Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Werbefenster, veränderte Startseiten, unbekannte Software (https://www.trojaner-board.de/150431-werbefenster-veraenderte-startseiten-unbekannte-software.html)

Drai-cin 28.02.2014 16:20
Werbefenster, veränderte Startseiten, unbekannte Software
 
Sehrt geehrte Damen und Herren, ich habe den PC einer Freundin (Null-Ahnung) bekommen weil das Internet verrückt spielt und ich es richten soll. Als Symptome zeigten sich übermäßig viele Werbefenster und veränderte Startseiten im Internet Explorer und Chrome. Außerdem fand ich verdächtige Programme: Mobogenie, Internet Updater, Desk365, BrowserSafeGuard, Tube Dimmer, Sup Tab, Ie PluginService, Visuellbee, Re-Markable Software, MyPCBackup, Create Amazing Presentations. Zuerst habe ich alles in der Systemsteuerung unter Software diese Programme deinstalliert. Anschließend nutzte ich den CCleaner Portable, AdwCleaner, Junk Removal Tool und Malwarebytes (in dieser Reihenfolge), da ich auf dem eigenen PC bereits gegen Iminent kämpfen musste. Hier die Logs, außer CCleaner (weis nicht wie oder ob der sowas erstellt). Hoffe ihr könnt helfen und nach getaner Arbeit wird Sie geschult!

schrauber 28.02.2014 19:38
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307



Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Drai-cin 28.02.2014 21:07
Das mit den Code-Tag wusste ich nicht, sorry. Hier die zwei Logs:
Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-02-2014 02
Ran by SCHEIDENBERGER Heike at 2014-02-28 21:02:00
Running from C:\Users\SCHEIDENBERGER Heike\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
@promt Expert 7.8 EGGE (HKLM\...\{FDACDD95-4B15-404C-B0A4-9C792E60B6D4}) (Version: 7.8.00009 - PROMT Ltd.)
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.5.0.600 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.5.0.600 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
Adobe Shockwave Player (HKLM\...\{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}) (Version: 10.2.0.023 - Adobe Systems, Inc.)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.8.638 - Adobe Systems, Inc.)
Amazing Adventures The Lost Tomb 1.0.0.5 (HKLM\...\Amazing Adventures The Lost Tomb 1.0.0.5) (Version:  - )
Apple Application Support (HKLM\...\{F5266D28-E0B2-4130-BFC5-EE155AD514DC}) (Version: 2.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{CACAEB5F-174D-4C7C-AC56-A33289A807CA}) (Version: 3.4.0.25 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft PhotoImpression 3.0 (HKLM\...\ArcSoft PhotoImpression 3.0) (Version:  - )
Atheros Driver Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.1 - Atheros)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.338 - Avira)
Bonjour (HKLM\...\{C2E4B5BD-32DB-4817-A060-341AB17C3F90}) (Version: 2.0.5.0 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 3.24 - Piriform)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.36.7.60 - Conexant)
Copy Utility (HKLM\...\Copy Utility) (Version:  - )
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1002 - CyberLink Corp.)
CyberLink YouCam (Version: 1.0.1002 - CyberLink Corp.) Hidden
Die drei Freunde von der Reitschule (HKLM\...\{C4688657-3541-4CAC-9C56-EE964732F8A6}) (Version: 1.0.0 - Rondomedia)
DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.5.0928 - CyberLink Corp.)
EA Link (HKLM\...\InstallShield_{F5577101-33CC-4711-8235-3A95BCD49DB0}) (Version: 3.1.1.4 - Electronic Arts)
EA Link (Version: 3.1.1.4 - Electronic Arts) Hidden
ESU for Microsoft Vista (HKLM\...\{65AA10FF-6F32-48AE-881F-FC96E7BF3A5E}) (Version: 2.0.11.1 - Hewlett-Packard)
Google Chrome (HKCU\...\Google Chrome) (Version: 31.0.1650.63 - Google Inc.)
Google Earth (HKLM\...\{3E8A20E1-223F-11E2-9116-B8AC6F98CCE3}) (Version: 7.0.1.8244 - Google)
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDAUDIO_HERMOSA_HSF) (Version:  - )
Hewlett-Packard Active Check (Version: 1.1.11.0 - Hewlett-Packard) Hidden
Hewlett-Packard Asset Agent for Health Check (Version: 2.0.62.5 - HP) Hidden
Horse Life (HKLM\...\Horse Life_is1) (Version:  - )
HP Active Support Library (HKLM\...\{11BB336F-0E58-4977-B866-F24FA334616B}) (Version: 2.3.0.2 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM\...\{BD0E2B92-3814-46F0-893B-4612EA010C7E}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Doc Viewer (HKLM\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.02.0001 - Hewlett-Packard)
HP DVD Play 3.6 (HKLM\...\{45D707E9-F3C4-11D9-A373-0050BAE317E1}) (Version:  - )
HP Easy Setup - Frontend (HKLM\...\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}) (Version: 5.4.0.2430 - Hewlett-Packard)
HP Help and Support (HKLM\...\{28EDCE9C-3304-4331-8AB3-F3EBE94C35B4}) (Version: 1.5.1 - Hewlett-Packard)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (HKLM\...\{DEB23231-0851-4E3E-A2DB-EED8A40B0883}) (Version: 22.0.334.0 - Hewlett-Packard Co.)
HP Officejet Pro 8500 A910 Hilfe (HKLM\...\{13D324E9-9DB1-478D-944C-28BBE1BB80DC}) (Version: 140.0.2.2 - Hewlett Packard)
HP Product Detection (HKLM\...\{4F38594F-2C4A-4C42-B2C4-505E225F6F80}) (Version: 11.14.0004 - HP)
HP Quick Launch Buttons (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.14.1 - Hewlett-Packard Company)
HP Total Care Advisor (HKLM\...\{b02df929-29a7-4fd2-9a70-81a644b635f7}) (Version: 1.4.19.2433 - Hewlett-Packard)
HP User Guides 0091 (HKLM\...\{E6D3A461-8DDE-45C9-8C34-A33436FCC0B4}) (Version: 1.00.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}) (Version: 3.00 H2 - Hewlett-Packard)
I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4 - HP)
Integrated Webcam Driver (1.00.02.0625)  (HKLM\...\Creative OA004) (Version:  - )
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
iTunes (HKLM\...\{F59A9E08-A6A4-4ACF-91F2-D0344956C30B}) (Version: 10.2.2.14 - Apple Inc.)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
L&H TTS3000 British English (HKLM\...\LHTTSENG) (Version:  - )
L&H TTS3000 Deutsch (HKLM\...\LHTTSGED) (Version:  - )
LabelPrint (HKLM\...\{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.20.2128 - CyberLink Corp.)
Lernout & Hauspie TruVoice American English TTS Engine (HKLM\...\tv_enua) (Version:  - )
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Marketsplash Schnellzugriffe (HKLM\...\{FB0C267C-8B4F-4867-8161-A6A3B66D42C1}) (Version: 1.0.0.9 - Hewlett-Packard)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2000 Premium (HKLM\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Speech Recognition Engine 4.0 (English) (HKLM\...\MSCSR) (Version:  - )
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.40303 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40308 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.40303 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.40303 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
MSCU for Microsoft Vista (HKLM\...\{3D356AA9-2D0C-4373-A762-B42F1A289233}) (Version: 1.0.1.9 - Hewlett-Packard)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: HPCMPQ1902 - WildTangent)
NetWaiting (HKLM\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.46 - BVRP Software, Inc)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
PARTcommunity 3D Web Viewer (HKLM\...\{F6C0D92C-7EBC-4CEE-A0DD-BCE6ADB50E22}) (Version: 1.0.36.11 - CADENAS)
pc_met für Windows (HKLM\...\{470A3C0F-C4F7-4753-822C-17DC9B382123}) (Version:  - )
Peggle Deluxe 1.03 (HKLM\...\Peggle Deluxe 1.03) (Version:  - )
PicaJet 2.5.0.527 (HKLM\...\PicaJet_is1) (Version: PicaJet 2.5.0.527 - PicaJet.Com)
Power2Go (HKLM\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.3327 - CyberLink Corp.)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2129 - CyberLink Corp.)
PowerDirector (Version: 6.5.2129 - CyberLink Corp.) Hidden
QLBCASL (Version: 6.40.17.2 - Hewlett-Packard) Hidden
QuickTime (HKLM\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
ScanToWeb (HKLM\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version:  - )
Spaß am Turnierreiten (HKLM\...\{DD79EA7D-0912-4883-AC0F-B639A5D05E60}) (Version: 1.0.0 - IR Gurus Interactive)
SpeedCommander 12 (HKLM\...\SpeedCommander 12) (Version: 12 - SpeedProject)
Spelling Dictionaries Support For Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-5464-3428-800000000003}) (Version: 8.0.0 - Adobe Systems)
Studie zur Verbesserung von HP Officejet Pro 8500 A910 Produkten (HKLM\...\{140BAED1-23A8-401F-A722-8BFB0F0E0FAB}) (Version: 22.0.334.0 - Hewlett-Packard Co.)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update Installer for WildTangent Games App (Version:  - WildTangent) Hidden
VLC media player 2.0.4 (HKLM\...\VLC media player) (Version: 2.0.4 - VideoLAN)
WildTangent Games App (HP Games) (HKLM\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp) (Version: 4.0.10.5 - WildTangent)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8098.930 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

28-02-2014 02:13:14 Windows Defender Checkpoint
28-02-2014 13:45:57 Installed Java 7 Update 51
28-02-2014 14:08:50 Removed Java 7 Update 51
28-02-2014 14:14:52 Installed Java 7 Update 51
28-02-2014 14:22:01 Removed Skype™ 6.11

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost
::1            localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {07EC10E8-EF29-4937-9553-9CD60EBF81C3} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - SCHEIDENBERGER Heike => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {0EFB93D1-0090-4A23-842B-96895C817F79} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {494DE52A-EE17-4E1A-94C0-821F335E871E} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-19] (Microsoft Corporation)
Task: {57C5874B-6051-456A-82F2-F5E2A9BAB771} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-22] (Adobe Systems Incorporated)
Task: {5929FFF2-8D03-41DA-BD3E-DB7452EABE73} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-10-24] (Piriform Ltd)
Task: {679E9979-2A46-4E0D-9604-AC09333B8790} - System32\Tasks\HPCustParticipation HP Officejet Pro 8500 A910 => C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-06-14] (Hewlett-Packard Co.)
Task: {6D6B79BC-D64E-4968-AF05-FCB0EB2500DB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2545976033-4072682707-54654107-1000UA => C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-17] (Google Inc.)
Task: {71E2C308-9772-4DF6-A90B-CC6707C16D15} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {A04857B6-51A0-4E66-A2F5-96E3A8B69584} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => C:\Windows\servicing\vsp1ceip.exe [2008-01-19] (Microsoft Corporation)
Task: {BD027DAD-2402-41EB-82BD-F26CF98B93BD} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2545976033-4072682707-54654107-1000Core => C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-17] (Google Inc.)
Task: {BF2459C8-6B06-407A-9F73-B46CD065F3A2} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {EC16D3FE-C26F-4F5B-B9FB-3ABEBE9AD57D} - System32\Tasks\{81F0F4D3-30C4-4D7D-8D81-B8FB50760A89} => Chrome.exe hxxp://ui.skype.com/ui/0/6.0.0.126/de/go/help.faq.installer?LastError=1618
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2545976033-4072682707-54654107-1000Core.job => C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2545976033-4072682707-54654107-1000UA.job => C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-11-17 18:58 - 2012-09-19 18:17 - 00397088 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2007-11-06 18:18 - 2007-01-09 11:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2009-09-06 09:13 - 2009-02-24 15:41 - 00140288 _____ () C:\Program Files\PicaJet\PJExt.dll
2008-01-09 03:42 - 2007-10-02 21:00 - 00066856 _____ () C:\Program Files\HP\QuickPlay\Kernel\Common\MCEMediaStatus.dll
2009-07-01 15:44 - 2009-07-01 15:44 - 00632888 _____ () C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
2013-12-06 16:50 - 2013-12-04 03:48 - 04055504 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll
2013-12-06 16:51 - 2013-12-04 03:48 - 00399312 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll
2013-12-06 16:50 - 2013-12-04 03:47 - 01619408 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll
2013-12-06 16:50 - 2013-12-04 03:47 - 00702416 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\libglesv2.dll
2013-12-06 16:50 - 2013-12-04 03:47 - 00099792 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\libegl.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: Google Update => "C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: HP Health Check Scheduler => [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: lxdcamon => "C:\Program Files\Lexmark 1300 Series\lxdcamon.exe"
MSCONFIG\startupreg: msnmsgr => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QPService => "C:\Program Files\HP\QuickPlay\QPService.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: WindowsWelcomeCenter => rundll32.exe oobefldr.dll,ShowWelcomeCenter

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (02/28/2014 02:39:42 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058


Microsoft Office Sessions:
=========================
Error: (10/18/2013 02:25:20 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 96 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (03/11/2012 07:48:52 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 18333 seconds with 1020 seconds of active time.  This session ended with a crash.

Error: (01/25/2012 05:30:53 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 27 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2012-11-17 22:58:44.384
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-11-17 22:58:44.072
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-11-17 22:58:43.776
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-11-17 22:58:43.464
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-11-17 22:58:43.136
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-01-09 11:42:19.921
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\PRMT78\PRMTED\EDSel.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-01-09 11:42:19.762
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\PRMT78\PRMTED\EDSel.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-01-09 11:41:03.503
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\PRMT78\PRMTED\EDSel.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-01-09 11:41:03.329
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\PRMT78\PRMTED\EDSel.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2010-12-22 01:57:00.549
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\PRMT78\PRMTED\EDSel.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
und hier die FRST:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-02-2014 02
Ran by SCHEIDENBERGER Heike (administrator) on HEIKE on 28-02-2014 21:00:14
Running from C:\Users\SCHEIDENBERGER Heike\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(Microsoft Corporation) C:\Windows\System32\wpcumi.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(PROMT Ltd.) C:\Program Files\PRMT78\PRMTED\EDLauncher.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(PROMT Ltd.) C:\Program Files\PRMT78\PRMTED\prmedsvr.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
() C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Microsoft Corporation) C:\Windows\System32\dfrgui.exe
(Microsoft Corp.) C:\Windows\system32\defrag.exe
(Microsoft Corp.) C:\Windows\system32\DfrgNtfs.exe
(Google Inc.) C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [UCam_Menu] - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [218408 2007-08-16] (CyberLink Corp.)
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [480560 2007-09-13] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [WAWifiMessage] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [311296 2007-01-08] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [WPCUMI] - C:\Windows\system32\WpcUmi.exe [176128 2006-11-02] (Microsoft Corporation)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-27] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13601312 2009-06-24] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [92704 2009-06-24] (NVIDIA Corporation)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-2545976033-4072682707-54654107-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-2545976033-4072682707-54654107-1000\...\Run: [EDLauncher] - C:\Program Files\PRMT78\PRMTED\EDLauncher.exe [73728 2004-11-03] (PROMT Ltd.)
HKU\S-1-5-21-2545976033-4072682707-54654107-1000\...\Run: [Google Update] - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-11-17] (Google Inc.)
HKU\S-1-5-21-2545976033-4072682707-54654107-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2545976033-4072682707-54654107-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
GroupPolicyUsers\S-1-5-21-2545976033-4072682707-54654107-1001\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {18E12AD8-C569-42FB-B8CC-1B37D8789C15} URL =
SearchScopes: HKCU - {75b4241f-171e-44a3-bf44-23613b6e3e03} URL =
SearchScopes: HKCU - {94C202E1-A521-49A2-B0F0-F07F5EBBED99} URL =
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKLM - Übersetzer - {FF284F5C-7CF9-4682-8701-D467C1DBB99F} - C:\Program Files\PRMT78\PRMTIE\prmtie.dll (PROMT Ltd.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Winsock: Catalog9 01 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 02 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 03 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 04 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 05 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 06 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 07 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 08 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 19 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Google Drive) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-17]
CHR Extension: (YouTube) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-17]
CHR Extension: (Google-Suche) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-17]
CHR Extension: (Star Stable Online) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnlmdkpemkkigkgelegknllpmfclakkk [2013-12-11]
CHR Extension: (Google Wallet) - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-14]
CHR HKLM\...\Chrome\Extension: [ogfjmhfnldnajmfaofeiaepghjenbgjo] - C:\Users\SCHEIDENBERGER Heike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx [2014-02-27]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-27] (Avira Operations GmbH & Co. KG)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-09] (Conexant Systems Inc.)
S3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows (R) Codename Longhorn DDK provider)
R3 OA004Ufd; C:\Windows\System32\DRIVERS\OA004Ufd.sys [144672 2008-06-03] (Creative Technology Ltd.)
R3 OA004Vid; C:\Windows\System32\DRIVERS\OA004Vid.sys [270048 2008-06-24] (Creative Technology Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
U4 eabfiltr;
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 SymIM; system32\DRIVERS\SymIM.sys [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-28 21:00 - 2014-02-28 21:01 - 00014075 _____ () C:\Users\SCHEIDENBERGER Heike\Downloads\FRST.txt
2014-02-28 20:59 - 2014-02-28 21:00 - 00000000 ____D () C:\FRST
2014-02-28 20:58 - 2014-02-28 20:59 - 01143808 _____ (Farbar) C:\Users\SCHEIDENBERGER Heike\Downloads\FRST.exe
2014-02-28 15:35 - 2014-02-28 15:35 - 00000000 ____D () C:\Users\SCHEIDENBERGER Heike\AppData\Roaming\Malwarebytes
2014-02-28 15:34 - 2014-02-28 15:34 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-28 15:34 - 2014-02-28 15:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-28 15:34 - 2014-02-28 15:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-28 15:34 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-28 15:32 - 2014-02-28 15:33 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\SCHEIDENBERGER Heike\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-28 15:16 - 2014-02-28 15:16 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-02-28 15:16 - 2014-02-28 15:15 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-28 15:16 - 2014-02-28 15:15 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-28 15:15 - 2014-02-28 15:15 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-28 15:15 - 2014-02-28 15:15 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-28 15:12 - 2014-02-28 15:12 - 00921000 _____ (Oracle Corporation) C:\Users\SCHEIDENBERGER Heike\Downloads\chromeinstall-7u51 (1).exe
2014-02-28 14:59 - 2014-02-28 15:00 - 00921000 _____ (Oracle Corporation) C:\Users\SCHEIDENBERGER Heike\Downloads\chromeinstall-7u51.exe
2014-02-28 14:57 - 2014-02-28 15:17 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-28 14:52 - 2014-02-28 14:56 - 00006648 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log
2014-02-28 04:11 - 2014-02-28 04:11 - 00001249 _____ () C:\Users\SCHEIDENBERGER Heike\Desktop\JRT.txt
2014-02-28 04:00 - 2014-02-28 04:00 - 00000000 ____D () C:\Windows\ERUNT
2014-02-28 03:57 - 2014-02-28 03:58 - 01037734 _____ (Thisisu) C:\Users\SCHEIDENBERGER Heike\Downloads\JRT.exe
2014-02-28 03:36 - 2014-02-28 03:48 - 00000000 ____D () C:\AdwCleaner
2014-02-28 03:34 - 2014-02-28 03:35 - 01244192 _____ () C:\Users\SCHEIDENBERGER Heike\Downloads\adwcleaner.exe
2014-02-28 03:06 - 2014-02-28 03:51 - 00008564 _____ () C:\Windows\PFRO.log
2014-02-28 03:06 - 2014-02-28 03:07 - 00309360 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-27 22:17 - 2014-02-27 22:17 - 00074568 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-27 21:51 - 2014-02-27 21:51 - 00000078 _____ () C:\lxdc.log
2014-02-27 20:32 - 2014-02-27 20:33 - 00060056 _____ () C:\Users\SCHEIDENBERGER Heike\Documents\cc_20140227_203249.reg
2014-02-27 18:06 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-27 18:06 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-27 18:06 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-27 18:06 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-27 18:06 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-27 18:06 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-27 18:06 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-27 18:06 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-27 18:06 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-27 18:06 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-27 18:06 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-27 18:06 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-27 18:06 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-27 18:06 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-27 18:06 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-27 18:05 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-22 13:31 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-02-28 21:01 - 2014-02-28 21:00 - 00014075 _____ () C:\Users\SCHEIDENBERGER Heike\Downloads\FRST.txt
2014-02-28 21:00 - 2014-02-28 20:59 - 00000000 ____D () C:\FRST
2014-02-28 20:59 - 2014-02-28 20:58 - 01143808 _____ (Farbar) C:\Users\SCHEIDENBERGER Heike\Downloads\FRST.exe
2014-02-28 20:57 - 2010-01-01 17:50 - 00000024 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\{C916D440-D489-4A79-B306-5FDC1E7932C0}.list
2014-02-28 20:56 - 2012-11-17 19:19 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-28 20:55 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-28 20:55 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-28 20:54 - 2008-01-09 03:29 - 01185728 _____ () C:\Windows\WindowsUpdate.log
2014-02-28 20:06 - 2012-11-17 19:25 - 00001180 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2545976033-4072682707-54654107-1000UA.job
2014-02-28 15:35 - 2014-02-28 15:35 - 00000000 ____D () C:\Users\SCHEIDENBERGER Heike\AppData\Roaming\Malwarebytes
2014-02-28 15:34 - 2014-02-28 15:34 - 00000906 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-02-28 15:34 - 2014-02-28 15:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-28 15:34 - 2014-02-28 15:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-28 15:33 - 2014-02-28 15:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\SCHEIDENBERGER Heike\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-28 15:23 - 2008-01-29 23:00 - 00000000 ____D () C:\ProgramData\Skype
2014-02-28 15:22 - 2008-01-29 23:03 - 00000000 ____D () C:\Users\SCHEIDENBERGER Heike\AppData\Roaming\Skype
2014-02-28 15:17 - 2014-02-28 14:57 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-28 15:16 - 2014-02-28 15:16 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-02-28 15:15 - 2014-02-28 15:16 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-28 15:15 - 2014-02-28 15:16 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-28 15:15 - 2014-02-28 15:15 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-28 15:15 - 2014-02-28 15:15 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-28 15:12 - 2014-02-28 15:12 - 00921000 _____ (Oracle Corporation) C:\Users\SCHEIDENBERGER Heike\Downloads\chromeinstall-7u51 (1).exe
2014-02-28 15:00 - 2014-02-28 14:59 - 00921000 _____ (Oracle Corporation) C:\Users\SCHEIDENBERGER Heike\Downloads\chromeinstall-7u51.exe
2014-02-28 14:56 - 2014-02-28 14:52 - 00006648 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log
2014-02-28 14:56 - 2007-11-06 18:35 - 00000000 ____D () C:\Program Files\Java
2014-02-28 14:38 - 2012-11-17 22:15 - 00050384 _____ () C:\ProgramData\nvModes.001
2014-02-28 14:38 - 2012-11-17 22:12 - 00050384 _____ () C:\ProgramData\nvModes.dat
2014-02-28 14:38 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-28 04:23 - 2006-11-02 14:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-28 04:11 - 2014-02-28 04:11 - 00001249 _____ () C:\Users\SCHEIDENBERGER Heike\Desktop\JRT.txt
2014-02-28 04:00 - 2014-02-28 04:00 - 00000000 ____D () C:\Windows\ERUNT
2014-02-28 03:58 - 2014-02-28 03:57 - 01037734 _____ (Thisisu) C:\Users\SCHEIDENBERGER Heike\Downloads\JRT.exe
2014-02-28 03:51 - 2014-02-28 03:06 - 00008564 _____ () C:\Windows\PFRO.log
2014-02-28 03:48 - 2014-02-28 03:36 - 00000000 ____D () C:\AdwCleaner
2014-02-28 03:47 - 2012-11-17 19:28 - 00001159 _____ () C:\Users\SCHEIDENBERGER Heike\Desktop\Google Chrome.lnk
2014-02-28 03:47 - 2012-11-17 19:28 - 00000000 ____D () C:\Users\SCHEIDENBERGER Heike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-02-28 03:47 - 2008-01-29 20:36 - 00001005 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-28 03:35 - 2014-02-28 03:34 - 01244192 _____ () C:\Users\SCHEIDENBERGER Heike\Downloads\adwcleaner.exe
2014-02-28 03:07 - 2014-02-28 03:06 - 00309360 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-27 23:30 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-27 22:17 - 2014-02-27 22:17 - 00074568 _____ () C:\Users\SCHEIDENBERGER Heike\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-27 21:51 - 2014-02-27 21:51 - 00000078 _____ () C:\lxdc.log
2014-02-27 21:38 - 2007-11-06 16:41 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-02-27 21:38 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\twain_32
2014-02-27 21:31 - 2008-01-29 20:23 - 00000000 ____D () C:\Program Files\Electronic Arts
2014-02-27 20:33 - 2014-02-27 20:32 - 00060056 _____ () C:\Users\SCHEIDENBERGER Heike\Documents\cc_20140227_203249.reg
2014-02-27 20:04 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-02-27 19:42 - 2008-07-04 16:39 - 00000000 ____D () C:\Users\SCHEIDENBERGER Heike\AppData\Roaming\cerasus.media
2014-02-27 19:42 - 2008-02-12 17:24 - 00000853 _____ () C:\Windows\disney.ini
2014-02-27 19:42 - 2008-02-02 10:01 - 00000000 ____D () C:\Program Files\Rondomedia
2014-02-27 19:39 - 2008-02-03 17:39 - 00000000 ____D () C:\Program Files\FlightPlanner
2014-02-27 19:36 - 2008-10-16 11:13 - 00000000 ____D () C:\Program Files\Arbeitsblatt Profi Testversion
2014-02-27 19:12 - 2007-11-06 18:07 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-27 19:01 - 2008-02-02 14:30 - 00000000 ____D () C:\Program Files\Lx_cats
2014-02-27 18:46 - 2006-11-02 11:33 - 01588252 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-27 18:24 - 2013-08-15 15:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-27 18:16 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-27 18:03 - 2014-01-15 14:47 - 00015522 _____ () C:\Users\SCHEIDENBERGER Heike\daemonprocess.txt
2014-02-27 17:45 - 2009-07-25 12:34 - 00000000 ____D () C:\Program Files\Deep Silver
2014-02-27 17:18 - 2008-06-13 18:14 - 00000000 ____D () C:\Program Files\McDonaldsFairies
2014-02-27 13:06 - 2012-11-17 19:25 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2545976033-4072682707-54654107-1000Core.job
2014-02-26 14:26 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\system32\restore
2014-02-22 12:57 - 2012-11-17 19:19 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-22 12:57 - 2012-11-17 19:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 09:58 - 2014-02-27 18:05 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-27 18:06 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-27 18:06 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-27 18:06 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-27 18:06 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-27 18:06 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-27 18:06 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-27 18:06 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-27 18:06 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-27 18:06 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-27 18:06 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-27 18:06 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-27 18:06 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-27 18:06 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-27 18:06 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-27 18:06 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

Files to move or delete:
====================
C:\ProgramData\ezsid.dat


Some content of TEMP:
====================
C:\Users\SCHEIDENBERGER Heike\AppData\Local\Temp\avgnt.exe
C:\Users\SCHEIDENBERGER Heike\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\SCHEIDENBERGER Heike\AppData\Local\Temp\Quarantine.exe
C:\Users\SCHEIDENBERGER Heike\AppData\Local\Temp\System.Data.SQLite14759.dll
C:\Users\SCHEIDENBERGER Heike\AppData\Local\Temp\_isD5B4.exe
C:\Users\SCHEIDENBERGER Heike\AppData\Local\Temp\_isF78A.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-28 15:20

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 01.03.2014 14:38
Sieht gut aus, bestehen noch Probleme?

Drai-cin 01.03.2014 15:00
Funktioniert wieder alles, vielen Dank für die schnelle Hilfe!

schrauber 02.03.2014 08:26
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:02 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131