,
Protection, 11.06.2014 16:01:26, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting,
Protection, 11.06.2014 16:03:01, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Started,
Update, 11.06.2014 16:05:25, SYSTEM, ANKE-PC, Scheduler, Malware Database, 2014.6.10.6, 2014.6.11.4,
Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Refresh, Starting,
Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Stopping,
Protection, 11.06.2014 16:05:27, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Stopped,
Protection, 11.06.2014 16:05:34, SYSTEM, ANKE-PC, Protection, Refresh, Success,
Protection, 11.06.2014 16:05:34, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Starting,
Protection, 11.06.2014 16:05:35, SYSTEM, ANKE-PC, Protection, Malicious Website Protection, Started,

(end)
Code:
# AdwCleaner v3.212 - Bericht erstellt am 11/06/2014 um 16:16:12
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (32 bits)
# Benutzername : Anke - ANKE-PC
# Gestartet von : C:\Users\Anke\Desktop\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : SearchAnonymizer

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files\Ask.com
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\Mein Gutscheincode Finder
Ordner Gelöscht : C:\windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\Anke\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\Anke\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Anke\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\DataMngr
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Anke\AppData\LocalLow\searchquband
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Toolplugin
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\ICQToolbarData
Ordner Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\welcome@toolmin.com
Datei Gelöscht : C:\Users\Anke\Desktop\eBay.lnk
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.gif
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.src
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-10.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-11.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-12.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-13.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-14.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-15.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-16.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-17.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-18.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-19.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-20.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-21.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-22.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-4.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-5.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-6.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-7.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-8.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\icqplugin-9.xml
Datei Gelöscht : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\Search_Results.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Ocs_SM]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nasa-world-wind[1]_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nasa-world-wind[1]_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\Myfree Codec
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16476

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.asktb.InstallDir", "C:\\Program Files\\Ask.com\\");
Zeile gelöscht : user_pref("extensions.asktb.OOBEVersion", "1");
Zeile gelöscht : user_pref("extensions.asktb.apn_dbr", "ie_9.0.8112.16421");
Zeile gelöscht : user_pref("extensions.asktb.autofill-text-highlight-enabled", true);
Zeile gelöscht : user_pref("extensions.asktb.cbid", "^AGS");
Zeile gelöscht : user_pref("extensions.asktb.config-updated", true);
Zeile gelöscht : user_pref("extensions.asktb.crumb", "2012.10.16+12.08.32-toolbar014iad-DE-S2Fzc2VsLEdlcm1hbnk%3D");
Zeile gelöscht : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://avira-int.ask.com/web?q={query}&qsrc={qsrc}&o={o}&l={l}&gct=bar&locale={locale}");
Zeile gelöscht : user_pref("extensions.asktb.domain", "avira-int.ask.com");
Zeile gelöscht : user_pref("extensions.asktb.domainName", "avira-int.ask.com");
Zeile gelöscht : user_pref("extensions.asktb.dtid", "^YYYYYY^YY^DE");
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q=");
Zeile gelöscht : user_pref("extensions.asktb.fresh-install", false);
Zeile gelöscht : user_pref("extensions.asktb.guid", "7c03ab2d-32f2-475c-8015-036e72b51cea");
Zeile gelöscht : user_pref("extensions.asktb.hpr", "YES");
Zeile gelöscht : user_pref("extensions.asktb.if", "su");
Zeile gelöscht : user_pref("extensions.asktb.keyword-toggled-in-session", false);
Zeile gelöscht : user_pref("extensions.asktb.last-config-req", "1402413961012");
Zeile gelöscht : user_pref("extensions.asktb.last-search-timestamp", "1358092774601");
Zeile gelöscht : user_pref("extensions.asktb.last-v", "3.15.26.100015");
Zeile gelöscht : user_pref("extensions.asktb.locale", "de_DE");
Zeile gelöscht : user_pref("extensions.asktb.localePref", true);
Zeile gelöscht : user_pref("extensions.asktb.location", "Kassel,Germany");
Zeile gelöscht : user_pref("extensions.asktb.nthp", "YES");
Zeile gelöscht : user_pref("extensions.asktb.nthp_prev", "1");
Zeile gelöscht : user_pref("extensions.asktb.o", "APN10261");
Zeile gelöscht : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Zeile gelöscht : user_pref("extensions.asktb.qsrc", "2871");
Zeile gelöscht : user_pref("extensions.asktb.r", "5");
Zeile gelöscht : user_pref("extensions.asktb.sa", "YES");
Zeile gelöscht : user_pref("extensions.asktb.saguid", "887AEBCC-AC07-4601-A9B7-0331970CA726");
Zeile gelöscht : user_pref("extensions.asktb.search-history-queries", "was ist Weinstein||cala ratjada neuigkeiten||ebay||unwetterzentrale deutschland||youtube mallorca||lionie ritchi||lionel Richi schönheitsoperation[...]
Zeile gelöscht : user_pref("extensions.asktb.search-suggestions-enabled", true);
Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade", true);
Zeile gelöscht : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", true);
Zeile gelöscht : user_pref("extensions.asktb.socialmini-first", true);
Zeile gelöscht : user_pref("extensions.asktb.socialmini-interval", "1200000");
Zeile gelöscht : user_pref("extensions.asktb.socialmini-max-char-ticker", "33");
Zeile gelöscht : user_pref("extensions.asktb.socialmini-max-items", "30");
Zeile gelöscht : user_pref("extensions.asktb.socialmini-native-on", true);
Zeile gelöscht : user_pref("extensions.asktb.socialmini-speed", "5000");
Zeile gelöscht : user_pref("extensions.asktb.themeid", "");
Zeile gelöscht : user_pref("extensions.asktb.timeinstalled", "20.10.2012 21:45:19");
Zeile gelöscht : user_pref("extensions.asktb.to", "");
Zeile gelöscht : user_pref("extensions.asktb.v", "3.15.26.100015");
Zeile gelöscht : user_pref("extensions.asktb.version", "5.15.26.45268");
Zeile gelöscht : user_pref("extensions.enabledAddons", "google%40hitachi.com:0.3,welcome%40toolmin.com:1.03,%7B800b5000-a755-47e1-992b-48a1c1357f07%7D:1.5.3,finder%40meingutscheincode.de:3.0.2,wrc%40avast.com:9.0.2018[...]
Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Zeile gelöscht : user_pref("icqtoolbar.defSearchChange", true);
Zeile gelöscht : user_pref("icqtoolbar.engineVerified", true);
Zeile gelöscht : user_pref("icqtoolbar.facebookSmilesAddonShowedPopup", true);
Zeile gelöscht : user_pref("icqtoolbar.firstTbRun", false);
Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1402413960);
Zeile gelöscht : user_pref("icqtoolbar.history", "ewe%20w%C3%A4rme%20plus%23||Kosten%20f%C3%BCr%20Anbau||Was%20kostest%20ein%20schl%C3%BCsselfertiger%20Anbau%20von%20ca.%2050%20m%C2%B2||welches%20flugzeug%20fliegt%20g[...]
Zeile gelöscht : user_pref("icqtoolbar.hpChange", true);
Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
Zeile gelöscht : user_pref("icqtoolbar.installTime", "1343503399");
Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_most_visited_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_recently_closed_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");
Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "27.0.1");
Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "131772683613177267161317830510638");
Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1402413972);
Zeile gelöscht : user_pref("icqtoolbar.userEngineApproved", true);
Zeile gelöscht : user_pref("icqtoolbar.userHpApproved", true);
Zeile gelöscht : user_pref("icqtoolbar.version", "1.5.3");
Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

-\\ Google Chrome v35.0.1916.114

[ Datei : C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://de.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [18862 octets] - [11/06/2014 16:14:35]
AdwCleaner[S0].txt - [18726 octets] - [11/06/2014 16:16:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18787 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by Anke on 11.06.2014 at 16:23:36,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iLividSetupV1[1]_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iLividSetupV1[1]_RASMANCS
Successfully deleted: [Registry Key] "hkey_current_user\software\classes\typelib\{006ad7b2-968a-11de-88c9-5bde55d89593}"
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\Program Files\myfree codec"



~~~ FireFox

Emptied folder: C:\Users\Anke\AppData\Roaming\mozilla\firefox\profiles\etpvy6y5.default\minidumps [119 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.06.2014 at 16:31:43,81
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

schrauber 12.06.2014 08:00

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

jemgumeranke 13.06.2014 19:40
Code:
SETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=c9c44d9b498aee42a7c852c55672e5b2
# engine=18684
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-13 04:32:25
# local_time=2014-06-13 06:32:25 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 95 139891 222887 0 0
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 6031577 25614339 0 0
# scanned=271732
# found=8
# cleaned=0
# scan_time=54472
sh=5E15B25E7002AF7308300569AFEBBEC992C1172A ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Backup\C\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs_11_06_2014_16_16_20.js"
sh=A47739F27C4BC8FD3A48B4A90B40679DF1218E1B ft=1 fh=ab4f3351c96b3042 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=9AC5040984D4B0DF00FD271BE03F559A9249C423 ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js"
sh=56C8CBAEB533088942E70ACFEA9B1FACD589560C ft=0 fh=0000000000000000 vn="JS/SecurityDisabler.A.Gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\prefs.js.BAK"
sh=A1303527D9A7BAF61130E38636FD53926A211D74 ft=1 fh=77b67014d8a47abf vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup-Downloader.exe"
sh=A7E501599B80D1E6548C85EF661C70D85A64ACD5 ft=1 fh=77b67014c21a5d01 vn="möglicherweise Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\airstrike2_free_setup.exe"
sh=B60CC8450EB91C56033D2ECA69506FB5B6D31122 ft=1 fh=598063cfc2fe7e7f vn="Win32/Malavida.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\desmume-windows-malavida.exe"
sh=C710AA620B81C1991468A33A5798DAF2ACED4C5E ft=1 fh=c1847d19b9c602ab vn="Variante von Win32/OpenInstall evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Anke\Downloads\FrikingShark-Downloader.exe"
Code:
Results of screen317's Security Check version 0.99.83 
 Windows 7  x86 (UAC is disabled!) 
 Out of date service pack!!
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials 
avast! Antivirus               
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 CCleaner   
 Java(TM) 6 Update 30 
 Java version out of Date!
 Adobe Flash Player        13.0.0.214 
 Adobe Reader 9 
 Adobe Reader XI 
 Mozilla Firefox 27.0.1 Firefox out of Date! 
 Mozilla Thunderbird (24.3.0)
 Google Chrome 35.0.1916.114 
 Google Chrome 35.0.1916.153 
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 AVAST Software Avast AvastSvc.exe 
 AVAST Software Avast avastui.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-06-2014 02
Ran by Anke (administrator) on ANKE-PC on 13-06-2014 16:30:10
Running from C:\Users\Anke\Downloads
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(DoctorSoft) C:\Program Files\AnyPC Client\APLanMgrC.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaRegistry.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [fsn] => C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe [137792 2010-04-26] ()
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-14] (Realtek Semiconductor)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-10] (AVAST Software)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [RemoteControl8] => C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-1871111397-3539990770-1974983793-1000\...\RunOnce: [FlashPlayerUpdate] - C:\windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [847536 2014-05-15] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.facebook.de/
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {291FBCDC-92E5-427D-A712-1449AF5758F0} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {3626E536-84F8-41F2-ABE8-D7A21962E6BD} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {43E73F3A-F350-48D0-8BEE-9B93B9514929} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {615D6B1F-D615-4511-B82F-6873B8E04546} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.de/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE376DE376
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D696537&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&k=0
SearchScopes: HKCU - {7A33B853-20BD-44F1-8EA3-4C4F0DAEDF61} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {8246A879-D4B8-4767-A85B-3E1C7CE09E0F} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {A77A1A9D-84E7-4CFC-B52C-856B0FDC714B} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {B7346A11-27AB-450F-8B41-857F3FA50296} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
SearchScopes: HKCU - {D3381FF7-E6DD-4B70-992E-B66611B65949} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {FA3102A5-D4D7-446A-877C-4EBFCF469E71} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=da570e41-b615-45d0-940f-8f05d8782de7&pid=freewarede&mode=bounce&k=0
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {902CCC37-E74D-49F0-8C10-5F10151BE923} hxxp://www.flexwatch.com/app_link/download/SmartViewer.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com/firefox
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @oberon-media.com/ONCAdapter - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @veetle.com/veetleCorePlugin,version=0.9.18 - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{815A4F63-B897-442D-9F2D-90F99FF6FE0A}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{96FD8767-6827-4D9B-AC7B-3CA21566B5B2}.xml
FF SearchPlugin: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\searchplugins\{D644E5AF-3CEF-46E9-8330-BDF49F489C9C}.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-12]
FF Extension: Google Search by Image - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\google@hitachi.com.xpi [2012-08-10]
FF Extension: Adblock Plus - C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\etpvy6y5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-01-27]
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-06-10]
FF HKCU\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Oberon com adapter) - C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Anke\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Anke\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Extension: (YouTube) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-02]
CHR Extension: (Google-Suche) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-02]
CHR Extension: (preisspion.de) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2012-12-02]
CHR Extension: (Google Wallet) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-22]
CHR Extension: (Google Mail) - C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-02]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-10]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2014-06-10]

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-10] (AVAST Software)
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [279776 2014-03-11] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RaRegistry.exe [374112 2010-11-11] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Program Files\Ralink\Common\RaMediaServer.exe [619872 2010-12-31] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [24184 2014-06-10] ()
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [67824 2014-06-10] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [81768 2014-06-10] (AVAST Software)
R0 aswRvrt; C:\windows\system32\Drivers\aswRvrt.sys [49944 2014-06-10] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [777488 2014-06-10] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [411680 2014-06-10] (AVAST Software)
R2 aswStm; C:\windows\system32\drivers\aswStm.sys [68312 2014-06-10] (AVAST Software)
R0 aswVmm; C:\windows\system32\Drivers\aswVmm.sys [180632 2014-06-10] ()
R1 dtsoftbus01; C:\windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-01-02] (Disc Soft Ltd)
R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] () [File not signed]
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
S3 netr28u; C:\windows\System32\DRIVERS\netr28u.sys [1174880 2010-12-28] (Ralink Technology Corp.)
S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Anke\AppData\Local\Temp\catchme.sys [X]
S3 dg_ssudbus; system32\DRIVERS\ssudbus.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S1 MpKsl80f46909; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18B604BB-4DC4-400F-B83B-F427DB61300C}\MpKsl80f46909.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion
2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe
2014-06-12 15:19 - 2014-06-13 16:23 - 00000000 ____D () C:\Program Files\ESET
2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe
2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt
2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt
2014-06-11 16:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-11 16:14 - 2014-06-11 16:16 - 00000000 ____D () C:\AdwCleaner
2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe
2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe
2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt
2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software
2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-10 16:36 - 2014-06-10 16:37 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe
2014-06-10 15:43 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-10 15:21 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2014-06-10 15:21 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2014-06-10 15:21 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2014-06-10 15:21 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2014-06-10 15:14 - 2014-06-10 15:43 - 00000000 ____D () C:\Qoobox
2014-06-10 15:14 - 2014-06-10 15:41 - 00000000 ____D () C:\windows\erdnt
2014-06-10 15:11 - 2014-06-10 15:12 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe
2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk
2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-10 15:01 - 2014-06-10 13:09 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe
2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:05 - 2014-06-12 15:31 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-10 14:05 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:19 - 2014-06-10 15:02 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:11 - 2014-06-10 13:12 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:10 - 2014-06-13 16:30 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-10 13:10 - 2014-06-13 16:30 - 00000000 ____D () C:\FRST
2014-06-10 13:09 - 2014-06-13 16:30 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:23 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 12:57 - 2014-06-10 15:58 - 00000000 ____D () C:\Users\Rolf
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER

==================== One Month Modified Files and Folders =======

2014-06-13 16:30 - 2014-06-13 16:30 - 00000000 ____D () C:\Users\Anke\Downloads\FRST-OlderVersion
2014-06-13 16:30 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Anke\AppData\Local\temp
2014-06-13 16:30 - 2014-06-10 13:10 - 00025594 _____ () C:\Users\Anke\Downloads\FRST.txt
2014-06-13 16:30 - 2014-06-10 13:10 - 00000000 ____D () C:\FRST
2014-06-13 16:30 - 2014-06-10 13:09 - 01073152 _____ (Farbar) C:\Users\Anke\Downloads\FRST.exe
2014-06-13 16:25 - 2010-04-24 16:55 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 16:23 - 2014-06-12 15:19 - 00000000 ____D () C:\Program Files\ESET
2014-06-13 16:22 - 2014-06-13 16:22 - 00854367 _____ () C:\Users\Anke\Downloads\SecurityCheck.exe
2014-06-13 16:05 - 2009-12-05 04:40 - 01598358 _____ () C:\windows\WindowsUpdate.log
2014-06-13 16:01 - 2012-05-03 13:10 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-13 15:18 - 2011-10-16 18:08 - 00001134 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
2014-06-13 12:25 - 2010-04-24 16:55 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 12:18 - 2011-10-16 18:08 - 00001112 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
2014-06-12 19:45 - 2012-10-25 21:27 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-12 15:31 - 2014-06-10 14:05 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 15:21 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 15:19 - 2014-06-12 15:19 - 02347384 _____ (ESET) C:\Users\Anke\Desktop\esetsmartinstaller_deu.exe
2014-06-12 15:13 - 2013-08-31 19:10 - 00000374 _____ () C:\windows\system32\Drivers\etc\hosts.ics
2014-06-12 15:11 - 2012-12-03 11:05 - 00018887 _____ () C:\windows\setupact.log
2014-06-12 15:11 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2014-06-12 15:11 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-12 15:07 - 2010-04-24 15:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 15:06 - 2013-08-12 09:43 - 00000000 ____D () C:\windows\system32\MRT
2014-06-12 15:01 - 2010-04-27 20:46 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 16:31 - 2014-06-11 16:31 - 00001622 _____ () C:\Users\Anke\Desktop\JRT.txt
2014-06-11 16:20 - 2014-06-11 16:20 - 00000000 ____D () C:\windows\ERUNT
2014-06-11 16:19 - 2014-06-11 16:19 - 00018868 _____ () C:\Users\Anke\Desktop\AdwCleaner[S0].txt
2014-06-11 16:17 - 2012-12-16 11:56 - 04199370 _____ () C:\windows\PFRO.log
2014-06-11 16:16 - 2014-06-11 16:14 - 00000000 ____D () C:\AdwCleaner
2014-06-11 16:13 - 2014-06-11 16:13 - 01016261 _____ (Thisisu) C:\Users\Anke\Desktop\JRT.exe
2014-06-11 16:09 - 2014-06-11 16:09 - 01333465 _____ () C:\Users\Anke\Desktop\adwcleaner_3.212.exe
2014-06-11 16:08 - 2014-06-11 16:08 - 00001427 _____ () C:\Users\Anke\Desktop\mbam.txt
2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-11 16:05 - 2014-01-04 20:52 - 00001057 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-11 16:05 - 2014-01-02 17:44 - 00001848 _____ () C:\Users\Anke\Desktop\Amazon.lnk
2014-06-11 16:05 - 2014-01-02 17:44 - 00001846 _____ () C:\Users\Anke\Desktop\WEB.DE.lnk
2014-06-11 16:05 - 2010-04-24 15:56 - 00001371 _____ () C:\Users\Anke\Desktop\Internet Explorer.lnk
2014-06-11 15:49 - 2012-10-16 21:09 - 00000000 ____D () C:\ProgramData\Avira
2014-06-10 17:40 - 2009-12-05 04:46 - 00000000 ____D () C:\ProgramData\Temp
2014-06-10 16:45 - 2014-06-10 16:45 - 00000000 ____D () C:\Users\Anke\AppData\Roaming\AVAST Software
2014-06-10 16:41 - 2014-06-10 16:41 - 00002083 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-10 16:41 - 2014-06-10 16:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-10 16:41 - 2014-03-23 12:24 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-06-10 16:40 - 2014-06-10 16:40 - 00777488 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00776976 _____ (AVAST Software) C:\windows\system32\Drivers\aswsnx.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00411680 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00411552 _____ (AVAST Software) C:\windows\system32\Drivers\aswsp.sys.1402411253300
2014-06-10 16:40 - 2014-06-10 16:40 - 00271264 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2014-06-10 16:40 - 2014-06-10 16:40 - 00180632 _____ () C:\windows\system32\Drivers\aswVmm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00081768 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00068312 _____ (AVAST Software) C:\windows\system32\Drivers\aswstm.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00067824 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00049944 _____ () C:\windows\system32\Drivers\aswRvrt.sys
2014-06-10 16:40 - 2014-06-10 16:40 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2014-06-10 16:40 - 2014-06-10 16:40 - 00024184 _____ () C:\windows\system32\Drivers\aswHwid.sys
2014-06-10 16:38 - 2014-06-10 16:38 - 00000000 ____D () C:\Program Files\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:37 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-10 16:37 - 2014-06-10 16:36 - 94714880 _____ (AVAST Software) C:\Users\Anke\Downloads\avast_free_antivirus_setup_21514.exe
2014-06-10 15:58 - 2014-06-10 12:57 - 00000000 ____D () C:\Users\Rolf
2014-06-10 15:43 - 2014-06-10 15:43 - 00016404 _____ () C:\ComboFix.txt
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:43 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-10 15:43 - 2014-06-10 15:14 - 00000000 ____D () C:\Qoobox
2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-06-10 15:43 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-10 15:41 - 2014-06-10 15:14 - 00000000 ____D () C:\windows\erdnt
2014-06-10 15:40 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini
2014-06-10 15:38 - 2010-04-24 15:38 - 00000000 ____D () C:\Users\Anke
2014-06-10 15:12 - 2014-06-10 15:11 - 05205915 ____R (Swearware) C:\Users\Anke\Desktop\ComboFix.exe
2014-06-10 15:02 - 2014-06-10 15:02 - 00001186 _____ () C:\Users\Anke\Desktop\Revo Uninstaller.lnk
2014-06-10 15:02 - 2014-06-10 15:02 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-10 15:02 - 2014-06-10 13:19 - 00047026 _____ () C:\Users\Anke\Desktop\FRST.txt
2014-06-10 14:58 - 2014-06-10 14:58 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Anke\Downloads\revosetup95.exe
2014-06-10 14:57 - 2014-06-10 14:57 - 00000589 _____ () C:\Users\Anke\Desktop\fixlist.txt
2014-06-10 14:49 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME
2014-06-10 14:05 - 2014-06-10 14:05 - 00001024 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-10 14:05 - 2014-06-10 14:05 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-10 14:04 - 2014-06-10 14:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Anke\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-10 13:46 - 2014-06-10 13:46 - 00002951 _____ () C:\Users\Anke\Desktop\gmer.log
2014-06-10 13:23 - 2014-06-10 13:23 - 00000242 _____ () C:\Users\Anke\Downloads\defogger_enable.log
2014-06-10 13:23 - 2014-06-10 13:08 - 00000470 _____ () C:\Users\Anke\Downloads\defogger_disable.log
2014-06-10 13:19 - 2014-06-10 13:19 - 00051480 _____ () C:\Users\Anke\Desktop\Addition.txt
2014-06-10 13:17 - 2014-06-10 13:17 - 00380416 _____ () C:\Users\Anke\Downloads\nhmwyhxd.exe
2014-06-10 13:12 - 2014-06-10 13:11 - 00051480 _____ () C:\Users\Anke\Downloads\Addition.txt
2014-06-10 13:09 - 2014-06-10 15:01 - 01177600 _____ (Farbar) C:\Users\Anke\Desktop\FRST.exe
2014-06-10 13:08 - 2014-06-10 13:08 - 00000156 _____ () C:\Users\Anke\Desktop\defogger_reenable
2014-06-10 13:07 - 2014-06-10 13:07 - 00050477 _____ () C:\Users\Anke\Downloads\Defogger (1).exe
2014-06-10 12:58 - 2009-07-26 22:06 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-16 11:08 - 2014-05-16 11:08 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-15 12:01 - 2012-05-03 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-05-15 12:01 - 2011-07-24 21:59 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

Some content of TEMP:
====================
C:\Users\Anke\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-08 13:56

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Und wie weiss ich jetzt das mein Lappi wieder ok ist? Bin extrem auf Online-Banking angewiesen

schrauber 14.06.2014 15:26
Java und Adobe updaten.

Zitat:
Bin extrem auf Online-Banking angewiesen
dann würde ich mal mein Online-Verhalten überdenken. Bei dir fehlt Servicepack 1 WIndows inklusive aller Folge-Updates. Da kann man die Kohle auch gleich verschenken ;).

Mach die Updates jetzt, solange wiederholen bis keine mehr gefunden werden.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Client <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Alle Zeitangaben in WEZ +1. Es ist jetzt 06:42 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132