Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Malwarebytes findet PUP.Optional.Iminent.A und PUP.Optional.Somoto (https://www.trojaner-board.de/160235-malwarebytes-findet-pup-optional-iminent-a-pup-optional-somoto.html)

anja-pc 30.10.2014 16:26
Malwarebytes findet PUP.Optional.Iminent.A und PUP.Optional.Somoto
 
Hallo Trojaner-Board-Team,

mir wurde von einem Bekannten empfohlen mal einen Malwarbytes Scan durchzuführen.
Malwarebytes fand extrem viele unerwünschte Dateien.

Ich habe sowohl den Defogger als auch das FRST Tool genutzt.

Defogger :

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:57 on 30/10/2014 (anja)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST:

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014
Ran by anja (administrator) on ANJA-PC on 30-10-2014 16:00:32
Running from C:\Users\anja\Desktop
Loaded Profiles: anja &  (Available profiles: anja)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe
(Spotify Ltd) C:\Users\anja\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\anja\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [521272 2010-03-22] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2108200 2010-04-01] (Synaptics Incorporated)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [776608 2009-12-19] (Lenovo)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-06-24] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2844608 2012-10-15] (Eastman Kodak Company)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1646216 2013-04-01] (Ask)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [WLStart] => C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2235840 2012-10-19] (Eastman Kodak Company)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Voobly] => C:\Program Files (x86)\Voobly\voobly.exe [135168 2012-12-09] (Voobly)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [HP Officejet 6700 (NET)] => C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Spotify] => C:\Users\anja\AppData\Roaming\Spotify\Spotify.exe [6342200 2014-09-19] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Spotify Web Helper] => C:\Users\anja\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-09-19] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Voobly] => C:\Program Files (x86)\Voobly\voobly.exe [135168 2012-12-09] (Voobly)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [HP Officejet 6700 (NET)] => C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spotify] => C:\Users\anja\AppData\Roaming\Spotify\Spotify.exe [6342200 2014-09-19] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spotify Web Helper] => C:\Users\anja\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-09-19] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [WLStart] => C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2235840 2012-10-19] (Eastman Kodak Company)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\anja\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: HKCU - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {043C5167-00BB-4324-AF7E-62013FAEDACF} URL = hxxp://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp
SearchScopes: HKCU - {3F6DCD92-AA30-4740-B309-494619C8DF96} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=1bbe4ade-0f8d-4643-8f3a-998a88d1cebc&apn_sauid=88FD9F8F-204F-4015-84D1-DA4C35DFAA65
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: vShare Plugin -> {043C5167-00BB-4324-AF7E-62013FAEDACF} -> C:\Program Files (x86)\vShare\vshare_toolbar.dll ()
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Avira SearchFree Toolbar plus Web Protection -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM-x32 - vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files (x86)\vShare\vshare_toolbar.dll ()
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {043C5167-00BB-4324-AF7E-62013FAEDACF} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler: vsharechrome - {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} -  No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: vsharechrome - {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files (x86)\vShare\vshare_toolbar.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
FF NetworkProxy: "no_proxies_on", "*.local"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\windows\system32\TVUAx\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\abs@avira.com [2014-10-15]
FF Extension: TVU Web Player - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\firefox@tvunetworks.com [2011-09-13]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\toolbar@ask.com [2013-04-09]
FF Extension: IMinent Toolbar - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444} [2012-03-08]
FF Extension: Cliqz Beta - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\cliqz@cliqz.com.xpi [2014-09-15]
FF Extension: vshare Add-On - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\{dd05fd3d-18df-4ce4-ae53-e795339c5f01}.xpi [2011-09-13]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\cliqz@cliqz.com

Chrome:
=======
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gears.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll No File
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avira Toolbar) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl [2013-04-16]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-13]
CHR Extension: (Avira Browser Safety) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-15]
CHR Extension: (Google Wallet) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-13]
CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\anja\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.24.0.crx [2013-04-09]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R2 HPSLPSVC; C:\Users\anja\AppData\Local\Temp\7zS4D2B\hpslpsvc64.dll [1039360 2013-07-19] (Hewlett-Packard Co.) [File not signed]
S4 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [246520 2010-06-02] ()
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [579400 2009-09-22] (Lenovo Group Limited)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [736104 2012-02-14] (Tunngle.net GmbH) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-30] (Malwarebytes Corporation)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197888 2010-01-22] (SMI)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
U3 BcmSqlStartupSvc; No ImagePath
U2 IviRegMgr; No ImagePath
U2 RichVideo; No ImagePath
U3 SQLWriter; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-30 16:00 - 2014-10-30 16:01 - 00028201 _____ () C:\Users\anja\Desktop\FRST.txt
2014-10-30 16:00 - 2014-10-30 16:00 - 00000000 ____D () C:\FRST
2014-10-30 15:59 - 2014-10-30 15:59 - 02113536 _____ (Farbar) C:\Users\anja\Desktop\FRST64.exe
2014-10-30 15:57 - 2014-10-30 15:57 - 00000470 _____ () C:\Users\anja\Desktop\defogger_disable.log
2014-10-30 15:57 - 2014-10-30 15:57 - 00000000 _____ () C:\Users\anja\defogger_reenable
2014-10-30 15:56 - 2014-10-30 15:56 - 00050477 _____ () C:\Users\anja\Desktop\Defogger.exe
2014-10-30 14:36 - 2014-10-30 14:36 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-30 14:35 - 2014-10-30 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-30 14:35 - 2014-10-30 14:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-30 14:35 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-30 14:35 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-30 14:32 - 2014-10-30 14:33 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\anja\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-30 14:32 - 2014-10-30 14:33 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\anja\Downloads\mbam-setup-2.0.3.1025 (1).exe
2014-10-26 12:00 - 2014-10-26 12:00 - 09254634 _____ () C:\Users\anja\Downloads\Anhänge_20141026.zip
2014-10-15 13:30 - 2014-10-15 13:30 - 00000000 ____D () C:\c00ac36788bedc4ba7
2014-10-15 12:02 - 2014-10-16 13:32 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-15 12:01 - 2014-10-16 13:32 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 11:44 - 2014-09-15 01:44 - 03195392 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-13 09:32 - 2014-10-13 09:32 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup(2).exe
2014-10-13 09:32 - 2014-10-13 09:32 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup(1).exe
2014-10-13 09:31 - 2014-10-13 09:31 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup.exe
2014-10-06 14:03 - 2014-10-06 14:03 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-06 14:03 - 2014-10-06 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-30 15:58 - 2012-08-17 12:02 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Skype
2014-10-30 15:57 - 2010-10-15 07:09 - 00000000 ____D () C:\Users\anja
2014-10-30 15:56 - 2010-10-17 08:12 - 00131301 _____ () C:\windows\setupact.log
2014-10-30 15:55 - 2014-08-22 15:12 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Spotify
2014-10-30 15:55 - 2013-10-21 19:27 - 00000000 ___RD () C:\Users\anja\Dropbox
2014-10-30 15:55 - 2013-10-21 19:25 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Dropbox
2014-10-30 15:55 - 2011-01-01 22:48 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-30 15:55 - 2010-06-24 06:27 - 18242576 _____ () C:\FaceProv.log
2014-10-30 15:55 - 2010-06-24 06:17 - 00000000 ____D () C:\ProgramData\VeriFace
2014-10-30 15:32 - 2013-01-14 15:14 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-30 15:19 - 2011-01-01 22:48 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-30 14:36 - 2013-08-30 14:35 - 00001098 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-30 14:36 - 2013-08-30 14:35 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Malwarebytes
2014-10-30 14:36 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-30 14:36 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-30 14:35 - 2013-08-30 14:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-30 14:35 - 2013-08-30 14:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-10-30 14:34 - 2010-06-24 05:32 - 01694831 _____ () C:\windows\WindowsUpdate.log
2014-10-30 14:29 - 2010-11-20 13:28 - 00000000 ____D () C:\ProgramData\Kodak
2014-10-30 14:27 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-29 11:09 - 2010-06-23 21:20 - 00654400 _____ () C:\windows\system32\perfh007.dat
2014-10-29 11:09 - 2010-06-23 21:20 - 00130240 _____ () C:\windows\system32\perfc007.dat
2014-10-29 11:09 - 2009-07-14 06:13 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-28 20:24 - 2011-01-01 22:48 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-27 11:14 - 2011-01-01 22:48 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-27 11:14 - 2011-01-01 22:48 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-24 12:58 - 2014-07-08 15:38 - 00000000 ____D () C:\Users\anja\Documents\Fachpraktikum Garbsen
2014-10-23 14:24 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2014-10-22 17:05 - 2010-10-26 15:36 - 00000000 ____D () C:\Users\anja\Documents\AAAUnikram
2014-10-18 11:02 - 2012-10-28 13:27 - 00000000 ____D () C:\Users\anja\Documents\Nachhilfe
2014-10-17 15:16 - 2012-01-08 20:51 - 00000000 ____D () C:\Users\anja\Documents\Bewerbungen
2014-10-16 13:32 - 2013-04-09 16:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-16 13:32 - 2013-04-09 16:01 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-16 13:24 - 2009-07-14 05:45 - 00414144 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-15 17:43 - 2010-10-15 07:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-15 13:31 - 2013-08-16 13:28 - 00000000 ____D () C:\windows\system32\MRT
2014-10-15 13:30 - 2010-12-30 21:36 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-15 12:01 - 2013-04-09 16:01 - 00000000 ____D () C:\ProgramData\Avira
2014-10-14 11:57 - 2013-05-08 07:50 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-10-14 11:57 - 2013-04-09 16:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-10-14 11:57 - 2013-04-09 16:02 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-10-06 14:03 - 2014-03-01 06:51 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-10-06 14:03 - 2012-08-17 12:01 - 00000000 ____D () C:\ProgramData\Skype
2014-10-01 11:11 - 2013-08-30 14:35 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

Some content of TEMP:
====================
C:\Users\anja\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\Users\anja\AppData\Local\Temp\avgnt.exe
C:\Users\anja\AppData\Local\Temp\BetterInstaller.exe
C:\Users\anja\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplmx6lz.dll
C:\Users\anja\AppData\Local\Temp\eTypeSetup.exe
C:\Users\anja\AppData\Local\Temp\HPInstaller.exe
C:\Users\anja\AppData\Local\Temp\IcqUpdater.exe
C:\Users\anja\AppData\Local\Temp\IminentSetup{2.kKzKJAbP.1}.exe
C:\Users\anja\AppData\Local\Temp\nj5ksvii.dll
C:\Users\anja\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-26 13:03

==================== End Of Log ============================

Addition:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-10-2014
Ran by anja at 2014-10-30 16:01:45
Running from C:\Users\anja\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden
aioscnnr (x32 Version: 6.2.3.10 - Your Company Name) Hidden
aioscnnr (x32 Version: 7.3.4.0 - Your Company Name) Hidden
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.24.0 - Ask.com) <==== ATTENTION
Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Avira SearchFree Toolbar plus Web Protection Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.5.42066 - Ask.com) <==== ATTENTION
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Wireless Driver (HKLM-x32\...\{8991E763-21F5-4DEA-A938-5D9D77DCB488}) (Version: 1.0.0.0 - )
C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden
CCleaner (remove only) (HKLM-x32\...\CCleaner) (Version:  - )
center (x32 Version: 6.2.5.0 - Eastman Kodak Company) Hidden
Cisco AnyConnect VPN Client (HKLM-x32\...\{8F3EF135-1B7F-44A1-8605-CB84CF9CF615}) (Version: 2.5.3046 - Cisco Systems, Inc.)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.62 - Conexant)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2421a - CyberLink Corp.)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
Energy Management (HKLM-x32\...\{0CE226F3-EB27-4ECD-BBF5-F088716779FD}) (Version: 5.4.0.8 - Lenovo)
essentials (x32 Version: 6.0.14.0 - Eastman Kodak Company) Hidden
GIMP 2.6.11 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
HP Officejet 6700 - Grundlegende Software für das Gerät (HKLM\...\{9086D601-50B7-491D-A143-28193DADE36B}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6700 Hilfe (HKLM-x32\...\{E1AE0CB7-1333-4728-8520-CB3F88A252B4}) (Version: 140.0.2.2 - Hewlett Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
ICQ Toolbar (HKLM-x32\...\ICQToolbar) (Version: 3.0.0 - ICQ)
ICQ7.2 (HKLM-x32\...\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}) (Version: 7.2 - ICQ)
IMinent Toolbar (HKLM-x32\...\{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}) (Version: 3.26.0 - IMinent) <==== ATTENTION
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2104 - Intel Corporation)
Intel(R) IPP Run-Time Installer 5.3 Update 4 for Windows* on Intel(R) EM64T-Based Platforms (HKLM\...\{65AD609C-5935-485D-8616-3281A9601F26}) (Version: 5.3.4.087 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.6.1001 - Intel Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417025FF}) (Version: 7.0.250 - Oracle)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)
Java(TM) 6 Update 22 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416022FF}) (Version: 6.0.220 - Oracle)
Kodak AIO Printer (Version: 7.0.3.0 - Eastman Kodak Company) Hidden
KODAK All-in-One Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.6.12.20 - Eastman Kodak Company)
Koordinierungsstelle GDI-NI
ksDIP (x32 Version: 3.20.0000.0001 - Eastman Kodak Company) Hidden
Lenovo DirectShare (HKLM-x32\...\InstallShield_{B2164CCB-C002-4B80-8550-7535D80DF237}) (Version: 1.0.1.38 - ArcSoft)
Lenovo DirectShare (x32 Version: 1.0.1.38 - ArcSoft) Hidden
Lenovo EasyCamera (HKLM\...\Lenovo EasyCamera) (Version: 5.38.2.4 - Silicon Motion)
Lenovo EasyCamera (HKLM-x32\...\{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}) (Version: 5.38.2.4 - Silicon Motion)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1230 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
Lenovo ReadyComm 5 (HKLM-x32\...\{17542DBF-E17C-4562-BC4D-FA3EF3076C45}) (Version: 5.1.1.20 - Lenovo)
Lenovo ReadyComm 5.0 Service (HKLM-x32\...\{76C66170-C538-4E77-B54D-48E136B5B533}) (Version: 5.0.0.1 - Lenovo Group Limited)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{751EE164-9F12-4E57-ADB0-02D8F34A10AD}) (Version: 9.00.1399.06 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
NiedersachsenViewer Plus (HKCU\...\NiedersachsenViewer Plus) (Version:  -
ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden
Onekey Theater (HKLM-x32\...\{DFB19121-0609-49C1-92B1-546E5A940FE8}) (Version: 2.0.1.7 - Lenovo)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.4809d4 - CyberLink Corp.)
PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden
PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30116 - Realtek Semiconductor Corp.)
Rossmann Fotowelt Software 4.12.1 (HKLM-x32\...\Rossmann Fotowelt Software) (Version: 4.12.1 - ORWO Net)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.0.13074_14 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.0.13074_14 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.27.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.13.24.g5dbb3103 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.15.0 - Synaptics Incorporated)
Tunngle beta (HKLM-x32\...\Tunngle beta_is1) (Version:  - Tunngle.net GmbH)
Veetle TV 0.9.18 (HKLM-x32\...\Veetle TV) (Version: 0.9.18 - Veetle, Inc)
VeriFace (HKLM-x32\...\VeriFace) (Version: 3.6.0.1211 - Lenovo)
Voobly (HKLM-x32\...\Voobly_is1) (Version: Voobly - Voobly)
vShare Plugin (HKLM-x32\...\vShare) (Version:  - )
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-17149075-376968338-2513088794-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\anja\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

21-09-2014 14:30:06 Geplanter Prüfpunkt
30-09-2014 14:26:22 Geplanter Prüfpunkt
09-10-2014 16:42:03 Geplanter Prüfpunkt
15-10-2014 12:30:18 Windows Update
15-10-2014 16:42:07 Windows Update
26-10-2014 12:10:30 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {30360124-A3EC-4DE5-86A7-613F9E09491F} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-01] () <==== ATTENTION
Task: {7D7C7464-DFEF-4873-BB57-F56391FA396C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: {85D0AD60-58A5-47FC-A6F5-7E732389B097} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: {B2A54100-0035-4BD5-8A3D-882E84B54B65} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {FC1E5F4A-24E7-4EAD-9599-3F73B2044274} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-06-24 06:15 - 2009-12-19 03:52 - 00201120 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect64.dll
2010-06-24 06:15 - 2009-12-19 03:53 - 00156576 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll64.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-06-24 06:29 - 2009-07-15 16:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2010-06-24 06:29 - 2009-07-15 16:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2010-06-24 06:15 - 2009-12-19 03:52 - 00100256 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-06-24 05:46 - 2009-12-23 18:32 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2010-06-24 06:15 - 2009-12-19 03:50 - 00161696 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
2010-06-24 06:15 - 2009-12-19 03:51 - 00133024 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
2014-10-30 15:55 - 2014-10-30 15:55 - 00043008 _____ () c:\users\anja\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplmx6lz.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\anja\AppData\Roaming\Dropbox\bin\libcef.dll
2010-06-24 06:17 - 2010-06-24 06:17 - 00492896 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: ICQ Service => 2
MSCONFIG\startupreg: ICQ => "C:\Program Files (x86)\ICQ7.2\ICQ.exe" silent loginmode=4

========================= Accounts: ==========================

Administrator (S-1-5-21-17149075-376968338-2513088794-500 - Administrator - Disabled)
anja (S-1-5-21-17149075-376968338-2513088794-1001 - Administrator - Enabled) => C:\Users\anja
Gast (S-1-5-21-17149075-376968338-2513088794-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-17149075-376968338-2513088794-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Officejet 6700
Description: Officejet 6700
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/29/2014 02:07:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding  15 30.178.168.192.in-addr.arpa. PTR anja-PC.local.

Error: (10/29/2014 02:07:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.30:5353  17 30.178.168.192.in-addr.arpa. PTR anja-PC-2.local.

Error: (10/29/2014 10:56:59 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding  15 30.178.168.192.in-addr.arpa. PTR anja-PC.local.

Error: (10/29/2014 10:56:59 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.30:5353  17 30.178.168.192.in-addr.arpa. PTR anja-PC-2.local.

Error: (10/28/2014 07:36:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding  15 30.178.168.192.in-addr.arpa. PTR anja-PC.local.

Error: (10/28/2014 07:36:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.30:5353  17 30.178.168.192.in-addr.arpa. PTR anja-PC-2.local.

Error: (10/23/2014 04:36:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6303

Error: (10/23/2014 04:36:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6303

Error: (10/23/2014 04:36:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/23/2014 04:36:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5258


System errors:
=============
Error: (10/30/2014 02:57:21 PM) (Source: BROWSER) (EventID: 8032) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{4EF9E1F0-FF78-4386-BBB4-F10F72C41799}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.

Error: (10/30/2014 02:31:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (10/29/2014 02:10:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (10/29/2014 11:00:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (10/28/2014 07:40:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (10/28/2014 01:47:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (10/28/2014 01:47:37 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5

Error: (10/28/2014 01:47:37 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5

Error: (10/28/2014 01:39:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (10/27/2014 10:50:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2


Microsoft Office Sessions:
=========================
Error: (10/29/2014 02:07:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding  15 30.178.168.192.in-addr.arpa. PTR anja-PC.local.

Error: (10/29/2014 02:07:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.30:5353  17 30.178.168.192.in-addr.arpa. PTR anja-PC-2.local.

Error: (10/29/2014 10:56:59 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding  15 30.178.168.192.in-addr.arpa. PTR anja-PC.local.

Error: (10/29/2014 10:56:59 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.30:5353  17 30.178.168.192.in-addr.arpa. PTR anja-PC-2.local.

Error: (10/28/2014 07:36:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding  15 30.178.168.192.in-addr.arpa. PTR anja-PC.local.

Error: (10/28/2014 07:36:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.30:5353  17 30.178.168.192.in-addr.arpa. PTR anja-PC-2.local.

Error: (10/23/2014 04:36:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6303

Error: (10/23/2014 04:36:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6303

Error: (10/23/2014 04:36:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/23/2014 04:36:41 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5258


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
Percentage of memory in use: 42%
Total physical RAM: 3894.85 MB
Available physical RAM: 2232.49 MB
Total Pagefile: 7787.84 MB
Available Pagefile: 5764.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:421.81 GB) (Free:130.98 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:28.12 GB) NTFS
Drive f: (EC_108889) (CDROM) (Total:7.58 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 00700B65)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=421.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)

==================== End Of Log ============================
Danke schonmal im voraus!

Mit freundlichen Grüßen,

anja-pc

schrauber 30.10.2014 16:42
hi,

Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    Ask Toolbar

    Avira SearchFree Toolbar plus Web Protection Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.5.42066 - Ask.com) <==== ATTENTION

    IMinent Toolbar


  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 





Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

anja-pc 30.10.2014 18:38
Hallo Schrauber,

Hier die gewünschten .txt Dateien.





MBAM:

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 30.10.2014
Suchlauf-Zeit: 17:28:09
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.10.30.10
Rootkit Datenbank: v2014.10.22.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7
CPU: x64
Dateisystem: NTFS
Benutzer: anja

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 339548
Verstrichene Zeit: 31 Min, 44 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 34
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{043C5167-00BB-4324-AF7E-62013FAEDACF}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{3E315C81-442B-431C-AEC8-ED189699EC24}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{5F46C08E-A655-44E4-B7CB-34143A17FFF5}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{5F46C08E-A655-44E4-B7CB-34143A17FFF5}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{3E315C81-442B-431C-AEC8-ED189699EC24}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\vShare.ScriptHelpers.1, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\vShare.ScriptHelpers, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\vShare.ScriptHelpers, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\vShare.ScriptHelpers.1, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}, Löschen bei Neustart, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\vShare.IMedixProtocol.1, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\vShare.IMedixProtocol, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\vShare.IMedixProtocol, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\vShare.IMedixProtocol.1, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\vShare.PugiObj.1, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\CLASSES\vShare.PugiObj, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\vShare.PugiObj, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{043C5167-00BB-4324-AF7E-62013FAEDACF}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\vShare.PugiObj.1, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Löschen bei Neustart, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Löschen bei Neustart, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Löschen bei Neustart, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{043C5167-00BB-4324-AF7E-62013FAEDACF}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\CLASSES\TBSB01620.IEToolbar, In Quarantäne, [0ad8001ab7c5c6700991dc06b34f4eb2],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\CLASSES\TBSB01620.IEToolbar.1, In Quarantäne, [816130eac1bba5912d6d6b77fc068878],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TBSB01620.IEToolbar, In Quarantäne, [816130eac1bba5912d6d6b77fc068878],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TBSB01620.IEToolbar.1, In Quarantäne, [816130eac1bba5912d6d6b77fc068878],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\WOW6432NODE\Iminent, In Quarantäne, [fde576a4314bf64023cb322dd82bfd03],
PUP.Optional.Iminent.A, HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent, Löschen bei Neustart, [9c4669b19ce0f73f925dc19ea26108f8],

Registrierungswerte: 4
PUP.Optional.VShare.A, HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{043C5167-00BB-4324-AF7E-62013FAEDACF}, å?§Ð¼Â»ä?¤çº¯Å¢ê¸¿ì¿?, Löschen bei Neustart, [2eb4ef2b1963fe381005dccffa08d62a]
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{043C5167-00BB-4324-AF7E-62013FAEDACF}, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.VShare.A, HKU\S-1-5-21-17149075-376968338-2513088794-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{043C5167-00BB-4324-AF7E-62013FAEDACF}, In Quarantäne, [27bb27f3106c5fd7f421d4d791714eb2],
PUP.Optional.VShare.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{043C5167-00BB-4324-AF7E-62013FAEDACF}, In Quarantäne, [81610911dba1a4922aebacffc04223dd],

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 5
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\components, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],

Dateien: 212
PUP.Optional.VShare.A, C:\Program Files (x86)\vShare\vshare_toolbar.dll, In Quarantäne, [2eb4ef2b1963fe381005dccffa08d62a],
PUP.Optional.Somoto.A, C:\Users\anja\AppData\Local\Temp\BetterInstaller.exe, In Quarantäne, [23bf7c9e6913171ff58b45efe81936ca],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome.manifest, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\install.rdf, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\1.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\10.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\100.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\101.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\102.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\103.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\104.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\105.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\106.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\107.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\108.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\109.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\11.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\110.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\111.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\112.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\113.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\114.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\115.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\116.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\separator.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tabs.htm, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tb.css, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tb.js, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tb.xsl, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tb.xul, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\TbCommonUtils.dll, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tbcore3.dll, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tbcore3.inf, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\tbhelper.dll, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\TbHelper2.exe, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\uninstall.exe, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\update.exe, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\url_processor.htm, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\version.txt, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\118.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\119.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\12.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\120.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\121.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\122.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\123.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\124.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\125.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\126.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\127.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\128.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\129.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\13.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\130.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\131.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\132.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\133.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\134.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\135.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\137.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\138.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\139.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\14.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\140.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\141.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\142.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\143.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\144.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\145.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\146.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\147.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\148.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\149.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\15.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\150.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\151.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\152.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\153.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\154.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\156.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\157.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\158.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\159.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\16.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\160.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\161.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\162.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\163.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\164.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\165.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\166.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\167.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\168.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\169.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\17.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\170.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\171.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\18.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\19.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\117.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\136.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\155.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\2.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\39.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\58.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\77.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\96.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\mozilla.xul, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\20.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\21.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\22.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\23.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\24.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\25.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\26.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\27.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\28.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\29.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\3.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\30.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\31.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\32.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\33.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\34.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\35.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\36.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\37.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\38.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\4.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\40.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\41.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\42.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\43.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\44.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\45.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\46.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\47.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\48.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\49.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\5.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\50.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\51.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\52.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\53.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\54.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\55.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\56.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\57.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\59.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\6.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\60.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\61.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\62.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\63.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\64.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\65.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\66.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\67.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\68.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\69.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\7.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\70.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\71.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\72.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\73.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\74.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\75.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\76.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\78.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\79.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\8.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\80.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\81.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\82.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\83.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\84.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\85.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\86.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\87.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\88.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\89.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\9.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\90.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\91.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\92.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\93.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\94.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\95.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\97.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\98.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\99.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\arrow_refresh.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\ask_settings.xul, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\ask_settings_bg.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\basis.xml, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\bubble.js, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\bubble.xul, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\closeIcon.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\cog.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\computer_delete.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\contents.rdf, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\icons.bmp, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\icons.png, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\IMBooster4Web_v6.dll, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\info.txt, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\jscontainer.htm, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\md5.js, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\minibrowser.js, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\chrome\content\id_imbooster4web_v6\minibrowser.xul, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\components\Engine.dll, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\components\Engine.xpt, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],
PUP.Optional.Iminent.A, C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}\components\setup_widget_serv.exe, In Quarantäne, [de04180287f5c96d940e1f01cf3453ad],

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)



ADWCleaner:

AdwCleaner Logfile:
Code:
# AdwCleaner v4.002 - Bericht erstellt am 30/10/2014 um 18:16:34
# DB v2014-10-26.6
# Aktualisiert 27/10/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium  (64 bits)
# Benutzername : anja - ANJA-PC
# Gestartet von : C:\Users\anja\Desktop\AdwCleaner_4.002.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : ICQ Service

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\anja\AppData\Local\apn
Ordner Gelöscht : C:\Users\anja\AppData\Local\Temp\AskSearch
Ordner Gelöscht : C:\Users\anja\AppData\Roaming\eType
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Users\anja\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Program Files (x86)\vShare
Ordner Gelöscht : C:\Users\anja\AppData\LocalLow\vShare
Datei Gelöscht : C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\Askcom.xml

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKCU\Software\DSNR Labs
Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\vShare
Schlüssel Gelöscht : HKLM\SOFTWARE\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Myfree Codec
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vShare
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16476

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

-\\ Mozilla Firefox v32.0.3 (x86 de)


-\\ Google Chrome v38.0.2125.111


*************************

AdwCleaner[R0].txt - [18789 octets] - [30/10/2014 18:12:13]
AdwCleaner[S0].txt - [18012 octets] - [30/10/2014 18:16:34]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18073 octets] ##########
--- --- ---

[/CODE]



JRT:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 7 Home Premium x64
Ran by anja on 30.10.2014 at 18:23:50,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3F6DCD92-AA30-4740-B309-494619C8DF96}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}



~~~ Files

Successfully deleted: [File] "C:\windows\s.bat"



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"



~~~ FireFox

Successfully deleted: [File] C:\Users\anja\AppData\Roaming\mozilla\firefox\profiles\z018up31.default\extensions\{dd05fd3d-18df-4ce4-ae53-e795339c5f01}.xpi
Successfully deleted the following from C:\Users\anja\AppData\Roaming\mozilla\firefox\profiles\z018up31.default\prefs.js

user_pref("browser.search.order.1", "Ask.com");
user_pref("browser.search.selectedEngine", "Ask.com");
user_pref("browser.startup.homepage", "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE");
user_pref("extensions.toolbar@ask.com.install-event-fired", true);
user_pref("id_imbooster4web_v6.bubble_src", "hxxp%3A//toolbar.iminent.com/SocialNetworking/%3FvToolbar%3DIminent");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent109", "1332925941450");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent110", "1332834537252");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent111", "1332925941449");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent112", "1332925941451");
user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent140", "1332875764879");
user_pref("vshare.install.date", "1315942437");
user_pref("vshare.install.finished", "1.0.0");
user_pref("vshare.install.fresh", "false");
user_pref("vshare.install.guid", "{06e34983-cf94-4afa-a289-8bbe5d45d31a}");
user_pref("vshare.install.newtab", false);
Emptied folder: C:\Users\anja\AppData\Roaming\mozilla\firefox\profiles\z018up31.default\minidumps [118 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.10.2014 at 18:29:27,16
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



FRST:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014
Ran by anja (administrator) on ANJA-PC on 30-10-2014 18:31:39
Running from C:\Users\anja\Desktop
Loaded Profile: anja (Available profiles: anja)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe
(Spotify Ltd) C:\Users\anja\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\anja\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Thisisu) C:\Users\anja\Desktop\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [521272 2010-03-22] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2108200 2010-04-01] (Synaptics Incorporated)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [776608 2009-12-19] (Lenovo)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-06-24] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2844608 2012-10-15] (Eastman Kodak Company)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Voobly] => C:\Program Files (x86)\Voobly\voobly.exe [135168 2012-12-09] (Voobly)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [HP Officejet 6700 (NET)] => C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Spotify] => C:\Users\anja\AppData\Roaming\Spotify\Spotify.exe [6342200 2014-09-19] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Spotify Web Helper] => C:\Users\anja\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-09-19] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [WLStart] => C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2235840 2012-10-19] (Eastman Kodak Company)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\anja\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default
FF NetworkProxy: "no_proxies_on", "*.local"
FF NetworkProxy: "type", 0
FF DefaultSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\windows\system32\TVUAx\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\abs@avira.com [2014-10-15]
FF Extension: TVU Web Player - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\firefox@tvunetworks.com [2011-09-13]
FF Extension: Cliqz Beta - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\cliqz@cliqz.com.xpi [2014-09-15]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\cliqz@cliqz.com

Chrome:
=======
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gears.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll No File
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-13]
CHR Extension: (Avira Browser Safety) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-15]
CHR Extension: (Google Wallet) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R2 HPSLPSVC; C:\Users\anja\AppData\Local\Temp\7zS4D2B\hpslpsvc64.dll [1039360 2013-07-19] (Hewlett-Packard Co.) [File not signed]
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [579400 2009-09-22] (Lenovo Group Limited)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [736104 2012-02-14] (Tunngle.net GmbH) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197888 2010-01-22] (SMI)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
U3 BcmSqlStartupSvc; No ImagePath
U2 IviRegMgr; No ImagePath
U2 RichVideo; No ImagePath
U3 SQLWriter; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-30 18:31 - 2014-10-30 18:31 - 00022387 _____ () C:\Users\anja\Desktop\FRST.txt
2014-10-30 18:29 - 2014-10-30 18:29 - 00003015 _____ () C:\Users\anja\Desktop\JRT.txt
2014-10-30 18:23 - 2014-10-30 18:23 - 01706144 _____ (Thisisu) C:\Users\anja\Downloads\JRT.exe
2014-10-30 18:23 - 2014-10-30 18:23 - 01706144 _____ (Thisisu) C:\Users\anja\Desktop\JRT.exe
2014-10-30 18:23 - 2014-10-30 18:23 - 00000000 ____D () C:\windows\ERUNT
2014-10-30 18:21 - 2014-10-30 18:21 - 00000000 ____D () C:\Users\anja\Documents\trash
2014-10-30 18:20 - 2014-10-30 18:20 - 00018406 _____ () C:\Users\anja\Desktop\AdwCleaner[S0].txt
2014-10-30 18:11 - 2014-10-30 18:16 - 00000000 ____D () C:\AdwCleaner
2014-10-30 18:11 - 2014-10-30 18:11 - 01998336 _____ () C:\Users\anja\Desktop\AdwCleaner_4.002.exe
2014-10-30 18:09 - 2014-10-30 18:09 - 00059595 _____ () C:\Users\anja\Desktop\mbam.txt
2014-10-30 17:06 - 2014-10-30 17:06 - 00001260 _____ () C:\Users\anja\Desktop\Revo Uninstaller.lnk
2014-10-30 17:06 - 2014-10-30 17:06 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-30 17:05 - 2014-10-30 17:05 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\anja\Desktop\revosetup95.exe
2014-10-30 16:00 - 2014-10-30 18:31 - 00000000 ____D () C:\FRST
2014-10-30 15:59 - 2014-10-30 15:59 - 02113536 _____ (Farbar) C:\Users\anja\Desktop\FRST64.exe
2014-10-30 15:57 - 2014-10-30 15:57 - 00000470 _____ () C:\Users\anja\Desktop\defogger_disable.log
2014-10-30 15:57 - 2014-10-30 15:57 - 00000000 _____ () C:\Users\anja\defogger_reenable
2014-10-30 15:56 - 2014-10-30 15:56 - 00050477 _____ () C:\Users\anja\Desktop\Defogger.exe
2014-10-30 14:36 - 2014-10-30 18:08 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-30 14:35 - 2014-10-30 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-30 14:35 - 2014-10-30 14:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-30 14:35 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-30 14:35 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-30 14:32 - 2014-10-30 14:33 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\anja\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-30 14:32 - 2014-10-30 14:33 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\anja\Downloads\mbam-setup-2.0.3.1025 (1).exe
2014-10-26 12:00 - 2014-10-26 12:00 - 09254634 _____ () C:\Users\anja\Downloads\Anhänge_20141026.zip
2014-10-15 13:30 - 2014-10-15 13:30 - 00000000 ____D () C:\c00ac36788bedc4ba7
2014-10-15 12:02 - 2014-10-16 13:32 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-15 12:01 - 2014-10-16 13:32 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 11:44 - 2014-09-15 01:44 - 03195392 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-13 09:32 - 2014-10-13 09:32 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup(2).exe
2014-10-13 09:32 - 2014-10-13 09:32 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup(1).exe
2014-10-13 09:31 - 2014-10-13 09:31 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup.exe
2014-10-06 14:03 - 2014-10-06 14:03 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-06 14:03 - 2014-10-06 14:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-30 18:32 - 2013-01-14 15:14 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-30 18:26 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-30 18:26 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-30 18:20 - 2014-08-22 15:12 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Spotify
2014-10-30 18:20 - 2013-10-21 19:27 - 00000000 ___RD () C:\Users\anja\Dropbox
2014-10-30 18:20 - 2013-10-21 19:25 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Dropbox
2014-10-30 18:19 - 2012-08-17 12:02 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Skype
2014-10-30 18:19 - 2011-01-01 22:48 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-30 18:18 - 2010-06-24 06:27 - 18263290 _____ () C:\FaceProv.log
2014-10-30 18:18 - 2010-06-24 06:17 - 00000000 ____D () C:\ProgramData\VeriFace
2014-10-30 18:17 - 2011-06-28 21:39 - 00269176 _____ () C:\windows\PFRO.log
2014-10-30 18:17 - 2011-01-01 22:48 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-30 18:17 - 2010-11-20 13:28 - 00000000 ____D () C:\ProgramData\Kodak
2014-10-30 18:17 - 2010-10-17 08:12 - 00131469 _____ () C:\windows\setupact.log
2014-10-30 18:17 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-30 18:16 - 2010-06-24 05:32 - 01716296 _____ () C:\windows\WindowsUpdate.log
2014-10-30 18:01 - 2011-03-24 22:00 - 00000000 ____D () C:\windows\Minidump
2014-10-30 15:57 - 2010-10-15 07:09 - 00000000 ____D () C:\Users\anja
2014-10-30 14:36 - 2013-08-30 14:35 - 00001098 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-30 14:36 - 2013-08-30 14:35 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Malwarebytes
2014-10-30 14:35 - 2013-08-30 14:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-30 14:35 - 2013-08-30 14:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-10-29 11:09 - 2010-06-23 21:20 - 00654400 _____ () C:\windows\system32\perfh007.dat
2014-10-29 11:09 - 2010-06-23 21:20 - 00130240 _____ () C:\windows\system32\perfc007.dat
2014-10-29 11:09 - 2009-07-14 06:13 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-28 20:24 - 2011-01-01 22:48 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-27 11:14 - 2011-01-01 22:48 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-27 11:14 - 2011-01-01 22:48 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-24 12:58 - 2014-07-08 15:38 - 00000000 ____D () C:\Users\anja\Documents\Fachpraktikum Garbsen
2014-10-23 14:24 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2014-10-22 17:05 - 2010-10-26 15:36 - 00000000 ____D () C:\Users\anja\Documents\AAAUnikram
2014-10-18 11:02 - 2012-10-28 13:27 - 00000000 ____D () C:\Users\anja\Documents\Nachhilfe
2014-10-17 15:16 - 2012-01-08 20:51 - 00000000 ____D () C:\Users\anja\Documents\Bewerbungen
2014-10-16 13:32 - 2013-04-09 16:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-16 13:32 - 2013-04-09 16:01 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-10-16 13:24 - 2009-07-14 05:45 - 00414144 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-15 17:43 - 2010-10-15 07:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-15 13:31 - 2013-08-16 13:28 - 00000000 ____D () C:\windows\system32\MRT
2014-10-15 13:30 - 2010-12-30 21:36 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-15 12:01 - 2013-04-09 16:01 - 00000000 ____D () C:\ProgramData\Avira
2014-10-14 11:57 - 2013-05-08 07:50 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-10-14 11:57 - 2013-04-09 16:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-10-14 11:57 - 2013-04-09 16:02 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-10-06 14:03 - 2014-03-01 06:51 - 00002517 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-10-06 14:03 - 2012-08-17 12:01 - 00000000 ____D () C:\ProgramData\Skype
2014-10-01 11:11 - 2013-08-30 14:35 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

Some content of TEMP:
====================
C:\Users\anja\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\Users\anja\AppData\Local\Temp\avgnt.exe
C:\Users\anja\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpdohxhs.dll
C:\Users\anja\AppData\Local\Temp\eTypeSetup.exe
C:\Users\anja\AppData\Local\Temp\HPInstaller.exe
C:\Users\anja\AppData\Local\Temp\IcqUpdater.exe
C:\Users\anja\AppData\Local\Temp\IminentSetup{2.kKzKJAbP.1}.exe
C:\Users\anja\AppData\Local\Temp\nj5ksvii.dll
C:\Users\anja\AppData\Local\Temp\Quarantine.exe
C:\Users\anja\AppData\Local\Temp\SkypeSetup.exe
C:\Users\anja\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-26 13:03

==================== End Of Log ============================
--- --- ---



Mit freundlichen grüßen,
anja-pc

schrauber 31.10.2014 10:06

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

anja-pc 09.11.2014 18:19
Hallo Schrauber,
hier die gewünschten Ergebnisse.

ESET:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=57f13691dd39184188a73269cdc80588
# engine=20894
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-11-02 08:57:23
# local_time=2014-11-02 09:57:23 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 15113 159514021 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 49458719 166591693 0 0
# scanned=251020
# found=9
# cleaned=0
# scan_time=10480
sh=BB6FE4258A70A25C647850ED8B6A6D65F829523F ft=0 fh=0000000000000000 vn="JS/Exploit.Agent.NGQ Trojaner" ac=I fn="C:\Users\anja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\UG5VUDGZ\ue1a0nmn92[1].htm"
sh=AD32592256EC2625AC8F02A24B56F14C7F980214 ft=1 fh=537e405fad3fc69d vn="Variante von Win32/Toolbar.eType.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\anja\AppData\Local\Temp\eTypeSetup.exe"
sh=8DB51595492609FFF73800174DDBC6363C1DA181 ft=1 fh=e03aa7f093055e9b vn="Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\anja\AppData\Local\Temp\IminentSetup{2.kKzKJAbP.1}.exe"
sh=609F2D4B1AE5C7177C44CCAF9309EFD16FC9E42D ft=1 fh=8551c46845849e5f vn="Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\TbHelper2.exe"
sh=22B1B0EAFDBB1229336F9D8187F9905A5DDEDF89 ft=1 fh=406c1e66a46fc082 vn="Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\uninstall.exe"
sh=88CA2B9C5E587306B08CF6EA239CA72775495695 ft=1 fh=b15f3040528a74fd vn="Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\update.exe"
sh=609F2D4B1AE5C7177C44CCAF9309EFD16FC9E42D ft=1 fh=8551c46845849e5f vn="Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\TbHelper2.exe"
sh=22B1B0EAFDBB1229336F9D8187F9905A5DDEDF89 ft=1 fh=406c1e66a46fc082 vn="Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\uninstall.exe"
sh=88CA2B9C5E587306B08CF6EA239CA72775495695 ft=1 fh=b15f3040528a74fd vn="Variante von Win32/Toolbar.Iminent.E evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Toolbar4\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\update.exe"

Security-Check:

Code:
Results of screen317's Security Check version 0.99.89 
 Windows 7  x64 (UAC is enabled) 
 Out of date service pack!!
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 CCleaner (remove only) 
 Java 7 Update 45 
 Java version out of Date!
 Adobe Flash Player 15.0.0.152 
 Adobe Reader 9 Adobe Reader out of Date!
 Mozilla Firefox 32.0.3 Firefox out of Date! 
 Google Chrome 38.0.2125.104 
 Google Chrome 38.0.2125.111 
````````Process Check: objlist.exe by Laurent```````` 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
Und das frische FRST:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-11-2014
Ran by anja (administrator) on ANJA-PC on 09-11-2014 18:15:32
Running from C:\Users\anja\Desktop
Loaded Profile: anja (Available profiles: anja)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BBSvc.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe
(Spotify Ltd) C:\Users\anja\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\anja\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [521272 2010-03-22] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2108200 2010-04-01] (Synaptics Incorporated)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [776608 2009-12-19] (Lenovo)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-06-24] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2844608 2012-10-15] (Eastman Kodak Company)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124720 2014-10-09] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Voobly] => C:\Program Files (x86)\Voobly\voobly.exe [135168 2012-12-09] (Voobly)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-26] (Samsung)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [HP Officejet 6700 (NET)] => C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Spotify] => C:\Users\anja\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-11-03] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Spotify Web Helper] => C:\Users\anja\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-11-03] (Spotify Ltd)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
HKU\S-1-5-21-17149075-376968338-2513088794-1001\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-18\...\RunOnce: [WLStart] => C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2235840 2012-10-19] (Eastman Kodak Company)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\anja\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\anja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default
FF DefaultSearchEngine: Google
FF NetworkProxy: "no_proxies_on", "*.local"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\windows\system32\TVUAx\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\abs@avira.com [2014-10-15]
FF Extension: TVU Web Player - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\firefox@tvunetworks.com [2011-09-13]
FF Extension: Cliqz Beta - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\Extensions\cliqz@cliqz.com.xpi [2014-09-15]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\anja\AppData\Roaming\Mozilla\Firefox\Profiles\z018up31.default\extensions\cliqz@cliqz.com

Chrome:
=======
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gears.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll No File
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-13]
CHR Extension: (Avira Browser Safety) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-10-15]
CHR Extension: (Google Wallet) - C:\Users\anja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-13]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-14] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [162096 2014-10-09] (Avira Operations GmbH & Co. KG)
R2 HPSLPSVC; C:\Users\anja\AppData\Local\Temp\7zS4D2B\hpslpsvc64.dll [1039360 2013-07-19] (Hewlett-Packard Co.) [File not signed]
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [579400 2009-09-22] (Lenovo Group Limited)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [736104 2012-02-14] (Tunngle.net GmbH) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197888 2010-01-22] (SMI)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
U3 BcmSqlStartupSvc; No ImagePath
U2 IviRegMgr; No ImagePath
U2 RichVideo; No ImagePath
U3 SQLWriter; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-09 18:15 - 2014-11-09 18:15 - 00024137 _____ () C:\Users\anja\Desktop\FRST.txt
2014-11-09 18:15 - 2014-11-09 18:15 - 00000000 ____D () C:\Users\anja\Desktop\FRST-OlderVersion
2014-11-09 18:08 - 2014-11-09 18:08 - 00854448 _____ () C:\Users\anja\Desktop\SecurityCheck.exe
2014-11-02 22:10 - 2014-11-02 22:10 - 00003042 _____ () C:\Users\anja\Documents\Lennart Virus.txt
2014-11-02 18:57 - 2014-11-02 18:57 - 02347384 _____ (ESET) C:\Users\anja\Desktop\esetsmartinstaller_deu.exe
2014-11-02 18:51 - 2014-11-02 18:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\anja\Downloads\revosetup95.exe
2014-11-01 16:36 - 2014-11-01 16:36 - 00091785 _____ () C:\Users\anja\Downloads\Schüleraktivierender_Unterricht_in_der_Sekundarstufe-Neue_Dokumente.zip
2014-10-31 16:45 - 2014-10-31 16:45 - 00003614 _____ () C:\windows\System32\Tasks\HPCustParticipation HP Photosmart 5520 series
2014-10-31 16:45 - 2014-10-31 16:45 - 00001987 _____ () C:\Users\Public\Desktop\HP Photo Creations.lnk
2014-10-31 16:45 - 2014-10-31 16:45 - 00000000 ____D () C:\ProgramData\HP Photo Creations
2014-10-31 16:45 - 2014-10-31 16:45 - 00000000 ____D () C:\Program Files (x86)\HP Photo Creations
2014-10-31 16:44 - 2014-11-08 13:48 - 00000000 ____D () C:\Users\anja\AppData\Roaming\HpUpdate
2014-10-31 16:44 - 2014-10-31 16:44 - 00002248 _____ () C:\Users\Public\Desktop\HP Photosmart 5520 series.lnk
2014-10-31 16:44 - 2014-10-31 16:44 - 00001180 _____ () C:\Users\Public\Desktop\Shop für Zubehör - HP Photosmart 5520 series.lnk
2014-10-31 16:44 - 2012-10-17 04:31 - 00741480 ____N (Hewlett-Packard Co.) C:\windows\system32\HPDiscoPMB111.dll
2014-10-30 18:23 - 2014-10-30 18:23 - 01706144 _____ (Thisisu) C:\Users\anja\Downloads\JRT.exe
2014-10-30 18:23 - 2014-10-30 18:23 - 01706144 _____ (Thisisu) C:\Users\anja\Desktop\JRT.exe
2014-10-30 18:23 - 2014-10-30 18:23 - 00000000 ____D () C:\windows\ERUNT
2014-10-30 18:21 - 2014-10-30 18:40 - 00000000 ____D () C:\Users\anja\Documents\trash
2014-10-30 18:11 - 2014-10-30 18:16 - 00000000 ____D () C:\AdwCleaner
2014-10-30 18:11 - 2014-10-30 18:11 - 01998336 _____ () C:\Users\anja\Desktop\AdwCleaner_4.002.exe
2014-10-30 17:06 - 2014-10-30 17:06 - 00001260 _____ () C:\Users\anja\Desktop\Revo Uninstaller.lnk
2014-10-30 17:06 - 2014-10-30 17:06 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-30 17:05 - 2014-10-30 17:05 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\anja\Desktop\revosetup95.exe
2014-10-30 16:00 - 2014-11-09 18:15 - 00000000 ____D () C:\FRST
2014-10-30 15:59 - 2014-11-09 18:15 - 02115584 _____ (Farbar) C:\Users\anja\Desktop\FRST64.exe
2014-10-30 15:57 - 2014-10-30 15:57 - 00000000 _____ () C:\Users\anja\defogger_reenable
2014-10-30 15:56 - 2014-10-30 15:56 - 00050477 _____ () C:\Users\anja\Desktop\Defogger.exe
2014-10-30 14:36 - 2014-10-30 18:08 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-30 14:35 - 2014-10-30 14:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-30 14:35 - 2014-10-30 14:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-30 14:35 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-30 14:35 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-30 14:32 - 2014-10-30 14:33 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\anja\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-30 14:32 - 2014-10-30 14:33 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\anja\Downloads\mbam-setup-2.0.3.1025 (1).exe
2014-10-26 12:00 - 2014-10-26 12:00 - 09254634 _____ () C:\Users\anja\Downloads\Anhänge_20141026.zip
2014-10-15 13:30 - 2014-10-15 13:30 - 00000000 ____D () C:\c00ac36788bedc4ba7
2014-10-15 12:02 - 2014-11-04 14:14 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-10-15 12:01 - 2014-11-04 14:14 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-15 11:44 - 2014-09-15 01:44 - 03195392 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-13 09:32 - 2014-10-13 09:32 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup(2).exe
2014-10-13 09:32 - 2014-10-13 09:32 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup(1).exe
2014-10-13 09:31 - 2014-10-13 09:31 - 00880272 _____ (Google Inc.) C:\Users\anja\Downloads\ChromeSetup.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-09 18:08 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-09 18:08 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-09 18:05 - 2010-11-20 13:28 - 00000000 ____D () C:\ProgramData\Kodak
2014-11-09 18:05 - 2010-06-24 05:32 - 01857183 _____ () C:\windows\WindowsUpdate.log
2014-11-09 18:03 - 2013-10-21 19:27 - 00000000 ___RD () C:\Users\anja\Dropbox
2014-11-09 18:03 - 2013-10-21 19:25 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Dropbox
2014-11-09 18:02 - 2014-08-22 15:12 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Spotify
2014-11-09 18:01 - 2010-06-24 06:17 - 00000000 ____D () C:\ProgramData\VeriFace
2014-11-09 18:00 - 2011-01-01 22:48 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-09 18:00 - 2010-06-24 06:27 - 18369829 _____ () C:\FaceProv.log
2014-11-09 17:59 - 2010-10-17 08:12 - 00132029 _____ () C:\windows\setupact.log
2014-11-09 17:59 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-08 22:32 - 2013-01-14 15:14 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-08 22:19 - 2011-01-01 22:48 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-08 17:55 - 2014-09-25 18:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-04 14:14 - 2013-04-09 16:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-11-04 14:14 - 2013-04-09 16:01 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-11-02 18:57 - 2010-06-23 21:20 - 00654400 _____ () C:\windows\system32\perfh007.dat
2014-11-02 18:57 - 2010-06-23 21:20 - 00130240 _____ () C:\windows\system32\perfc007.dat
2014-11-02 18:57 - 2009-07-14 06:13 - 01498742 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-02 18:48 - 2014-08-22 15:13 - 00000000 ____D () C:\Users\anja\AppData\Local\Spotify
2014-11-01 13:30 - 2012-08-17 12:02 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Skype
2014-10-31 17:20 - 2011-02-19 17:49 - 00000000 ____D () C:\Users\anja\.gimp-2.6
2014-10-31 16:48 - 2014-08-07 16:38 - 00000000 ____D () C:\Users\anja\AppData\Local\HP
2014-10-31 16:45 - 2014-08-07 16:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-10-31 16:44 - 2014-08-07 16:39 - 00000000 ____D () C:\Program Files\HP
2014-10-31 16:44 - 2014-08-07 16:39 - 00000000 ____D () C:\Program Files (x86)\HP
2014-10-31 16:44 - 2014-08-07 16:29 - 00000000 ____D () C:\ProgramData\HP
2014-10-30 18:17 - 2011-06-28 21:39 - 00269176 _____ () C:\windows\PFRO.log
2014-10-30 18:16 - 2010-10-17 15:55 - 00000000 ____D () C:\ProgramData\ICQ
2014-10-30 18:03 - 2011-03-24 22:00 - 00000000 ____D () C:\windows\Minidump
2014-10-30 15:57 - 2010-10-15 07:09 - 00000000 ____D () C:\Users\anja
2014-10-30 14:36 - 2013-08-30 14:35 - 00001098 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-30 14:36 - 2013-08-30 14:35 - 00000000 ____D () C:\Users\anja\AppData\Roaming\Malwarebytes
2014-10-30 14:35 - 2013-08-30 14:35 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-30 14:35 - 2013-08-30 14:35 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-10-28 20:24 - 2011-01-01 22:48 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-27 11:14 - 2011-01-01 22:48 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-27 11:14 - 2011-01-01 22:48 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-24 12:58 - 2014-07-08 15:38 - 00000000 ____D () C:\Users\anja\Documents\Fachpraktikum Garbsen
2014-10-23 14:24 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2014-10-22 17:05 - 2010-10-26 15:36 - 00000000 ____D () C:\Users\anja\Documents\AAAUnikram
2014-10-18 11:02 - 2012-10-28 13:27 - 00000000 ____D () C:\Users\anja\Documents\Nachhilfe
2014-10-17 15:16 - 2012-01-08 20:51 - 00000000 ____D () C:\Users\anja\Documents\Bewerbungen
2014-10-16 13:24 - 2009-07-14 05:45 - 00414144 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-15 17:43 - 2010-10-15 07:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-15 13:31 - 2013-08-16 13:28 - 00000000 ____D () C:\windows\system32\MRT
2014-10-15 13:30 - 2010-12-30 21:36 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-15 12:01 - 2013-04-09 16:01 - 00000000 ____D () C:\ProgramData\Avira
2014-10-14 11:57 - 2013-05-08 07:50 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-10-14 11:57 - 2013-04-09 16:02 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-10-14 11:57 - 2013-04-09 16:02 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys

Some content of TEMP:
====================
C:\Users\anja\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\Users\anja\AppData\Local\Temp\avgnt.exe
C:\Users\anja\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_h6aws.dll
C:\Users\anja\AppData\Local\Temp\eTypeSetup.exe
C:\Users\anja\AppData\Local\Temp\HPInstaller.exe
C:\Users\anja\AppData\Local\Temp\IcqUpdater.exe
C:\Users\anja\AppData\Local\Temp\IminentSetup{2.kKzKJAbP.1}.exe
C:\Users\anja\AppData\Local\Temp\nj5ksvii.dll
C:\Users\anja\AppData\Local\Temp\Quarantine.exe
C:\Users\anja\AppData\Local\Temp\SkypeSetup.exe
C:\Users\anja\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-05 14:05

==================== End Of Log ============================
--- --- ---


Gruß.

schrauber 10.11.2014 15:01
Java, Adobe und Firefox updaten.

Windows updaten, da fehlt ein ganzes Servicepack!!! Dann bitte ein frisches FRST log.


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:13 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19