Widows 7: Trojaner Befall Mitte August mit Anti-Malware entfernt system aber immernoch langsam
Hallo,
vorwegnehmen möchte ich, dass ich aus 2 defekten Notebooks 1 intaktes gebastelt habe. Windows warnt mich seither das meine Version eine Fälschung sein könnte, was sie faktisch aber nicht ist.
Letzten Monat hatte ich einen Trojaner auf dem Rechner, den ich mit Anti-Malware (Malwarebytes) entfernt habe. Seither erscheint mir das System jedoch immer noch langsamer als vorher. Es wäre wirklich eine große Hilfe wenn jemand mit Sachverstand meine Logfiles prüfen könnte, damit ich Gewissheit habe ob der Rechner sicher ist.
Die Log Files sind in folgender Reihenfolge:
1. Anti-Malware (ACHTUNG: nicht aktuell sondern vom befall)
2. Avira Free Antivirus (ACHTUNG: nicht aktuell sondern vom befall)
3. FRST (aktuell)
4. Addition (aktuell)
5. GMER (aktuell)
Ich hoffe es ist alles angefügt was notwendig ist und bedanke mich vorweg für die Hilfe!
Anti-Malware Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 14.08.2014
Scan Time: 20:32:31
Logfile: Malwarebytes_Anti_Malware_Log.txt
Administrator: Yes
Version: 2.00.2.1012
Malware Database: v2014.08.14.09
Rootkit Database: v2014.08.04.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Millefiori-Offenbach
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 291925
Time Elapsed: 14 min, 1 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 4
PUP.Optional.ELEX, C:\ProgramData\IePluginServices\PluginService.exe, 1236, Delete-on-Reboot, [522fdbebabd01026e5a1d0da0ef3e11f]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\HpUI.exe, 3016, Delete-on-Reboot, [2c5556705229142261aadff67f834db3]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader32.exe, 1524, Delete-on-Reboot, [2c5556705229142261aadff67f834db3]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader64.exe, 1492, Delete-on-Reboot, [2c5556705229142261aadff67f834db3]
Modules: 9
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
Registry Keys: 14
PUP.Optional.ELEX, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, Quarantined, [522fdbebabd01026e5a1d0da0ef3e11f],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [8af74e789ae1da5c5e052846a161946c],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [8af74e789ae1da5c5e052846a161946c],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [8af74e789ae1da5c5e052846a161946c],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [8af74e789ae1da5c5e052846a161946c],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [8af74e789ae1da5c5e052846a161946c],
PUP.Optional.SupTab.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Delete-on-Reboot, [8af74e789ae1da5c5e052846a161946c],
PUP.Optional.SupTab.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Delete-on-Reboot, [8af74e789ae1da5c5e052846a161946c],
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [344d695d413ad165038e6ebea46044bc],
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\istartsurfSoftware, Quarantined, [add451756b105cda4e4a29b35ea4c43c],
PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, Quarantined, [b0d12a9c502b3bfbf41e0a37b351f40c],
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [e0a1cbfbb0cbbf77543d67c5c14350b0],
PUP.Optional.WebSearches.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SupHpUISoft, Delete-on-Reboot, [dea35d69b4c73402187adc00c43e09f7],
PUP.Optional.Qone8, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Delete-on-Reboot, [a2df76502b50e74f6927d6568381d22e],
Registry Values: 0
(No malicious items detected)
Registry Data: 11
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[0a778541077460d650dc883ddc28ba46]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}),Replaced,[9ce5c9fd2259c86ed34fb1149b6938c8]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[bdc43d8988f38babea369e27cf35c53b]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[7908fccaef8c6fc774b05174966e738d]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[463bcdf90378a88e46f78b45659f53ad]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[077a4a7cd8a382b4e04c5f66669e8d73]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/web/?type=ds&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469&q={searchTerms}),Replaced,[800182444932da5c7da58144f60eaf51]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[790816b0ed8ed2640e120db862a2a759]
PUP.Optional.IStartSurf.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Replaced,[2958586eb0cbdf57c064ffc6dd2715eb]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[522fd5f1b6c530064fee10c09e6634cc]
PUP.Optional.IStartSurf.A, HKU\S-1-5-21-3187200561-4197913244-2507983753-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469, Good: (www.google.com), Bad: (hxxp://www.istartsurf.com/?type=hp&ts=1407441499&from=smt&uid=WDCXWD3200BPVT-80ZEST0_WD-WX91AC0T6469T6469),Delete-on-Reboot,[790812b469120b2bda476f567b898b75]
Folders: 28
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, Delete-on-Reboot, [f190616584f756e094de08c4ed15768a],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, Quarantined, [f190616584f756e094de08c4ed15768a],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, Quarantined, [2c5556705229142261aadff67f834db3],
Files: 69
PUP.Optional.ELEX, C:\ProgramData\IePluginServices\PluginService.exe, Delete-on-Reboot, [522fdbebabd01026e5a1d0da0ef3e11f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupTab.dll, Quarantined, [8af74e789ae1da5c5e052846a161946c],
Trojan.FakeMS.ED, C:\ProgramData\E0107B7B6658ADE2BD615E27C74FE1EF\bnaqav.cpp, Quarantined, [6e13d7ef7704c76f2cb34f3ca45d8779],
Trojan.FakeMS, C:\ProgramData\E0107B7B6658ADE2BD615E27C74FE1EF\vaqanb.dot, Quarantined, [98e98c3aa3d86bcb2a0f354bbb4620e0],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, Quarantined, [f190616584f756e094de08c4ed15768a],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\DpInterface64.dll, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\HpUI.exe, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader32.exe, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader64.exe, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\RSHP.exe, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SearchProtect32.dll, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SearchProtect64.dll, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupIePluginServiceUpdate.exe, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll64.dll, Delete-on-Reboot, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\bk_shadow.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\btn.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\close.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml.bak, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_box.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_check.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_bk.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_check.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit.js, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, Quarantined, [2c5556705229142261aadff67f834db3],
PUP.Optional.Spigot.A, C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "startup_urls": [ "https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ch" ],), Replaced,[7b06cbfb0378f640ab861de31fe627d9]
PUP.Optional.Spigot.A, C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "homepage": "https://de.search.yahoo.com/?type=800236&fr=spigot-yhp-ch",), Replaced,[f78a596d2e4de056af83d729c3420000]
Physical Sectors: 0
(No malicious items detected)
(end)
Avira Free Antivirus Code:
Die Datei 'D:\Download\imf13-setup.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Adware.Gen9' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '519bea05.qua' verschoben!
FRST
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-09-2014
Ran by Millefiori-Offenbach (administrator) on MILLEFIORI on 07-09-2014 12:35:38
Running from C:\Users\Millefiori-Offenbach\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
() C:\Program Files (x86)\Polar\Daemon\polard.exe
(Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Eyeo GmbH) C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_14_0_0_176_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-03-20] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-03-20] (Realtek Semiconductor)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-28] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-14] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3187200561-4197913244-2507983753-1001\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll File Not Found
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => "C:\Windows\SysWOW64\nvinit.dll" File Not Found
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE4C58813F5B7CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Program Files (x86)\TVUPlayer\npTVUAx.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-09-09]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-09]
Chrome:
=======
CHR Profile: C:\Users\Millefiori-Offenbach\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-28] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-14] (Avira Operations GmbH & Co. KG)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 Polar Daemon; C:\Program Files (x86)\Polar\Daemon\polard.exe [419536 2012-12-12] ()
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-28] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-28] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-21] ( )
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S4 nvpciflt; \SystemRoot\system32\DRIVERS\nvpciflt.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-07 12:35 - 2014-09-07 12:36 - 00011399 _____ () C:\Users\Millefiori-Offenbach\Desktop\FRST.txt
2014-09-07 12:35 - 2014-09-07 12:35 - 00000502 _____ () C:\Users\Millefiori-Offenbach\Desktop\defogger_disable.log
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 ____D () C:\FRST
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 _____ () C:\Users\Millefiori-Offenbach\defogger_reenable
2014-09-07 12:32 - 2014-09-07 12:32 - 00380416 _____ () C:\Users\Millefiori-Offenbach\Desktop\nmhkwv5n.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 02104832 _____ (Farbar) C:\Users\Millefiori-Offenbach\Desktop\FRST64.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 00050477 _____ () C:\Users\Millefiori-Offenbach\Desktop\Defogger.exe
2014-09-07 12:21 - 2014-09-07 12:21 - 00000056 _____ () C:\Windows\setupact.log
2014-09-07 12:21 - 2014-09-07 12:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-07 12:20 - 2014-09-07 12:20 - 00000624 _____ () C:\Windows\PFRO.log
2014-08-31 22:36 - 2014-08-31 22:41 - 00722432 _____ () C:\Users\Millefiori-Offenbach\Desktop\Baufi - Haus.xls
2014-08-31 08:11 - 2014-08-31 08:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 08:06 - 2014-08-31 08:06 - 05952624 _____ ( ) C:\Users\Millefiori-Offenbach\Downloads\adblockplusie-1.2.exe
2014-08-29 17:40 - 2014-08-29 17:40 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-29 17:39 - 2014-08-29 17:39 - 04901352 _____ (Piriform Ltd) C:\Users\Millefiori-Offenbach\Downloads\ccsetup417.exe
2014-08-28 23:16 - 2014-08-28 23:16 - 00559784 _____ () C:\Users\Millefiori-Offenbach\Documents\Präsentation1.pptx
2014-08-28 19:06 - 2014-09-01 22:08 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Downloads\Lachwiesen
2014-08-28 14:56 - 2014-08-28 14:56 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-28 14:56 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-28 14:54 - 2014-08-28 14:52 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-08-28 14:51 - 2014-08-28 14:51 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Avira
2014-08-28 14:50 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-28 14:50 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Avira
2014-08-28 14:50 - 2014-08-28 14:52 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-08-28 14:50 - 2014-08-28 14:52 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-08-28 14:50 - 2014-02-25 11:41 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-08-28 08:33 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 08:33 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 08:33 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-28 08:06 - 2014-08-28 08:06 - 00002884 _____ () C:\Users\Millefiori-Offenbach\Desktop\HitmanPro_20140828_0806.log
2014-08-28 07:59 - 2014-08-28 08:06 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-08-28 03:59 - 2014-08-28 04:21 - 00000000 ____D () C:\ProgramData\OqiyFuba
2014-08-24 00:18 - 2014-08-25 18:37 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\DKB Bank
2014-08-22 01:43 - 2014-08-22 01:43 - 18439741 _____ (Bauskript Software) C:\Users\Millefiori-Offenbach\Downloads\bauskript.exe
2014-08-17 09:47 - 2014-08-21 20:53 - 00013536 _____ () C:\Users\Millefiori-Offenbach\Desktop\20140817 Investrechnung Immobilie.xlsx
2014-08-16 21:19 - 2014-08-20 15:05 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\D
2014-08-15 17:30 - 2014-08-15 17:30 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Adobe
2014-08-15 09:19 - 2014-07-21 16:31 - 00763912 ____N (Hewlett-Packard Development Company, LP) C:\Windows\system32\HPDiscoPM7112.dll
2014-08-15 09:17 - 2014-08-15 09:17 - 40247720 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8610 Treiber.exe
2014-08-15 09:07 - 2014-08-15 09:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-15 09:07 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM5912.dll
2014-08-15 09:06 - 2014-08-15 09:06 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-08-15 09:05 - 2014-08-15 09:05 - 31455000 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8600 Treiber.exe
2014-08-14 21:39 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 21:39 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 21:39 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 21:39 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 21:39 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 21:39 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-14 21:38 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 21:38 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 21:37 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 21:37 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 21:37 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 21:37 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 21:37 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-14 21:37 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 21:37 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 21:37 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-14 21:37 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-14 21:37 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 21:37 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-14 21:37 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 21:37 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 21:37 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 21:37 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 21:37 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-14 21:37 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-14 21:37 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-14 21:37 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-14 21:37 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 21:37 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-14 21:37 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 21:37 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-14 21:37 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-14 21:37 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 21:37 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-14 21:37 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 21:37 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 21:37 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 21:37 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 21:37 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 21:37 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 21:37 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 21:37 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-14 21:37 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-14 21:37 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 21:37 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 21:37 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 21:37 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-14 21:37 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 21:37 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 21:37 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-14 21:37 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 21:37 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 21:37 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 21:37 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 21:37 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 21:37 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 21:37 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-14 21:37 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 21:37 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 21:37 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 21:37 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-14 21:37 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-14 21:37 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 21:37 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 21:36 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 21:36 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 21:36 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 21:36 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 21:36 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 21:36 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 21:36 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 21:36 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 21:36 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 21:36 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-14 21:08 - 2014-08-14 21:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-14 21:00 - 2014-08-28 04:56 - 00000000 ____D () C:\AdwCleaner
2014-08-14 21:00 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-14 20:31 - 2014-08-28 13:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-14 20:31 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-14 20:31 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-14 20:31 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-14 20:29 - 2014-08-14 20:29 - 00008833 _____ () C:\Users\Millefiori-Offenbach\Downloads\bookmark.htm
2014-08-14 20:14 - 2014-08-14 20:14 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-13 22:38 - 2014-08-14 20:17 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\GlarySoft
2014-08-13 22:38 - 2014-08-14 20:17 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-08-13 22:38 - 2014-08-14 19:59 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\DiskDefrag
2014-08-13 20:31 - 2014-08-13 20:31 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-13 20:31 - 2014-08-13 20:31 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-08-13 19:42 - 2014-08-13 19:42 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Nero
2014-08-13 19:34 - 2014-08-14 20:20 - 00000000 ____D () C:\ProgramData\Nero
2014-08-13 19:33 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-08-13 19:33 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-08-13 19:32 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-08-13 19:14 - 2014-08-13 22:40 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-08-12 22:50 - 2014-08-12 22:50 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-08-12 22:49 - 2014-08-12 22:49 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Canneverbe Limited
2014-08-10 21:03 - 2014-08-10 21:03 - 38603216 _____ (Amazon) C:\Users\Millefiori-Offenbach\Downloads\AmazonMusicInstaller.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-07 12:36 - 2014-09-07 12:35 - 00011399 _____ () C:\Users\Millefiori-Offenbach\Desktop\FRST.txt
2014-09-07 12:35 - 2014-09-07 12:35 - 00000502 _____ () C:\Users\Millefiori-Offenbach\Desktop\defogger_disable.log
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 ____D () C:\FRST
2014-09-07 12:35 - 2014-09-07 12:35 - 00000000 _____ () C:\Users\Millefiori-Offenbach\defogger_reenable
2014-09-07 12:35 - 2011-05-21 18:32 - 00000000 ____D () C:\Users\Millefiori-Offenbach
2014-09-07 12:32 - 2014-09-07 12:32 - 00380416 _____ () C:\Users\Millefiori-Offenbach\Desktop\nmhkwv5n.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 02104832 _____ (Farbar) C:\Users\Millefiori-Offenbach\Desktop\FRST64.exe
2014-09-07 12:31 - 2014-09-07 12:31 - 00050477 _____ () C:\Users\Millefiori-Offenbach\Desktop\Defogger.exe
2014-09-07 12:27 - 2011-03-20 01:26 - 01717026 _____ () C:\Windows\WindowsUpdate.log
2014-09-07 12:22 - 2012-07-13 16:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-07 12:21 - 2014-09-07 12:21 - 00000056 _____ () C:\Windows\setupact.log
2014-09-07 12:21 - 2014-09-07 12:21 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-07 12:21 - 2011-05-21 22:31 - 00058288 _____ (Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.dll
2014-09-07 12:21 - 2011-03-20 01:20 - 00017920 _____ () C:\Windows\system32\rpcnetp.exe
2014-09-07 12:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-07 12:20 - 2014-09-07 12:20 - 00000624 _____ () C:\Windows\PFRO.log
2014-09-07 12:19 - 2009-07-14 06:45 - 00010336 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-07 12:19 - 2009-07-14 06:45 - 00010336 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-03 19:37 - 2014-04-29 11:41 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Bewerbung
2014-09-01 22:08 - 2014-08-28 19:06 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Downloads\Lachwiesen
2014-08-31 22:41 - 2014-08-31 22:36 - 00722432 _____ () C:\Users\Millefiori-Offenbach\Desktop\Baufi - Haus.xls
2014-08-31 08:11 - 2014-08-31 08:11 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-31 08:10 - 2012-01-20 21:32 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Desktop 20120120
2014-08-31 08:06 - 2014-08-31 08:06 - 05952624 _____ ( ) C:\Users\Millefiori-Offenbach\Downloads\adblockplusie-1.2.exe
2014-08-29 17:42 - 2012-07-13 10:52 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\CC_reg_clean
2014-08-29 17:40 - 2014-08-29 17:40 - 00000824 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-29 17:40 - 2012-07-13 10:38 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-29 17:39 - 2014-08-29 17:39 - 04901352 _____ (Piriform Ltd) C:\Users\Millefiori-Offenbach\Downloads\ccsetup417.exe
2014-08-28 23:16 - 2014-08-28 23:16 - 00559784 _____ () C:\Users\Millefiori-Offenbach\Documents\Präsentation1.pptx
2014-08-28 14:56 - 2014-08-28 14:56 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-28 14:56 - 2014-08-28 14:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-28 14:56 - 2014-08-28 14:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-28 14:56 - 2014-08-28 14:50 - 00000000 ____D () C:\ProgramData\Avira
2014-08-28 14:56 - 2014-04-06 14:45 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-28 14:52 - 2014-08-28 14:54 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-08-28 14:52 - 2014-08-28 14:50 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-08-28 14:52 - 2014-08-28 14:50 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-08-28 14:51 - 2014-08-28 14:51 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Avira
2014-08-28 13:18 - 2014-08-14 20:31 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-28 08:38 - 2009-07-14 06:45 - 00353608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 08:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-08-28 08:22 - 2014-04-29 12:06 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\Schriftstücke misc
2014-08-28 08:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-28 08:06 - 2014-08-28 08:06 - 00002884 _____ () C:\Users\Millefiori-Offenbach\Desktop\HitmanPro_20140828_0806.log
2014-08-28 08:06 - 2014-08-28 07:59 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-08-28 04:56 - 2014-08-14 21:00 - 00000000 ____D () C:\AdwCleaner
2014-08-28 04:33 - 2014-04-29 11:43 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\CCRM
2014-08-28 04:21 - 2014-08-28 03:59 - 00000000 ____D () C:\ProgramData\OqiyFuba
2014-08-25 18:37 - 2014-08-24 00:18 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Documents\DKB Bank
2014-08-23 04:07 - 2014-08-28 08:33 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 08:33 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 08:33 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 10:18 - 2009-08-04 11:51 - 00714632 _____ () C:\Windows\system32\perfh007.dat
2014-08-22 10:18 - 2009-08-04 11:51 - 00154580 _____ () C:\Windows\system32\perfc007.dat
2014-08-22 10:18 - 2009-07-14 07:13 - 01660160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-22 01:43 - 2014-08-22 01:43 - 18439741 _____ (Bauskript Software) C:\Users\Millefiori-Offenbach\Downloads\bauskript.exe
2014-08-21 20:53 - 2014-08-17 09:47 - 00013536 _____ () C:\Users\Millefiori-Offenbach\Desktop\20140817 Investrechnung Immobilie.xlsx
2014-08-20 15:05 - 2014-08-16 21:19 - 00000000 ____D () C:\Users\Millefiori-Offenbach\Desktop\D
2014-08-15 17:30 - 2014-08-15 17:30 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\Adobe
2014-08-15 09:19 - 2014-08-15 09:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-08-15 09:19 - 2014-07-21 19:20 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Local\HP
2014-08-15 09:17 - 2014-08-15 09:17 - 40247720 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8610 Treiber.exe
2014-08-15 09:06 - 2014-08-15 09:06 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\ProgramData\HP
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\Program Files\HP
2014-08-15 09:06 - 2014-07-21 19:21 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-15 09:05 - 2014-08-15 09:05 - 31455000 _____ () C:\Users\Millefiori-Offenbach\Downloads\HP Officejet Pro 8600 Treiber.exe
2014-08-15 08:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-14 22:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 21:47 - 2014-04-06 16:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 21:44 - 2011-05-21 23:04 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 21:30 - 2014-04-08 20:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-14 21:29 - 2014-08-14 21:29 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-14 21:29 - 2014-08-14 21:29 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-14 21:29 - 2014-08-14 21:29 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-14 21:08 - 2014-08-14 21:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-14 21:02 - 2014-08-07 21:58 - 00001009 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-14 20:51 - 2014-05-04 11:26 - 00000000 ____D () C:\Windows\pss
2014-08-14 20:50 - 2014-05-26 23:44 - 00000000 ____D () C:\ProgramData\E0107B7B6658ADE2BD615E27C74FE1EF
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-14 20:31 - 2014-08-14 20:31 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-14 20:29 - 2014-08-14 20:29 - 00008833 _____ () C:\Users\Millefiori-Offenbach\Downloads\bookmark.htm
2014-08-14 20:20 - 2014-08-13 19:34 - 00000000 ____D () C:\ProgramData\Nero
2014-08-14 20:17 - 2014-08-13 22:38 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\GlarySoft
2014-08-14 20:17 - 2014-08-13 22:38 - 00000000 ____D () C:\ProgramData\GlarySoft
2014-08-14 20:14 - 2014-08-14 20:14 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-14 19:59 - 2014-08-13 22:38 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\DiskDefrag
2014-08-13 22:40 - 2014-08-13 19:14 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-08-13 22:07 - 2012-07-13 16:42 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-13 22:07 - 2012-07-13 16:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-13 22:07 - 2012-07-13 16:38 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-13 20:31 - 2014-08-13 20:31 - 00001905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-13 20:31 - 2014-08-13 20:31 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-08-13 19:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-08-13 19:42 - 2014-08-13 19:42 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Nero
2014-08-12 22:50 - 2014-08-12 22:50 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-08-12 22:49 - 2014-08-12 22:49 - 00000000 ____D () C:\Users\Millefiori-Offenbach\AppData\Roaming\Canneverbe Limited
2014-08-10 21:03 - 2014-08-10 21:03 - 38603216 _____ (Amazon) C:\Users\Millefiori-Offenbach\Downloads\AmazonMusicInstaller.exe
Some content of TEMP:
====================
C:\Users\Millefiori-Offenbach\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 10:42
==================== End Of Log ============================
--- --- ---
Addition Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-09-2014
Ran by Millefiori-Offenbach at 2014-09-07 12:37:15
Running from C:\Users\Millefiori-Offenbach\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adblock Plus für IE (32-Bit- und 64-Bit) (HKLM\...\{123A22CB-6D84-4135-A71F-886C9119E996}) (Version: 99.9 - Eyeo GmbH)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.176 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.2.0.591 - Amazon Services LLC)
Avira (HKLM-x32\...\{df495620-2ba9-412d-828d-b27f020d9fc8}) (Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5000 - CDBurnerXP)
Complément Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Complemento Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8610 - Grundlegende Software für das Gerät (HKLM\...\{C1586445-E3CA-45F0-A754-E6C2784CDDB7}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1029 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Messenger 分享元件 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
NVIDIA Install Application (Version: 2.1002.62.312 - NVIDIA Corporation) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
Polar Daemon (HKLM-x32\...\{2BA9320D-E061-4C71-ACCB-AC0E9D4FC82B}) (Version: 2.2.20000 - Polar Electro Oy)
Polar WebSync (HKLM-x32\...\{320453EE-6AEA-4E1A-8E64-72F33C0C928F}) (Version: 2.8.10006 - Polar Electro Oy)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6294 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10001 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SimpleOCR 3.1 (HKLM-x32\...\SimpleOCR 3.1) (Version: - )
Sonic Focus (HKLM-x32\...\{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}) (Version: 1.00.0000 - Virage Logic, Corp.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM-x32\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
מסייע Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (HKLM-x32\...\{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}) (Version: 15.4.5722.2 - Microsoft Corporation)
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (HKLM-x32\...\{622DE1BE-9EDE-49D3-B349-29D64760342A}) (Version: 15.4.5722.2 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
31-08-2014 06:10:48 Installed Adblock Plus for IE (32-bit and 64-bit)
31-08-2014 17:00:36 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {16606EB5-9E8B-4157-BB49-6F32C2190A78} - System32\Tasks\Driver Booster SkipUAC (SYSTEM) => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: {61D6C28C-A253-40A9-9DF8-70D2862E5253} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd)
Task: {6EDBAB98-36A8-415D-9A15-A60778B1CE9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-13] (Adobe Systems Incorporated)
Task: {70F31E0D-5896-4A6A-9615-2E1F376D3485} - System32\Tasks\{F2B9DC56-F9FD-4DF8-930D-47973B25A5CA} => C:\Program Files (x86)\Skype\\Phone\Skype.exe
Task: {BE45F46B-63AB-42C9-9BD5-C0523267E822} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2012-02-23 19:29 - 2005-03-12 02:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2012-12-12 15:20 - 2012-12-12 15:20 - 00419536 _____ () C:\Program Files (x86)\Polar\Daemon\polard.exe
2011-05-21 23:26 - 2011-03-02 12:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2014-01-10 07:26 - 2014-01-10 07:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2012-12-12 15:20 - 2012-12-12 15:20 - 03483856 _____ () C:\Program Files (x86)\Polar\Daemon\libpolar.dll
2014-07-14 16:49 - 2014-07-14 16:49 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-14 16:49 - 2014-07-14 16:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-01-10 07:28 - 2014-01-10 07:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-08-28 14:56 - 2014-07-14 16:49 - 00049744 _____ () C:\Users\Millefiori-Offenbach\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Polar WebSync (polargofit.com).lnk => C:\Windows\pss\Polar WebSync (polargofit.com).lnk.CommonStartup
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Massenspeichercontroller
Description: Massenspeichercontroller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (09/07/2014 00:23:04 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Error: (09/07/2014 00:22:55 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (09/07/2014 00:22:54 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.
Details:
0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800))
Error: (09/07/2014 00:22:50 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (3104) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0005D.log.
System errors:
=============
Error: (09/07/2014 00:23:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/07/2014 00:23:34 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/07/2014 00:23:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Microsoft Office Sessions:
=========================
Error: (06/30/2014 04:29:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 105790 seconds with 6300 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T6600 @ 2.20GHz
Percentage of memory in use: 37%
Total physical RAM: 4090.96 MB
Available physical RAM: 2553.41 MB
Total Pagefile: 8180.11 MB
Available Pagefile: 6430.38 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:74.52 GB) (Free:22.55 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:202.08 GB) (Free:42.4 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: E0C5913D)
Partition 1: (Not Active) - (Size=21.5 GB) - (Type=1C)
Partition 2: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=202.1 GB) - (Type=OF Extended)
==================== End Of Log ============================
GMER Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-07 12:53:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.01.0 298,09GB
Running: nmhkwv5n.exe; Driver: C:\Users\MILLEF~1\AppData\Local\Temp\uxldypod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80003405000 65 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594 fffff80003405042 4 bytes [00, 00, 00, 00]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[1964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075a41465 2 bytes [A4, 75]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[1964] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000075a414bb 2 bytes [A4, 75]
.text ... * 2
.text C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072bd1a22 2 bytes [BD, 72]
.text C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072bd1ad0 2 bytes [BD, 72]
.text C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072bd1b08 2 bytes [BD, 72]
.text C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072bd1bba 2 bytes [BD, 72]
.text C:\Windows\SysWOW64\rpcnet.exe[1328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072bd1bda 2 bytes [BD, 72]
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[1680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075a41465 2 bytes [A4, 75]
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[1680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075a414bb 2 bytes [A4, 75]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075a41465 2 bytes [A4, 75]
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075a414bb 2 bytes [A4, 75]
.text ... * 2
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075a41465 2 bytes [A4, 75]
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000075a414bb 2 bytes [A4, 75]
.text ... * 2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075a41465 2 bytes [A4, 75]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075a414bb 2 bytes [A4, 75]
.text ... * 2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075a41465 2 bytes [A4, 75]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1056] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075a414bb 2 bytes [A4, 75]
.text ... * 2
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[3028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075a41465 2 bytes [A4, 75]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[3028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075a414bb 2 bytes [A4, 75]
.text ... * 2
---- EOF - GMER 2.1 ----
|
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
