Trojaner-Board - Offen Zu viele Werbungen im Browser

Trojaner-Board (https://www.trojaner-board.de/)

- Überwachung, Datenschutz und Spam (https://www.trojaner-board.de/uberwachung-datenschutz-spam/)

- -

Zu viele Werbungen im Browser (https://www.trojaner-board.de/160210-viele-werbungen-browser.html)

Zu viele Werbungen im Browser

Ich hab schon oft Google gefragt aber trotzdem keine Lösung für mein Problem gefunden.
Ständig habe ich Werbungen im Browser von den Seiten Zalando, Otto.de usw. die Wörter sind unterstrichen oder es Öffnen sich manchmal neue Fenster mit Werbung. Das geht tierisch auf die nerven und verlangsamt das Surfen im Internet.
Ich habe oft über adwcleaner gelesen, hab den auch ausprobiert, aber leider hilft er nicht. Die Werbungen sind nach wie vor da. :headbang: Was kann ich noch machen?
Und welches antivir Programm würdet ihr mir empfehlen? Es muss bitte kostenlos sein.
Ich hab Avira aber es scheint nicht so gut zu sein. :wtf:

Freue mich über eure Antworten.

Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Ich habe noch 395 Funde.

FRST.txt

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-10-2014 01

Ran by acer (administrator) on ACER-PC on 29-10-2014 16:07:54

Running from C:\Users\acer\Desktop

Loaded Profile: acer (Available profiles: acer)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchService.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Windows\System32\wisptis.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Microsoft Corporation) C:\Windows\System32\wisptis.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe

(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe

(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\acer\AppData\Local\Google\Chrome\Application\chrome.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-19] (Synaptics Incorporated)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-02] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [38872 2012-07-31] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-16] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Google Update] => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)

HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Akamai NetSession Interface] => C:\Users\acer\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\MountPoints2: {8512f947-4be6-11e1-8e2a-806e6f6e6963} - D:\.\AutorunX\AutorunX.exe

HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [5085416 2014-10-29] (Avira)

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6137481703E0CC01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - C5B99FE4EBF6436E96255EC4E534CB93 URL = hxxp://yandex.ru/yandsearch?win=47&clid=135294&text={searchTerms}

SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c

SearchScopes: HKCU - {5308F6B2-D7C7-435F-ACE1-67C822EDD299} URL = hxxp://search.softonic.com/MON00016/tb_v1?q={searchTerms}&SearchSource=4&cc=

SearchScopes: HKCU - {F8BEEF2E-FAD3-41CA-B81F-232B4C13BF87} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=48201c1f-2234-406e-9170-e11d675ac164&apn_sauid=AB8CEBA9-3173-427A-ABA0-8BF924B7B29E

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: No Name -> {e5d4f4fd-a039-4670-8354-633c30a5f54e} ->  No File

Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default

FF NewTab: hxxp://www.sweet-page.com/newtab/?type=nt&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB

FF DefaultSearchEngine: sweet-page

FF SearchEngineOrder.1: Ask.com

FF SearchEngineOrder.3: Bing 

FF SelectedSearchEngine: sweet-page

FF Homepage: hxxp://www.sweet-page.com/?type=hp&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 -> C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)

FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 -> C:\Users\acer\AppData\LocalLow\Sony Online Entertainment\npsoe.dll No File

FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin HKCU: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002435.xml

FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002613.xml

FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\ybqs-yandex.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Яндекс.Бар - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\yasearch@yandex.ru [2013-06-11]

FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]

FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]

FF Extension: Adblock Plus - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-01]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-02-20]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> 

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Movies Toolbar) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaifmhgonleehnkppkhhchcbhhigac [2013-12-01]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-02]

CHR Extension: (YouTube) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-01]

CHR Extension: (Adblock Plus) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-11]

CHR Extension: (Google-Suche) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-01]

CHR Extension: (hxxp://www.facebook.com/?ref=logo) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpipgdjaiclliilaeaehcgkihcbcmooo [2012-05-21]

CHR Extension: (Stylish) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-02-01]

CHR Extension: (hxxp://www.yandex.ru/) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfjacpammignfpjljfmgpdebpnjfpcjl [2012-05-21]

CHR Extension: (WebSite Recommendation) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\jopdpbolklklaiookikgmdinfbooiipj [2013-12-07]

CHR Extension: (F2B Dark Electrique - Neon Blue on Black) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\modaobgliiinjfofblifbikbemfealmf [2012-05-21]

CHR Extension: (Google Wallet) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-02-01]

CHR Extension: (Google Mail) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-01]

CHR HKCU\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx [2012-08-13]

CHR HKLM-x32\...\Chrome\Extension: [aaaaifmhgonleehnkppkhhchcbhhigac] - C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC\toolbar.crx [2013-08-29]

CHR HKLM-x32\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx [2012-08-13]

CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-16] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S2 Update Deal Keeper; "C:\Program Files (x86)\Deal Keeper\updateDealKeeper.exe" [X]

S2 Util Deal Keeper; "C:\Program Files (x86)\Deal Keeper\bin\utilDealKeeper.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-16] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-16] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]

S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]

S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-29 16:07 - 2014-10-29 16:08 - 00019995 _____ () C:\Users\acer\Desktop\FRST.txt

2014-10-29 16:07 - 2014-10-29 16:07 - 00000000 ____D () C:\FRST

2014-10-29 16:05 - 2014-10-29 16:05 - 02113536 _____ (Farbar) C:\Users\acer\Desktop\FRST64.exe

2014-10-29 14:26 - 2014-10-29 14:26 - 00003320 _____ () C:\Windows\System32\Tasks\AviraSpeedup

2014-10-29 14:26 - 2014-10-29 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup

2014-10-29 14:12 - 2014-10-29 14:12 - 01998336 _____ () C:\Users\acer\Desktop\AdwCleaner_4.002.exe

2014-10-24 19:33 - 2014-10-25 13:45 - 00000000 ____D () C:\Users\acer\Desktop\Музыка 2

2014-10-24 16:25 - 2014-10-24 16:25 - 00000000 ____D () C:\Users\acer\Desktop\Ёлка

2014-10-23 17:32 - 2014-10-23 17:32 - 00000000 ____D () C:\Users\acer\Desktop\DeSmuMe1

2014-10-17 15:41 - 2014-10-17 15:41 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-10-12 14:02 - 2014-10-12 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-29 16:06 - 2012-02-01 18:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job

2014-10-29 15:54 - 2014-02-12 22:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-29 15:42 - 2014-02-08 20:23 - 00000288 _____ () C:\Windows\Tasks\Funmoods Chat.job

2014-10-29 15:42 - 2012-01-31 09:39 - 01262459 _____ () C:\Windows\WindowsUpdate.log

2014-10-29 15:42 - 2009-07-14 05:51 - 00683673 _____ () C:\Windows\setupact.log

2014-10-29 14:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat

2014-10-29 14:51 - 2012-02-19 03:32 - 00000000 ____D () C:\Users\acer\AppData\Local\Akamai

2014-10-29 14:50 - 2014-01-12 01:27 - 00000000 ____D () C:\Program Files (x86)\osu!

2014-10-29 14:49 - 2009-07-14 19:18 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-10-29 14:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration

2014-10-29 14:31 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-29 14:31 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-29 14:27 - 2009-07-14 18:58 - 00696370 _____ () C:\Windows\system32\perfh007.dat

2014-10-29 14:27 - 2009-07-14 18:58 - 00147634 _____ () C:\Windows\system32\perfc007.dat

2014-10-29 14:27 - 2009-07-14 06:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-29 14:26 - 2013-07-30 12:44 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-10-29 14:20 - 2012-01-31 12:18 - 00342912 _____ () C:\Windows\PFRO.log

2014-10-29 14:20 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-29 14:19 - 2014-09-13 11:50 - 00000000 ____D () C:\AdwCleaner

2014-10-29 14:19 - 2012-01-31 11:36 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-10-29 14:19 - 2012-01-31 09:47 - 00001168 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-10-29 14:19 - 2012-01-31 09:47 - 00000981 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk

2014-10-29 14:12 - 2012-07-09 21:08 - 00000000 ____D () C:\Users\acer\Desktop\PC

2014-10-29 13:55 - 2012-01-31 09:47 - 00000000 ____D () C:\Users\acer

2014-10-26 16:43 - 2013-02-24 23:22 - 03159040 ___SH () C:\Users\acer\Desktop\Thumbs.db

2014-10-23 16:10 - 2012-04-25 12:48 - 00000000 ____D () C:\Users\acer\Desktop\Mein Ordner

2014-10-23 16:06 - 2012-02-01 18:40 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job

2014-10-22 16:01 - 2012-02-01 18:40 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA

2014-10-22 16:01 - 2012-02-01 18:40 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core

2014-10-17 15:41 - 2014-08-05 09:04 - 00000000 ____D () C:\ProgramData\Package Cache

2014-10-17 15:41 - 2013-07-30 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-10-16 14:03 - 2013-07-30 12:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-10-16 14:03 - 2013-07-30 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-10-16 14:03 - 2013-07-30 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-10-12 17:49 - 2012-02-01 19:13 - 00000000 ____D () C:\Users\acer\AppData\Roaming\Skype

2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ____D () C:\ProgramData\Skype

2014-10-04 16:07 - 2014-05-11 18:38 - 00000499 _____ () C:\Users\acer\Desktop\7.txt
 

Some content of TEMP:

====================

C:\Users\acer\AppData\Local\Temp\AskSLib.dll

C:\Users\acer\AppData\Local\Temp\avgnt.exe

C:\Users\acer\AppData\Local\Temp\bdfilters.dll

C:\Users\acer\AppData\Local\Temp\BundleSweetIMSetup.exe

C:\Users\acer\AppData\Local\Temp\Delta.exe

C:\Users\acer\AppData\Local\Temp\DeltaTB.exe

C:\Users\acer\AppData\Local\Temp\DivXSetup.exe

C:\Users\acer\AppData\Local\Temp\drm_dyndata_7380006.dll

C:\Users\acer\AppData\Local\Temp\DWPUpgradeInstaller.exe

C:\Users\acer\AppData\Local\Temp\FlashPlayerUpdate.exe

C:\Users\acer\AppData\Local\Temp\gface_swap.exe

C:\Users\acer\AppData\Local\Temp\hcuninstaller_20131028_134921_3792.exe

C:\Users\acer\AppData\Local\Temp\i4jdel0.exe

C:\Users\acer\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll

C:\Users\acer\AppData\Local\Temp\IminentSetup.exe

C:\Users\acer\AppData\Local\Temp\MybabylonTB.exe

C:\Users\acer\AppData\Local\Temp\nsaBB1C.exe

C:\Users\acer\AppData\Local\Temp\nskC1C1.exe

C:\Users\acer\AppData\Local\Temp\nsp1A96.exe

C:\Users\acer\AppData\Local\Temp\nsp1E3F.exe

C:\Users\acer\AppData\Local\Temp\nsq6C41.exe

C:\Users\acer\AppData\Local\Temp\nsv16BF.exe

C:\Users\acer\AppData\Local\Temp\propsys.dll

C:\Users\acer\AppData\Local\Temp\qdf_n_pe.dll

C:\Users\acer\AppData\Local\Temp\Quarantine.exe

C:\Users\acer\AppData\Local\Temp\SkypeSetup.exe

C:\Users\acer\AppData\Local\Temp\SpotifyUninstall.exe

C:\Users\acer\AppData\Local\Temp\sqlite3.dll

C:\Users\acer\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\acer\AppData\Local\Temp\TuneUpUtilities2013_de-DE.exe

C:\Users\acer\AppData\Local\Temp\Uninstaller-4088.exe

C:\Users\acer\AppData\Local\Temp\WSSetup.exe

C:\Users\acer\AppData\Local\Temp\YgoUpdater.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-27 19:18
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition.txt

Code:

 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-10-2014 01

Ran by acer at 2014-10-29 16:09:12

Running from C:\Users\acer\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)

Adobe Reader 9.5.2 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.2 - Adobe Systems Incorporated)

Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)

Ashampoo Burning Studio FREE v.1.14.5 (HKLM-x32\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)

ATI AVIVO64 Codecs (Version: 10.7.0.40702 - ATI Technologies Inc.) Hidden

ATI Catalyst Install Manager (HKLM\...\{BADFD936-E907-C666-A6E1-3C04C06E4260}) (Version: 3.0.732.0 - ATI Technologies, Inc.)

Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)

Avira (HKLM-x32\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)

Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C1200}) (Version: 12.18.0.3051 - APN, LLC)

Avira System Speedup (HKLM-x32\...\AviraSpeedup) (Version: 1.3.1.9930 - Avira System Speedup)

Bamboo (HKLM\...\Pen Tablet Driver) (Version: 5.2.5-5 - Wacom Technology Corp.)

Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - )

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Broadcom Gigabit NetLink Controller (HKLM\...\{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}) (Version: 12.26.02 - Broadcom Corporation)

ccc-core-static (x32 Version: 2009.0702.1239.20840 - Ihr Firmenname) Hidden

DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.24 - DivX, LLC)

Google Chrome (HKCU\...\Google Chrome) (Version: 38.0.2125.104 - Google Inc.)

Happy Cloud Client (HKCU\...\HappyCloud) (Version: 3.59 - Happy Cloud, Inc.)

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )

League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Movies Toolbar for Chrome (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaCR) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION

Movies Toolbar for Internet Explorer (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION

Mozilla Firefox 12.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 12.0 (x86 de)) (Version: 12.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)

MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden

NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)

OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)

osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)

PowerTeacher Version 23.04.026.P34 (HKLM-x32\...\PowerTeacher_is1) (Version: 23.04.026.P34 - admigro media GmbH)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5911 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)

Senus 2012 (HKLM-x32\...\Senus 2012) (Version: 2012 - Senus)

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.2.0 - Synaptics Incorporated)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

Update for Funmoods Chat (HKCU\...\Funmoods Chat) (Version:  - Update for Funmoods Chat) <==== ATTENTION

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

Vegas Pro 11.0 (HKLM-x32\...\{6BE7495E-8DF1-11E1-BB7D-F04DA23A5C58}) (Version: 11.0.682 - Sony)

VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)

WebTablet FB Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.0.0.1 - Wacom Technology Corp.)

WebTablet IE Plugin (HKLM-x32\...\Wacom WebTabletPlugin for IE) (Version: 1.1.0.12 - Wacom Technology Corp.)

WebTablet Netscape Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Netscape) (Version: 1.1.0.10 - Wacom Technology Corp.)

WinRAR 4.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\acer\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
 

==================== Restore Points  =========================
 

16-10-2014 18:42:59 Geplanter Prüfpunkt

23-10-2014 18:54:49 Geplanter Prüfpunkt

29-10-2014 13:25:01 Avira System Speedup(1.3.1.9930)

29-10-2014 13:44:07 Wiederherstellungsvorgang
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - System32\Tasks\Funmoods Chat => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {0E581D78-090E-4B3F-AD54-0D14A0FE299D} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {0E7D64A6-726E-4520-97EE-93D347538AE7} - System32\Tasks\{B838A91B-D1E3-401C-9EA5-16C1B1C9DD79} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)

Task: {36598214-6DC8-4F89-A570-7DC3D33FD8BF} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)

Task: {39BC67C8-1301-43CD-AC38-AE940BA98B60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)

Task: {4C446A1C-E962-4CA1-8D3E-88EB4082CEB4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)

Task: {54C625ED-6DB0-4300-ACF8-4C6FAD13148B} - System32\Tasks\{6C9FA6D1-EA02-43B7-852D-72304E2BC18A} => C:\Program Files (x86)\JoWooD\NfH_Compilation\NfH1\bin\game.exe

Task: {6C29B57E-6178-47CC-A301-5FBF818442E7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)

Task: {74D4980C-87D8-47F2-8ED9-7B030B88CC9F} - System32\Tasks\{2EE2B7AA-5C0C-44A2-9C18-7743C493ABC2} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)

Task: {751AB0DB-7059-4856-82B6-104D01065C1A} - System32\Tasks\AviraSpeedup => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [2014-10-29] (Avira)

Task: {DE0E5CE5-8C3C-4C97-9202-C28256F3A581} - System32\Tasks\VKSaverUpdate => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-02-01 22:26 - 2012-01-09 19:44 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll

2012-09-22 20:00 - 2011-09-08 16:48 - 01183096 _____ () C:\Program Files\Tablet\Pen\libxml2.dll

2013-02-13 03:37 - 2013-02-13 03:37 - 01263952 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

2009-05-13 10:44 - 2009-05-13 10:44 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2012-01-31 10:19 - 2012-01-31 10:19 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

2014-10-20 19:37 - 2014-10-10 03:03 - 01042760 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\libglesv2.dll

2014-10-20 19:37 - 2014-10-10 03:03 - 00211272 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\libegl.dll

2014-10-20 19:37 - 2014-10-10 03:04 - 08910664 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\pdf.dll

2014-10-20 19:37 - 2014-10-10 03:03 - 01681224 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\ffmpegsumo.dll

2014-10-20 19:37 - 2014-10-10 03:04 - 14902600 _____ () C:\Users\acer\AppData\Local\Google\Chrome\Application\38.0.2125.104\PepperFlash\pepflashplayer.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^Users^acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup

MSCONFIG\startupreg: ApnTBMon => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"

MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: VKSaver => C:\ProgramData\VKSaver\VKSaver.exe
 

========================= Accounts: ==========================
 

acer (S-1-5-21-3090159671-3938598571-1968455546-1000 - Administrator - Enabled) => C:\Users\acer

Administrator (S-1-5-21-3090159671-3938598571-1968455546-500 - Administrator - Disabled)

Gast (S-1-5-21-3090159671-3938598571-1968455546-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3090159671-3938598571-1968455546-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft-Teredo-Tunneling-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 

Name: Microsoft-Adapter für Miniports virtueller WiFis

Description: Microsoft-Adapter für Miniports virtueller WiFis

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: vwifimp

Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

Resolution: Update the driver
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/29/2014 03:09:12 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.

Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 

Error: (10/29/2014 02:05:06 PM) (Source: Windows Backup) (EventID: 4103) (User: )

Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
 

Error: (10/28/2014 03:07:15 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.

Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 

Error: (10/27/2014 07:19:39 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.

Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 

Error: (10/27/2014 01:32:07 PM) (Source: TabletServicePen) (EventID: 1) (User: )

Description: Prefs: Failed to get user path
 

Error: (10/26/2014 07:00:03 PM) (Source: Windows Backup) (EventID: 4103) (User: )

Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
 

Error: (10/26/2014 04:44:54 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: Programm iexplore.exe, Version 8.0.7601.17514 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: 1490
 

Startzeit: 01cff133aa404715
 

Endzeit: 31
 

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe
 

Berichts-ID: fb4ef70a-5d26-11e4-8240-00262d55e02a
 

Error: (10/26/2014 04:03:23 PM) (Source: TabletServicePen) (EventID: 1) (User: )

Description: Prefs: Failed to get user path
 

Error: (10/25/2014 02:01:01 PM) (Source: TabletServicePen) (EventID: 1) (User: )

Description: Prefs: Failed to get user path
 

Error: (10/23/2014 07:49:31 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.

Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
 

System errors:

=============

Error: (10/29/2014 02:20:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (10/29/2014 02:20:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Update Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (10/29/2014 02:20:35 PM) (Source: amdsata) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\RaidPort0 gefunden.
 

Error: (10/29/2014 01:55:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (10/29/2014 01:55:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Update Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (10/29/2014 01:54:57 PM) (Source: amdsata) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\RaidPort0 gefunden.
 

Error: (10/29/2014 02:35:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Util Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (10/29/2014 02:35:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Update Deal Keeper" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (10/29/2014 02:35:44 PM) (Source: amdsata) (EventID: 11) (User: )

Description: Der Treiber hat einen Controllerfehler auf \Device\RaidPort0 gefunden.
 

Error: (10/29/2014 02:27:21 PM) (Source: DCOM) (EventID: 10005) (User: )

Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
 

Microsoft Office Sessions:

=========================

Error: (10/29/2014 03:09:12 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
 

Error: (10/29/2014 02:05:06 PM) (Source: Windows Backup) (EventID: 4103) (User: )

Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)
 

Error: (10/28/2014 03:07:15 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
 

Error: (10/27/2014 07:19:39 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
 

Error: (10/27/2014 01:32:07 PM) (Source: TabletServicePen) (EventID: 1) (User: )

Description: Prefs: Failed to get user path
 

Error: (10/26/2014 07:00:03 PM) (Source: Windows Backup) (EventID: 4103) (User: )

Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)
 

Error: (10/26/2014 04:44:54 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: iexplore.exe8.0.7601.17514149001cff133aa40471531C:\Program Files (x86)\Internet Explorer\iexplore.exefb4ef70a-5d26-11e4-8240-00262d55e02a
 

Error: (10/26/2014 04:03:23 PM) (Source: TabletServicePen) (EventID: 1) (User: )

Description: Prefs: Failed to get user path
 

Error: (10/25/2014 02:01:01 PM) (Source: TabletServicePen) (EventID: 1) (User: )

Description: Prefs: Failed to get user path
 

Error: (10/23/2014 07:49:31 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
 
 

==================== Memory info =========================== 
 

Processor: AMD Athlon(tm) II Dual-Core M300

Percentage of memory in use: 44%

Total physical RAM: 4094.36 MB

Available physical RAM: 2277.28 MB

Total Pagefile: 8186.91 MB

Available Pagefile: 5781.2 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:297.99 GB) (Free:199.64 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: CA20FFB1)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Logs vom Virenscanner und Malwarebytes?

In Avira steht bei Aktion überall "Malware gefunden"

Kannst du jetzt bitte de Logs dazu posten...
Und die von Malwarebytes auch nicht vergessen wenn es Funde gab

Ich habe alles gemacht wie hier: http://www.trojaner-board.de/125889-...tml#post941520

Ich kann aber die Datei hier nicht posten. Die Datei ist ungültig heißt es.

Zitat:

Ich habe alles gemacht wie hier: Wichtig: Bitte alle Logs mit Funden posten

Das ist mir nicht entgangen.

Ich möchte aber noch zusätzlich Virenscanner-Logs mit den Funden sehen. Wie du an die Logs kommst wurde erklärt. Bei Malwarebytes und Verlauf => Anwendungsprotokolle => Suchlauf-Protokolle, falls dieses Programm denn schon ausgeführt wurde.

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Scan Date: 31.10.2014

Scan Time: 12:10:45

Logfile: qwfasf.txt

Administrator: Yes
 

Version: 2.00.3.1025

Malware Database: v2014.09.19.05

Rootkit Database: v2014.10.22.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled
 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: acer
 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 341617

Time Elapsed: 27 min, 34 sec
 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled
 

Processes: 0

(No malicious items detected)
 

Modules: 0

(No malicious items detected)
 

Registry Keys: 19

Adware.GamePlayLab, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

PUP.Optional.Wajam.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, , [afd29f50fd7e36007c5b701f53af32ce], 

PUP.Optional.Wajam.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, , [afd29f50fd7e36007c5b701f53af32ce], 

PUP.Optional.Yontoo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, , [2e5318d797e411259b8e0d7dad558b75], 

PUP.Optional.Yontoo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, , [2e5318d797e411259b8e0d7dad558b75], 

PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Deal Keeper, , [166b32bd4f2cc5719dc07d93ee15a957], 

PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util Deal Keeper, , [9fe25c934c2f74c2d18d9d736f946c94], 

PUP.Optional.IWantThis.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\I Want This, , [740d06e9bbc0d75f939d65c3fb08758b], 

PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\koyotesoftmoviestoolbarha, , [0f721dd2cbb0cd69e480c1789b68748c], 

PUP.Optional.FastStart.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, , [8af7717ef388c571655550b58e7555ab], 

PUP.Optional.DealPly.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdejapggenmdmafpmbipje, , [cbb6ec033f3c75c1a95e2df1fe05f50b], 

PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{e5d4f4fd-a039-4670-8354-633c30a5f54e}, , [8bf64ea17efdc076c5cd90794eb7b050], 

PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 

PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 

PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 
 

Registry Values: 2

PUP.Optional.FastStart.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, , [8af7717ef388c571655550b58e7555ab]

PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{E5D4F4FD-A039-4670-8354-633C30A5F54E}, Movies Toolbar (Dist. by Koyote-Lab, Inc.), , [8bf64ea17efdc076c5cd90794eb7b050]
 

Registry Data: 0

(No malicious items detected)
 

Folders: 6

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha, , [176a42ad007b03331c614a9c42c040c0], 

PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC, , [176a42ad007b03331c614a9c42c040c0], 
 

Files: 54

PUP.Optional.Koyote.A, C:\Program Files (x86)\Free Easy CD DVD Burner\Uninstall.exe, , [b8c95b946a1173c3851867e9be43a957], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsaBB1C.exe, , [3a477a75eb905adcab480d2c61a06f91], 

PUP.Optional.Iminent.A, C:\Users\acer\AppData\Local\Temp\IminentSetup.exe, , [2d541ad5403ba393fb3af34b28d918e8], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nskC1C1.exe, , [275ac42bfe7d9b9bec0773c6e918fe02], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsp1A96.exe, , [b9c83eb1eb90b383b83b66d37c859d63], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsp1E3F.exe, , [71108b6448337abc579c56e326db53ad], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsq6C41.exe, , [b8c98c63d4a7d66040b3be7bb9485ba5], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsv16BF.exe, , [176a727d95e637ff757e50e916eb24dc], 

Adware.Korad, C:\Users\acer\AppData\Local\Temp\nspBA9A.tmp\basicstarter.exe, , [621fc52a522948eefe7748f8b34e629e], 

PUP.Optional.OpenCandy, C:\Users\acer\AppData\Local\Temp\is-SLOM1.tmp\OCSetupHlp.dll, , [7f026c83fd7e38fe79aaef3cd43109f7], 

PUP.Optional.Dealply, C:\Users\acer\AppData\Local\Temp\is1590112554\dealply.exe, , [1170cf204239112566915bcf4eb735cb], 

PUP.Optional.IWantThis.A, C:\Users\acer\AppData\Local\Temp\is1590112554\IWantThis_ROW.exe, , [9ee36d82d8a3dd59d60ec3d2ea17926e], 

PUP.Optional.Babylon.A, C:\Users\acer\AppData\Local\Temp\is1590112554\MyBabylonTB.exe, , [1f62a7485e1d3204797e5ec0b44c13ed], 

PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Temp\is1590112554\Wajam.exe, , [364b935c245793a339f0440341bfb947], 

PUP.Optional.MoviesToolbar.A, C:\Windows\Temp\e942428e\SetupDataMngr_Koyote.exe, , [621fc9265922da5c4bf48e9aa55ce917], 

PUP.Optional.SweetPacks.A, C:\Users\acer\AppData\Local\Temp\BundleSweetIMSetup.exe, , [e49d836ca9d2df577a7ce82821e241bf], 

PUP.Optional.Delta.A, C:\Users\acer\AppData\Local\Temp\DeltaTB.exe, , [a2dfe00f562561d5b641f11f2ad904fc], 

PUP.Optional.Babylon.A, C:\Users\acer\AppData\Local\Temp\MybabylonTB.exe, , [4f3208e790eb62d44eaaf51bf50e738d], 

PUP.Optional.FunMoods.A, C:\Windows\System32\Tasks\Funmoods Chat, , [a2df618e4d2edf57b57ca3713ac9e51b], 

PUP.Optional.FunMoods.A, C:\Windows\Tasks\Funmoods Chat.job, , [5031df108eed3afcbc76e52fb74c17e9], 

PUP.Optional.Superfish.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [b2cf08e793e83ef87238ee320af9d22e], 

PUP.Optional.Superfish.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, , [1170a14e5625bc7a3971e7397a8901ff], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0.localstorage-journal, , [f68baf40f883ab8b63c7df495ba8f808], 

PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jpmbfleldcgkldadpdinhjjopdfpjfjp_0.localstorage, , [e79ad11e39422a0ca74481a98281a759], 

PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jpmbfleldcgkldadpdinhjjopdfpjfjp_0.localstorage-journal, , [96ebe30c552662d4d81337f31ce749b7], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Local\funmoods_2.3.1.crx, , [bcc5c72886f57fb7d567dd8e9b69639d], 

PUP.Optional.Funmoods.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage-journal, , [38496c836f0c1422a239b2b908fc8878], 

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\CT3202918.txt, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\initData.json, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\manifest.json, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\apnuserid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\appid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\geodata.xml, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\setupCfg.xml, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\sysid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\trackid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\config.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\info.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\src.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\STTL.DAT, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\TTL.DAT, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001887.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001898.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001903.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001918.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001919.log, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\CURRENT, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOCK, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOG, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOG.old, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\MANIFEST-001917, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC\toolbar.crx, , [176a42ad007b03331c614a9c42c040c0], 

PUP.Optional.SweetPage.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "hxxp://www.sweet-page.com/newtab/?type=nt&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB");), ,[0a7719d61b6085b134c048f160a56997]

PUP.Optional.SweetPage.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "hxxp://www.sweet-page.com/?type=hp&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB");), ,[88f988673a4174c2fafb58e1ab5a6f91]
 

Physical Sectors: 0

(No malicious items detected)
 
 

(end)

Soll ich das bereinigen?

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen aus den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Code:

# AdwCleaner v4.002 - Bericht erstellt am 02/11/2014 um 00:15:29

# DB v2014-10-26.6

# Aktualisiert 27/10/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : acer - ACER-PC

# Gestartet von : C:\Users\acer\Desktop\AdwCleaner_4.002.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Datei Gelöscht : C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage

Datei Gelöscht : C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v8.0.7601.17514
 
 

-\\ Mozilla Firefox v12.0 (de)
 
 

-\\ Google Chrome v
 
 

*************************
 

AdwCleaner[R0].txt - [68098 octets] - [13/09/2014 11:50:16]

AdwCleaner[R1].txt - [2389 octets] - [15/09/2014 17:08:23]

AdwCleaner[R2].txt - [19360 octets] - [27/10/2014 13:26:42]

AdwCleaner[R3].txt - [1422 octets] - [01/11/2014 14:31:45]

AdwCleaner[R4].txt - [1482 octets] - [01/11/2014 14:38:03]

AdwCleaner[R5].txt - [1602 octets] - [02/11/2014 00:13:20]

AdwCleaner[S0].txt - [63415 octets] - [13/09/2014 11:53:17]

AdwCleaner[S1].txt - [2450 octets] - [15/09/2014 17:43:12]

AdwCleaner[S2].txt - [17292 octets] - [27/10/2014 13:29:07]

AdwCleaner[S3].txt - [1535 octets] - [01/11/2014 14:40:17]

AdwCleaner[S4].txt - [1515 octets] - [02/11/2014 00:15:29]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1575 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.3.5 (10.31.2014:1)

OS: Windows 7 Home Premium x64

Ran by acer on 02.11.2014 at  0:20:26,35

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\acer\AppData\Roaming\mozilla\firefox\profiles\mo5qape1.default\prefs.js
 

user_pref("extensions.AVIRA-V7.com.avira.dnt.rules", "\"{\\\"Version\\\":43,\\\"Companies\\\":[{\\\"company\\\":\\\"Google Inc\\\",\\\"rules\\\":[{\\\"name\\\":\\\"Google Anal

user_pref("extensions.AVIRA-V7.domain", "\"avira.search.ask.com\"");

user_pref("extensions.AVIRA-V7.hpr_cr", "\"hxxp://avira.search.ask.com/?tpid=AVIRA-V7&o=APN11074&pf=&trgb=ALL&p2=%5EB0Q%5EYYYYYY%5EYY%5EDE&gct=hp&apn_ptnrs=%5EB0Q&apn_dtid=%5E
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 02.11.2014 at  0:27:53,59

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-11-2014

Ran by acer (administrator) on ACER-PC on 02-11-2014 00:29:34

Running from C:\Users\acer\Desktop

Loaded Profile: acer (Available profiles: acer)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchService.exe

(Microsoft Corporation) C:\Windows\System32\wisptis.exe

(Microsoft Corporation) C:\Windows\System32\wisptis.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Akamai Technologies, Inc.) C:\Users\acer\AppData\Local\Akamai\netsession_win.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe

(Avira) C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-19] (Synaptics Incorporated)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-02] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [38872 2012-07-31] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-11] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-16] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [124720 2014-10-09] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Google Update] => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)

HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [Akamai NetSession Interface] => C:\Users\acer\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\Run: [AviraSpeedup] => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-10-29] (Avira)

HKU\S-1-5-21-3090159671-3938598571-1968455546-1000\...\MountPoints2: {8512f947-4be6-11e1-8e2a-806e6f6e6963} - D:\.\AutorunX\AutorunX.exe

HKU\S-1-5-18\...\Run: [AviraSpeedup] => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [5395192 2014-10-29] (Avira)

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6137481703E0CC01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKCU - C5B99FE4EBF6436E96255EC4E534CB93 URL = hxxp://yandex.ru/yandsearch?win=47&clid=135294&text={searchTerms}

SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default

FF SearchEngineOrder.3: Bing 

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 -> C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)

FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @soe.sony.com/installer,version=1.0.3 -> C:\Users\acer\AppData\LocalLow\Sony Online Entertainment\npsoe.dll No File

FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin HKCU: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002435.xml

FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\yandex.ru-002613.xml

FF SearchPlugin: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\searchplugins\ybqs-yandex.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

FF Extension: Яндекс.Бар - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\yasearch@yandex.ru [2013-06-11]

FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]

FF Extension: Adblock Plus - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-01]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-02-20]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]
 

Chrome: 

=======

CHR HomePage: Default -> 

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-02]

CHR Extension: (YouTube) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-01]

CHR Extension: (Adblock Plus) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-11]

CHR Extension: (Google-Suche) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-01]

CHR Extension: (hxxp://www.facebook.com/?ref=logo) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpipgdjaiclliilaeaehcgkihcbcmooo [2012-05-21]

CHR Extension: (Stylish) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2013-02-01]

CHR Extension: (hxxp://www.yandex.ru/) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfjacpammignfpjljfmgpdebpnjfpcjl [2012-05-21]

CHR Extension: (WebSite Recommendation) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\jopdpbolklklaiookikgmdinfbooiipj [2013-12-07]

CHR Extension: (F2B Dark Electrique - Neon Blue on Black) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\modaobgliiinjfofblifbikbemfealmf [2012-05-21]

CHR Extension: (Google Wallet) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Mehr Leistung und Videoformate für dein HTML5 <video>) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-02-01]

CHR Extension: (Google Mail) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-01]

CHR HKCU\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx []

CHR HKLM-x32\...\Chrome\Extension: [kppnoegbbaphhibbpdojjiehofchhdgk] - C:\Users\acer\AppData\Local\CRE\kppnoegbbaphhibbpdojjiehofchhdgk.crx []

CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-02-07]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [994552 2014-10-16] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [162096 2014-10-09] (Avira Operations GmbH & Co. KG)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

S2 Update Deal Keeper; "C:\Program Files (x86)\Deal Keeper\updateDealKeeper.exe" [X]

S2 Util Deal Keeper; "C:\Program Files (x86)\Deal Keeper\bin\utilDealKeeper.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-16] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-16] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-02] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)

S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]

S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]

S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]

S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [X]

S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [X]

S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-11-02 00:29 - 2014-11-02 00:30 - 00019413 _____ () C:\Users\acer\Desktop\FRST.txt

2014-11-02 00:27 - 2014-11-02 00:27 - 00001193 _____ () C:\Users\acer\Desktop\JRT.txt

2014-11-01 21:20 - 2014-11-01 21:20 - 00000000 ____D () C:\Users\acer\Desktop\Neuer Ordner

2014-11-01 14:45 - 2014-11-01 14:45 - 00000000 ____D () C:\Windows\ERUNT

2014-11-01 14:29 - 2014-11-01 14:29 - 00000000 ____D () C:\Users\acer\Desktop\FRST-OlderVersion

2014-11-01 14:25 - 2014-11-01 14:25 - 01706359 _____ (Thisisu) C:\Users\acer\Desktop\JRT.exe

2014-10-31 12:10 - 2014-11-02 00:19 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-31 12:09 - 2014-10-31 12:09 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-10-31 12:09 - 2014-10-31 12:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-31 12:09 - 2014-10-31 12:09 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-10-31 12:09 - 2014-10-31 12:09 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-10-31 12:09 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-31 12:09 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-31 12:09 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-10-30 18:37 - 2014-10-30 18:37 - 00001613 _____ () C:\Users\Public\Desktop\League of Legends.lnk

2014-10-30 18:37 - 2014-10-30 18:37 - 00000000 ____D () C:\Riot Games

2014-10-30 18:37 - 2014-10-30 18:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends

2014-10-29 23:21 - 2014-10-29 23:21 - 00003320 _____ () C:\Windows\System32\Tasks\AviraSpeedup

2014-10-29 23:16 - 2014-10-29 23:22 - 00000000 ____D () C:\Users\acer\AppData\Local\AviraSpeedup

2014-10-29 16:07 - 2014-11-02 00:29 - 00000000 ____D () C:\FRST

2014-10-29 16:05 - 2014-11-01 14:29 - 02114048 _____ (Farbar) C:\Users\acer\Desktop\FRST64.exe

2014-10-29 14:26 - 2014-10-29 14:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup

2014-10-29 14:12 - 2014-10-29 14:12 - 01998336 _____ () C:\Users\acer\Desktop\AdwCleaner_4.002.exe

2014-10-24 16:25 - 2014-11-01 14:26 - 00000000 ____D () C:\Users\acer\Desktop\Ёлка

2014-10-12 14:02 - 2014-10-12 14:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-11-02 00:25 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-11-02 00:25 - 2009-07-14 05:45 - 00015392 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-11-02 00:23 - 2014-02-08 20:23 - 00000288 _____ () C:\Windows\Tasks\Funmoods Chat.job

2014-11-02 00:21 - 2012-01-31 09:39 - 01311040 _____ () C:\Windows\WindowsUpdate.log

2014-11-02 00:16 - 2012-01-31 12:18 - 00343912 _____ () C:\Windows\PFRO.log

2014-11-02 00:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-11-02 00:16 - 2009-07-14 05:51 - 00686641 _____ () C:\Windows\setupact.log

2014-11-02 00:15 - 2014-09-13 11:50 - 00000000 ____D () C:\AdwCleaner

2014-11-02 00:06 - 2012-02-01 18:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job

2014-11-01 23:54 - 2014-02-12 22:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-11-01 17:55 - 2009-07-14 18:58 - 00696370 _____ () C:\Windows\system32\perfh007.dat

2014-11-01 17:55 - 2009-07-14 18:58 - 00147634 _____ () C:\Windows\system32\perfc007.dat

2014-11-01 17:55 - 2009-07-14 06:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-11-01 17:44 - 2012-02-01 18:40 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job

2014-11-01 14:26 - 2013-12-01 13:18 - 00000000 ____D () C:\Users\acer\Desktop\Музыка

2014-11-01 14:26 - 2012-07-09 21:08 - 00000000 ____D () C:\Users\acer\Desktop\PC

2014-11-01 14:26 - 2012-04-25 12:48 - 00000000 ____D () C:\Users\acer\Desktop\Mein Ordner

2014-11-01 14:01 - 2012-02-01 19:13 - 00000000 ____D () C:\Users\acer\AppData\Roaming\Skype

2014-10-29 23:31 - 2013-02-24 23:22 - 03190272 ___SH () C:\Users\acer\Desktop\Thumbs.db

2014-10-29 23:24 - 2014-08-05 09:04 - 00000000 ____D () C:\ProgramData\Package Cache

2014-10-29 23:23 - 2013-07-30 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-10-29 23:23 - 2013-07-30 12:44 - 00000000 ____D () C:\Program Files (x86)\Avira

2014-10-29 14:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat

2014-10-29 14:51 - 2012-02-19 03:32 - 00000000 ____D () C:\Users\acer\AppData\Local\Akamai

2014-10-29 14:50 - 2014-01-12 01:27 - 00000000 ____D () C:\Program Files (x86)\osu!

2014-10-29 14:49 - 2009-07-14 19:18 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-10-29 14:49 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration

2014-10-29 14:19 - 2012-01-31 11:36 - 00001065 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-10-29 14:19 - 2012-01-31 09:47 - 00001168 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-10-29 14:19 - 2012-01-31 09:47 - 00000981 _____ () C:\Users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk

2014-10-29 13:55 - 2012-01-31 09:47 - 00000000 ____D () C:\Users\acer

2014-10-22 16:01 - 2012-02-01 18:40 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA

2014-10-22 16:01 - 2012-02-01 18:40 - 00003688 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core

2014-10-16 14:03 - 2013-07-30 12:45 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys

2014-10-16 14:03 - 2013-07-30 12:44 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-10-16 14:03 - 2013-07-30 12:44 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-10-12 14:02 - 2012-02-01 19:13 - 00000000 ____D () C:\ProgramData\Skype

2014-10-04 16:07 - 2014-05-11 18:38 - 00000499 _____ () C:\Users\acer\Desktop\7.txt
 

Some content of TEMP:

====================

C:\Users\acer\AppData\Local\Temp\AskSLib.dll

C:\Users\acer\AppData\Local\Temp\avgnt.exe

C:\Users\acer\AppData\Local\Temp\AviraSetup268150.exe

C:\Users\acer\AppData\Local\Temp\bdfilters.dll

C:\Users\acer\AppData\Local\Temp\Delta.exe

C:\Users\acer\AppData\Local\Temp\DivXSetup.exe

C:\Users\acer\AppData\Local\Temp\drm_dyndata_7380006.dll

C:\Users\acer\AppData\Local\Temp\DWPUpgradeInstaller.exe

C:\Users\acer\AppData\Local\Temp\FlashPlayerUpdate.exe

C:\Users\acer\AppData\Local\Temp\gface_swap.exe

C:\Users\acer\AppData\Local\Temp\hcuninstaller_20131028_134921_3792.exe

C:\Users\acer\AppData\Local\Temp\i4jdel0.exe

C:\Users\acer\AppData\Local\Temp\ICSharpCode.SharpZipLib.dll

C:\Users\acer\AppData\Local\Temp\propsys.dll

C:\Users\acer\AppData\Local\Temp\qdf_n_pe.dll

C:\Users\acer\AppData\Local\Temp\Quarantine.exe

C:\Users\acer\AppData\Local\Temp\SkypeSetup.exe

C:\Users\acer\AppData\Local\Temp\SpotifyUninstall.exe

C:\Users\acer\AppData\Local\Temp\sqlite3.dll

C:\Users\acer\AppData\Local\Temp\swt-win32-3349.dll

C:\Users\acer\AppData\Local\Temp\TuneUpUtilities2013_de-DE.exe

C:\Users\acer\AppData\Local\Temp\Uninstaller-4088.exe

C:\Users\acer\AppData\Local\Temp\WSSetup.exe

C:\Users\acer\AppData\Local\Temp\YgoUpdater.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-27 19:18
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-11-2014

Ran by acer at 2014-11-02 00:30:44

Running from C:\Users\acer\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)

Adobe Reader 9.5.2 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.2 - Adobe Systems Incorporated)

Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)

Ashampoo Burning Studio FREE v.1.14.5 (HKLM-x32\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG)

ATI AVIVO64 Codecs (Version: 10.7.0.40702 - ATI Technologies Inc.) Hidden

ATI Catalyst Install Manager (HKLM\...\{BADFD936-E907-C666-A6E1-3C04C06E4260}) (Version: 3.0.732.0 - ATI Technologies, Inc.)

Audiograbber 1.83 SE  (HKLM-x32\...\Audiograbber) (Version: 1.83 SE  - Audiograbber)

Avira (HKLM-x32\...\{dc9a688a-12cb-4a22-b449-23d849d01dc7}) (Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.1.24.28609 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)

Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C1200}) (Version: 12.18.0.3051 - APN, LLC)

Avira System Speedup (HKLM-x32\...\AviraSpeedup) (Version: 1.3.1.9970 - Avira System Speedup)

Bamboo (HKLM\...\Pen Tablet Driver) (Version: 5.2.5-5 - Wacom Technology Corp.)

Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - )

Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)

Broadcom Gigabit NetLink Controller (HKLM\...\{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}) (Version: 12.26.02 - Broadcom Corporation)

ccc-core-static (x32 Version: 2009.0702.1239.20840 - Ihr Firmenname) Hidden

DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.24 - DivX, LLC)

Google Chrome (HKCU\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)

Happy Cloud Client (HKCU\...\HappyCloud) (Version: 3.59 - Happy Cloud, Inc.)

Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)

Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)

League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )

League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden

Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Movies Toolbar for Chrome (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaCR) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION

Movies Toolbar for Internet Explorer (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION

Mozilla Firefox 12.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 12.0 (x86 de)) (Version: 12.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)

MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden

NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)

OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)

osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy)

PowerTeacher Version 23.04.026.P34 (HKLM-x32\...\PowerTeacher_is1) (Version: 23.04.026.P34 - admigro media GmbH)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5911 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)

Senus 2012 (HKLM-x32\...\Senus 2012) (Version: 2012 - Senus)

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)

Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.2.0 - Synaptics Incorporated)

TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)

Update for Funmoods Chat (HKCU\...\Funmoods Chat) (Version:  - Update for Funmoods Chat) <==== ATTENTION

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden

Vegas Pro 11.0 (HKLM-x32\...\{6BE7495E-8DF1-11E1-BB7D-F04DA23A5C58}) (Version: 11.0.682 - Sony)

VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)

WebTablet FB Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.0.0.1 - Wacom Technology Corp.)

WebTablet IE Plugin (HKLM-x32\...\Wacom WebTabletPlugin for IE) (Version: 1.1.0.12 - Wacom Technology Corp.)

WebTablet Netscape Plugin (HKLM-x32\...\Wacom WebTabletPlugin for Netscape) (Version: 1.1.0.10 - Wacom Technology Corp.)

WinRAR 4.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\acer\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3090159671-3938598571-1968455546-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\acer\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
 

==================== Restore Points  =========================
 

29-10-2014 13:25:01 Avira System Speedup(1.3.1.9930)

29-10-2014 22:18:04 Avira System Speedup(1.3.1.9970)

30-10-2014 17:31:35 Removed League of Legends

30-10-2014 17:36:37 Installed League of Legends
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - \Funmoods Chat No Task File <==== ATTENTION

Task: {0E581D78-090E-4B3F-AD54-0D14A0FE299D} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {0E7D64A6-726E-4520-97EE-93D347538AE7} - System32\Tasks\{B838A91B-D1E3-401C-9EA5-16C1B1C9DD79} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)

Task: {36598214-6DC8-4F89-A570-7DC3D33FD8BF} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)

Task: {39BC67C8-1301-43CD-AC38-AE940BA98B60} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)

Task: {4C446A1C-E962-4CA1-8D3E-88EB4082CEB4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)

Task: {54C625ED-6DB0-4300-ACF8-4C6FAD13148B} - System32\Tasks\{6C9FA6D1-EA02-43B7-852D-72304E2BC18A} => C:\Program Files (x86)\JoWooD\NfH_Compilation\NfH1\bin\game.exe

Task: {5DCBF933-A080-410F-AAF5-4D6B010B5817} - System32\Tasks\AviraSpeedup => C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [2014-10-29] (Avira)

Task: {6C29B57E-6178-47CC-A301-5FBF818442E7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)

Task: {74D4980C-87D8-47F2-8ED9-7B030B88CC9F} - System32\Tasks\{2EE2B7AA-5C0C-44A2-9C18-7743C493ABC2} => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)

Task: {DE0E5CE5-8C3C-4C97-9202-C28256F3A581} - System32\Tasks\VKSaverUpdate => C:\ProgramData\VKSaver\VKSaver.exe [2013-06-10] (AudioVkontakte.ru)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000Core.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3090159671-3938598571-1968455546-1000UA.job => C:\Users\acer\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-09-22 20:00 - 2011-09-08 16:48 - 01183096 _____ () C:\Program Files\Tablet\Pen\libxml2.dll

2013-02-13 03:37 - 2013-02-13 03:37 - 01263952 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

2009-05-13 10:44 - 2009-05-13 10:44 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2012-01-31 10:19 - 2012-01-31 10:19 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2013-02-13 03:38 - 2013-02-13 03:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^Users^acer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup

MSCONFIG\startupreg: ApnTBMon => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"

MSCONFIG\startupreg: Overwolf => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: VKSaver => C:\ProgramData\VKSaver\VKSaver.exe
 

========================= Accounts: ==========================
 

acer (S-1-5-21-3090159671-3938598571-1968455546-1000 - Administrator - Enabled) => C:\Users\acer

Administrator (S-1-5-21-3090159671-3938598571-1968455546-500 - Administrator - Disabled)

Gast (S-1-5-21-3090159671-3938598571-1968455546-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3090159671-3938598571-1968455546-1002 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft-Teredo-Tunneling-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 

Name: Microsoft-Adapter für Miniports virtueller WiFis

Description: Microsoft-Adapter für Miniports virtueller WiFis

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: vwifimp

Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)

Resolution: Update the driver
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Processor: AMD Athlon(tm) II Dual-Core M300

Percentage of memory in use: 30%

Total physical RAM: 4094.36 MB

Available physical RAM: 2841.64 MB

Total Pagefile: 8186.91 MB

Available Pagefile: 6466.52 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:297.99 GB) (Free:203.12 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: CA20FFB1)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c

Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File

FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]

Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - \Funmoods Chat No Task File <==== ATTENTION

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1

C:\Users\acer\AppData\Roaming\FUNMOO~1

C:\Windows\Tasks\Funmoods Chat.job

EmptyTemp:

Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-11-2014

Ran by acer at 2014-11-02 14:36:32 Run:1

Running from C:\Users\acer\Desktop

Loaded Profile: acer (Available profiles: acer)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

SearchScopes: HKCU - yandex.ru-002434 URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110819&tt=050412_30b&babsrc=SP_ss&mntrId=92562bcb0000000000000ceee6a3fe7c

Toolbar: HKLM-x32 - No Name - {e5d4f4fd-a039-4670-8354-633c30a5f54e} -  No File

FF Extension: Ask New Tabs - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} [2014-08-29]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [Not Found]

FF Extension: No Name - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com [Not Found]

Task: C:\Windows\Tasks\Funmoods Chat.job => C:\Users\acer\AppData\Roaming\FUNMOO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {02F621BE-E296-4E88-B858-8C633FF9ABE8} - \Funmoods Chat No Task File <==== ATTENTION

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1

C:\Users\acer\AppData\Roaming\FUNMOO~1

C:\Windows\Tasks\Funmoods Chat.job

EmptyTemp:

Hosts:

         

*****************
 

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\yandex.ru-002434" => Key deleted successfully.

"HKCR\CLSID\yandex.ru-002434" => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{e5d4f4fd-a039-4670-8354-633c30a5f54e} => value deleted successfully.

"HKCR\Wow6432Node\CLSID\{e5d4f4fd-a039-4670-8354-633c30a5f54e}" => Key not found.

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1} => Moved successfully.

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\ffxtlbra@softonic.com not found.

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} not found.

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} not found.

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\WebSiteRecommendation@weliketheweb.com not found.

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi not found.

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\extensions\faststartff@gmail.com not found.

C:\Windows\Tasks\Funmoods Chat.job => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{02F621BE-E296-4E88-B858-8C633FF9ABE8}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02F621BE-E296-4E88-B858-8C633FF9ABE8}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Funmoods Chat" => Key deleted successfully.

C:\ProgramData\TEMP => ":D1B5B4F1" ADS removed successfully.

C:\Users\acer\AppData\Roaming\FUNMOO~1 => Moved successfully.

"C:\Windows\Tasks\Funmoods Chat.job" => File/Directory not found.

"C:\Windows\System32\Drivers\etc\hosts" => Could not move.

Could not reset Hosts.

EmptyTemp: => Removed 30.5 GB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog ====

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=b77b93d1870be24da5d2e00c382333cc

# engine=20894

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-11-02 06:03:32

# local_time=2014-11-02 07:03:32 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 16936 159503590 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 101281 166581262 0 0

# scanned=156879

# found=109

# cleaned=0

# scan_time=6819

sh=1B2E938EAEA27B990355B6C3DB6C1C1A9F33BFB4 ft=1 fh=c71c0011ddfe20fa vn="Variante von Win32/Toolbar.Montiera.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll.vir"

sh=7A18C5B083B2038CB2DE877694085DF633F40C46 ft=1 fh=c71c0011b1f6426d vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll.vir"

sh=AC056A6D25E04155BA23BF34670C3E6D2A85B248 ft=1 fh=c71c0011bbd638b2 vn="Variante von Win32/Toolbar.Babylon.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe.vir"

sh=C02A094933FD68AE44EAE0EA249EB6A981353C91 ft=1 fh=1cff81f31528b9a9 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll.vir"

sh=9E60FE40C5BA463780413D5D22446858015EFF4B ft=1 fh=b2e9a257c367f009 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll.vir"

sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"

sh=F94C0CB845D3D0D2D83D18A126427A63F85F8FD7 ft=0 fh=0000000000000000 vn="Win32/DealPly.J evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPly.crx.vir"

sh=46511245FAEE07E002BCCA6BA42FE4534642C2D7 ft=1 fh=89223efb08132e7c vn="Win32/DealPly.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\DealPlyUpdateRun.exe.vir"

sh=254309F8F11F953717BFBF6360B69A7B4843CB9C ft=1 fh=d03c27fa69eccd55 vn="Win32/DealPly.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPly\uninst.exe.vir"

sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DVDVideoSoftTB\DVDVideoSoftTBToolbarHelper.exe.vir"

sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DVDVideoSoftTB\ldrtbDVDV.dll.vir"

sh=A2D929A9864513C0E8ED84AAD622EF6ADCC9B950 ft=1 fh=22c06217fc444ec5 vn="Win32/Toolbar.Conduit.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll.vir"

sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll.vir"

sh=F1F86700107D394FA2F9D359D352F8B87418618D ft=1 fh=8dea19f4e1c9b63b vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll.vir"

sh=2DA4F830FEA8A2B651772FE0BB5A0F5174639EA1 ft=1 fh=86e1957bfb53b657 vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\Datamngr.dll.vir"

sh=B9E7ADA4304AD78A24713CF960791C2AF5480510 ft=1 fh=9cecbe546a2e37e7 vn="Variante von Win32/Toolbar.SearchSuite.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe.vir"

sh=FACDD305A10E8E43FE6688711FDF87467BB82505 ft=1 fh=009ec32f04d9be78 vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\del_DM_DLL_nslA855.dll.vir"

sh=E332D7126309CCD0ED18E7BB12B1B7F8B2D3E2A1 ft=1 fh=f14ce336020fa746 vn="Variante von Win32/Toolbar.SearchSuite.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\del_DM_EXE_nslA855.exe.vir"

sh=F23640CE64099EA0042D14D72F5AD6115BBF0A01 ft=1 fh=ea31ed6c2b1734d0 vn="Win32/Toolbar.SearchSuite.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\del_DM_LL_nslA855.dll.vir"

sh=C9D53FDAC16F88F9F2562D5F99CAB1CE755B1F99 ft=1 fh=328ccf6a797eb6f6 vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\del_mg_nslA855.dll.vir"

sh=233BDAD10DC815788EA0C0DE123C7AE45003E325 ft=1 fh=cd98a402ff846ffc vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\IEBHO.dll.vir"

sh=7C44707C1F931679E4994405115DAA7654D8C80F ft=1 fh=125e55d2bad626e1 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\Internet Explorer Settings.exe.vir"

sh=65B406AF190B54B24F2D27945FC70C97C83357F8 ft=1 fh=d48040a09a2c0de9 vn="Variante von Win32/Toolbar.SearchSuite.S evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\mgrldr.dll.vir"

sh=BFDC3839ACE19D582651CBDBCA401D85ACB87CEE ft=1 fh=c71c0011ea55d4ef vn="Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtUser.exe.vir"

sh=E00F8AD7A8F9DE954A7ADED2B0284EF33A562D09 ft=1 fh=f6e7eb45209dea96 vn="Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\__searchresultsDx.dll.vir"

sh=128E0462DEB7C01217708FB47FC515AEC4C65217 ft=1 fh=6c9d87d537781724 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\__searchresultstb.dll.vir"

sh=320458DEE246216A9BE6940D1F7FAB2F87D28FCD ft=1 fh=d569d2f13dc21f85 vn="Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll.vir"

sh=BD542BE6C2E07049717CAC5A206CD974ED57A84E ft=1 fh=5c7122502761f498 vn="Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\x64\Datamngr.dll.vir"

sh=1128149A2E0312FF608FBCE051FE22EFD5740854 ft=1 fh=2ee3c064dd671c10 vn="Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\x64\del_DM_LL_nslA855.dll.vir"

sh=04DE52A86FA5EBCD1614B831576CD5979E2A69A0 ft=1 fh=0a19d52d9413973b vn="Variante von Win64/Toolbar.SearchSuite.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\x64\IEBHO.dll.vir"

sh=59386576E3DFEF1DEAC7680A2F5BC49651D0B37F ft=1 fh=7d81dc70236e765c vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\x64\Internet Explorer Settings.exe.vir"

sh=34E0216C0E3971710EE137DE6435C1ABD09BDA28 ft=1 fh=49fa574500f43e60 vn="Variante von Win64/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Movies Toolbar\Datamngr\x64\mgrldr.dll.vir"

sh=73BB5DF7E9DF3853432A9C57EEB6B3E402DFD18B ft=1 fh=aec10d10b2ea1f6d vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir"

sh=D03D626914970BCCD7E9D6D0AF04D8DDDD102D35 ft=1 fh=04c020ac703b0538 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir"

sh=6CF920A16AACB0836B4B5DC10476C5FAFFE26F28 ft=1 fh=1c0d0ed03d7013d8 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir"

sh=6AE9B977E83409D81DF76032D19D20C5D979CCE3 ft=1 fh=5b6bc400114c9d9e vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir"

sh=A1CC7CCCBBD16193FFDBD780FB6B22446FD2B37A ft=1 fh=b7f45b77afc5218d vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe.vir"

sh=E3A6216DB4B39037B2CE98A02C02294AAD6BB4DD ft=1 fh=bd2e5f41dfe0ec50 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir"

sh=789312B5C0243DE4A33FF098B273EFA825591D85 ft=1 fh=987a98390317f4c6 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir"

sh=E39E2CEAF025D603D4A051F2C89E4C611740D292 ft=1 fh=7b980ed7aab60294 vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll.vir"

sh=1C3BD2650323564B8EF1EE88B07172C71A266D1D ft=1 fh=73589aeb7a059035 vn="Variante von Win64/Conduit.SearchProtect.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir"

sh=3B14C0CD898D3D3058C99FB4839F9EF906B2BDA0 ft=1 fh=1a6fa5e175f53ed4 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"

sh=7E33325BF18798932934E608BBFD02CA760B7C31 ft=1 fh=33032171096a8844 vn="Win64/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"

sh=257DB6A82CCE65D1F3727B7C7CCD5EEB9A448089 ft=1 fh=9846cd7c0f5842d8 vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\HpUI.exe.vir"

sh=BC9BCDBB6A2B4FDA4CCD4A03144130D134D8918E ft=1 fh=787e176d95b83b21 vn="Win64/Thinknice.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader64.exe.vir"

sh=808812BA5662DFCE16C25B1723B7DA59F7A8F1ED ft=1 fh=8d34edd66379c422 vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\RSHP.exe.vir"

sh=728A8D0606BB308F97B4F22002403F1A6A164BF1 ft=1 fh=6b9c82a417a73b14 vn="Win32/Thinknice.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"

sh=AD61F34F7552AFEA24891571B725705E41E6EDCF ft=1 fh=b4105e1d706221cc vn="Variante von Win64/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"

sh=FFE8F39A33B1531FE5382A8BB0C86CA4D73AA2B9 ft=1 fh=e9176271d561e2c5 vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"

sh=8A84B1C0899412460D707AF03F6403D62CF79994 ft=1 fh=bff85e0bee470375 vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll32.dll.vir"

sh=CAF658A7FB958D0D5A4D34BB7D2A9E6369E25DEA ft=1 fh=8e0dbcc0052f402a vn="Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll64.dll.vir"

sh=668551CC7FF664C1A1CA5A182FBDFDCA6FAAFD14 ft=1 fh=8171cef844f03bd7 vn="Variante von Win32/Wajam.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\IE\priam_bho.dll.vir"

sh=A252FEDCEEDCA1655D593982040CCEED07812DEF ft=1 fh=975aa770e795194d vn="Win32/Wajam.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Wajam\Updater\WajamUpdater.exe.vir"

sh=A096FAEDE385C6E3A659CD3D0D29769F6A17F64E ft=1 fh=575fcee60460456c vn="Variante von Win32/ELEX.AV evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"

sh=FDF652F803592E6840E076A89A19BF655686B8A8 ft=1 fh=de76e936397b25d2 vn="Variante von Win32/Adware.Yontoo.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll.vir"

sh=E15DF75E5B81A209E0E453092C9610C3F8DC7073 ft=1 fh=8918dac93ad3a346 vn="Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win32cert.dll.vir"

sh=9B56D5787C88CF939DABA1E9273775A1D33EF25F ft=1 fh=8aacdf233e2d6e39 vn="Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win32prop.dll.vir"

sh=2FA019C3D1CC2BC1905FBD6765DA3CFBE851DD64 ft=1 fh=f275e610e24fd946 vn="Win64/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win64cert.dll.vir"

sh=34ABB88310B01A075382292FDE9F2B6E727E5D66 ft=1 fh=1bef8d0f51d0bf3a vn="Win64/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\wincert\win64prop.dll.vir"

sh=9C6C68EFAE364FC17008C32848E148F86D468C99 ft=1 fh=c71c0011e4b098f3 vn="Variante von Win32/ELEX.AM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir"

sh=43A205985790C47A7E611FA2D3CAB9B4EB59121F ft=1 fh=5bd497922ffc5928 vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Babylon\Setup\BExternal.dll.vir"

sh=1B2801DD02E9D9B7F27789ED161BC1761943E921 ft=1 fh=8073091e54552e56 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Babylon\Setup\IECookieLow.dll.vir"

sh=3A9D7D4639B5EB8BEC42DF972C44493690EAADFC ft=1 fh=b8a59cf28e1dc165 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Babylon\Setup\Setup.exe.vir"

sh=E5AD99CE7C7362CA566156033ECB0F04F9437CA7 ft=1 fh=f45d83e01e1c8734 vn="Win32/Toolbar.Conduit.Q evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Conduit\CT2269050\DVDVideoSoftTBAutoUpdateHelper.exe.vir"

sh=027DF2D2944EA506A71D61928674C2CC42A8FE69 ft=1 fh=4c97c45eed1dce37 vn="Win32/Toolbar.Babylon evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe.vir"

sh=22835DE55335F850274B44722A1EBD335BC35576 ft=1 fh=79a216568a3d8f28 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Temp\CT2269050\chLogic.exe.vir"

sh=CCC805E46DFD5C628CEDEF0E5CDF99FB58C20D14 ft=1 fh=ec7b87824cc7cfb0 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Temp\CT2269050\ffLogic.exe.vir"

sh=DAF68CAD7214BEE00B94E06C7C5B88F84128F847 ft=1 fh=53c02cbd14e210f6 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Temp\CT2269050\ieLogic.exe.vir"

sh=5A0B2E3D7EA5AAACCC7AA2A579373021204BEDA1 ft=1 fh=572549f60b65a80d vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Local\Temp\CT2269050\statisticsStub.exe.vir"

sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll.vir"

sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll.vir"

sh=ABF759CA3BFB16DE62197DD7C417AC5039A43AE0 ft=1 fh=1801af74030ebca1 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll.vir"

sh=A011DFD8D93BBA7B75833C0F85FF6E1D25594B84 ft=1 fh=049679d5506e563e vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\Plugins\npConduitFirefoxPlugin.dll.vir"

sh=9D92140EDDAC2ECE093A4191F70F42C0E5EE133D ft=0 fh=0000000000000000 vn="Win32/DealPly.J evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}\chrome\content\dealply.xul.vir"

sh=A1445110587CC891758AEBD7232896443E6C7E74 ft=1 fh=c71c0011b94160dc vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Roaming\OpenCandy\D8E4CF63C74E453686E65E21C601F03B\Installer.exe.vir"

sh=CC76FC2BDA9226AE4A1DA5861A82FD0CB9216346 ft=1 fh=7187980c3cbb10db vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Roaming\OpenCandy\D8E4CF63C74E453686E65E21C601F03B\RAWinstaller.exe.vir"

sh=A37C5AAD56345BAA43F1CE25FFEEC576180A90C6 ft=1 fh=7becd807bd4cc6c5 vn="Variante von Win32/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\acer\AppData\Roaming\OpenCandy\D8E4CF63C74E453686E65E21C601F03B\SnapDo_ALL_p2v2.exe.vir"

sh=3F1E3FEADF5EC6EE628449CBC22C5D985386C18F ft=1 fh=e743fc859d55bcb1 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"

sh=70F2C2997BD72D7C6DE593FBDFE51E165BC10FC6 ft=1 fh=739e9bc79e344b23 vn="Variante von Win64/Riskware.NetFilter.F Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys.vir"

sh=49A29048C23AD573DED2CE5EFF746E4FE69E657F ft=1 fh=b54cdac68d2446e2 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF10.dll"

sh=470D04D2171F4F24A9E5872AB2AAEED8121BFBF8 ft=1 fh=6e4143d1284c099e vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF11.dll"

sh=475D72A9FD5908205E69B025FE8630B45774CDDF ft=1 fh=6a17b26d704adaa7 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF12.dll"

sh=F3AFA036C42DD4C4671BB67BED4529097153BBA7 ft=1 fh=932ae7b14070b337 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF13.dll"

sh=3C5D119AE6AD50FA3BE3D99BE668F4082CC47957 ft=1 fh=7b6bd3059da381c8 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF14.dll"

sh=78558836B54EC77657B68002F92C729AD0A4780F ft=1 fh=90479941ff9705bf vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF15.dll"

sh=F5FD550B8627C4AA46F2AB63E4AA3B4D2BD686DA ft=1 fh=2a45124443a41e97 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF16.dll"

sh=2B4C8E9C34509CE84EADBF15A1D28BB6DBB8756F ft=1 fh=aff9fa589f3ab385 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF17.dll"

sh=0DAA4A24C40AED6F7191280B94E29F0127B97724 ft=1 fh=530c55c44dccbb3c vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF18.dll"

sh=92944E2026EBC85DD0E217D30170D7C9394A2BB3 ft=1 fh=e8afad4b2710a4e7 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF19.dll"

sh=C48595832D4C5F752221FB43E8C932D73CA3B25C ft=1 fh=b480f2184146c7aa vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF2.dll"

sh=6F155D9B8F02D2564EF9F11CB2FC3103BE770961 ft=1 fh=53cfaa77f947b6e8 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF20.dll"

sh=271D357076B140BA2776A7ECFB98DA571F5C795E ft=1 fh=556fc319c092de63 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF21.dll"

sh=F095F1E05C656DFF28391314FE07EB8ABE9135C1 ft=1 fh=efdfe8f476f7dfef vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF22.dll"

sh=63A5C86CD7B70EE52A0500FB15B20F4B07FE3155 ft=1 fh=55f9169c02995c4f vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF23.dll"

sh=8F96D71875968D4E96F01B4CBE07807B926ADE66 ft=1 fh=e292929293eb0a94 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF24.dll"

sh=8E48EB9B7057AB187F1FE0F120DE5E6EAB11EEA7 ft=1 fh=defe261f71c5e3cb vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF25.dll"

sh=7CE9D5E22CF669C9230151302A4DD53830B9147F ft=1 fh=45471bffe955816e vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF26.dll"

sh=CFF8A496E01A3F7361B88DE4517F2F0CA74DCA89 ft=1 fh=485eef6651d59c21 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF27.dll"

sh=F85D6D941991F071BD21B2F4BB5FA9CB195E34F3 ft=1 fh=496b2cef6133123a vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF4.dll"

sh=1F6F912798ED6CC9EFFF2009AE82A49EC041B2E4 ft=1 fh=a0d1b00011c13d03 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF5.dll"

sh=9841E83FC51F3DC5F54CF5D4894BBB3A92E2C3F2 ft=1 fh=a94d202a69b5b1a6 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF6.dll"

sh=85BF37E32CCFAD64258E389F7C72D8BC6692D523 ft=1 fh=c5b049e498eb0510 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF7.dll"

sh=2F7545E836BF1296B8D75EC7624530B2DAF0A0CD ft=1 fh=d1072900f2a545cc vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF8.dll"

sh=BDBCB3BA6E7BF685F177516025B0CD4ED1ECE1AA ft=1 fh=f4a872a87ce1f627 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\Extensions\{6956504D-75A8-72DE-87D0-12E0248906E1}\components\DatamngrHlpFF9.dll"

sh=4EFB42475580C267B899F38299058C94901B03C6 ft=0 fh=0000000000000000 vn="JS/Kryptik.I Trojaner" ac=I fn="C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009"

sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll"

sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll"

sh=0460B794834ED78BE69BA5EB9C0E6211EBEAD9B6 ft=1 fh=0f8145e534b0e78b vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\ldrtbDVDV.dll"

sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll"

Log von MBAM bitte richtig posten

Im letzten Suchlauf vom 02.11.14 steht nichts aber ich poste den vorletzten vom 31.10.14.

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 31.10.2014

Suchlauf-Zeit: 12:10:45

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.3.1025

Malware Datenbank: v2014.09.19.05

Rootkit Datenbank: v2014.10.22.01

Lizenz: Testversion

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: acer
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 341617

Verstrichene Zeit: 27 Min, 34 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente erkannt)
 

Module: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsschlüssel: 19

Adware.GamePlayLab, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

Adware.GamePlayLab, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110011221158}, , [dba6d41b7209d16532d0d8c69e6442be], 

PUP.Optional.Wajam.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, , [afd29f50fd7e36007c5b701f53af32ce], 

PUP.Optional.Wajam.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, , [afd29f50fd7e36007c5b701f53af32ce], 

PUP.Optional.Yontoo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, , [2e5318d797e411259b8e0d7dad558b75], 

PUP.Optional.Yontoo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, , [2e5318d797e411259b8e0d7dad558b75], 

PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Deal Keeper, , [166b32bd4f2cc5719dc07d93ee15a957], 

PUP.Optional.DealKeeper.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util Deal Keeper, , [9fe25c934c2f74c2d18d9d736f946c94], 

PUP.Optional.IWantThis.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\I Want This, , [740d06e9bbc0d75f939d65c3fb08758b], 

PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\koyotesoftmoviestoolbarha, , [0f721dd2cbb0cd69e480c1789b68748c], 

PUP.Optional.FastStart.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, , [8af7717ef388c571655550b58e7555ab], 

PUP.Optional.DealPly.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdejapggenmdmafpmbipje, , [cbb6ec033f3c75c1a95e2df1fe05f50b], 

PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{e5d4f4fd-a039-4670-8354-633c30a5f54e}, , [8bf64ea17efdc076c5cd90794eb7b050], 

PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 

PUP.Optional.MoviesToolBar.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 

PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E5D4F4FD-A039-4670-8354-633C30A5F54E}, , [8bf64ea17efdc076c5cd90794eb7b050], 
 

Registrierungswerte: 2

PUP.Optional.FastStart.A, HKU\S-1-5-21-3090159671-3938598571-1968455546-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, , [8af7717ef388c571655550b58e7555ab]

PUP.Optional.MoviesToolBar.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{E5D4F4FD-A039-4670-8354-633C30A5F54E}, Movies Toolbar (Dist. by Koyote-Lab, Inc.), , [8bf64ea17efdc076c5cd90794eb7b050]
 

Registrierungsdaten: 0

(Keine schädliche Elemente erkannt)
 

Ordner: 6

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha, , [176a42ad007b03331c614a9c42c040c0], 

PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC, , [176a42ad007b03331c614a9c42c040c0], 
 

Dateien: 54

PUP.Optional.Koyote.A, C:\Program Files (x86)\Free Easy CD DVD Burner\Uninstall.exe, , [b8c95b946a1173c3851867e9be43a957], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsaBB1C.exe, , [3a477a75eb905adcab480d2c61a06f91], 

PUP.Optional.Iminent.A, C:\Users\acer\AppData\Local\Temp\IminentSetup.exe, , [2d541ad5403ba393fb3af34b28d918e8], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nskC1C1.exe, , [275ac42bfe7d9b9bec0773c6e918fe02], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsp1A96.exe, , [b9c83eb1eb90b383b83b66d37c859d63], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsp1E3F.exe, , [71108b6448337abc579c56e326db53ad], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsq6C41.exe, , [b8c98c63d4a7d66040b3be7bb9485ba5], 

PUP.Optional.SearchProtect.A, C:\Users\acer\AppData\Local\Temp\nsv16BF.exe, , [176a727d95e637ff757e50e916eb24dc], 

Adware.Korad, C:\Users\acer\AppData\Local\Temp\nspBA9A.tmp\basicstarter.exe, , [621fc52a522948eefe7748f8b34e629e], 

PUP.Optional.OpenCandy, C:\Users\acer\AppData\Local\Temp\is-SLOM1.tmp\OCSetupHlp.dll, , [7f026c83fd7e38fe79aaef3cd43109f7], 

PUP.Optional.Dealply, C:\Users\acer\AppData\Local\Temp\is1590112554\dealply.exe, , [1170cf204239112566915bcf4eb735cb], 

PUP.Optional.IWantThis.A, C:\Users\acer\AppData\Local\Temp\is1590112554\IWantThis_ROW.exe, , [9ee36d82d8a3dd59d60ec3d2ea17926e], 

PUP.Optional.Babylon.A, C:\Users\acer\AppData\Local\Temp\is1590112554\MyBabylonTB.exe, , [1f62a7485e1d3204797e5ec0b44c13ed], 

PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Temp\is1590112554\Wajam.exe, , [364b935c245793a339f0440341bfb947], 

PUP.Optional.MoviesToolbar.A, C:\Windows\Temp\e942428e\SetupDataMngr_Koyote.exe, , [621fc9265922da5c4bf48e9aa55ce917], 

PUP.Optional.SweetPacks.A, C:\Users\acer\AppData\Local\Temp\BundleSweetIMSetup.exe, , [e49d836ca9d2df577a7ce82821e241bf], 

PUP.Optional.Delta.A, C:\Users\acer\AppData\Local\Temp\DeltaTB.exe, , [a2dfe00f562561d5b641f11f2ad904fc], 

PUP.Optional.Babylon.A, C:\Users\acer\AppData\Local\Temp\MybabylonTB.exe, , [4f3208e790eb62d44eaaf51bf50e738d], 

PUP.Optional.FunMoods.A, C:\Windows\System32\Tasks\Funmoods Chat, , [a2df618e4d2edf57b57ca3713ac9e51b], 

PUP.Optional.FunMoods.A, C:\Windows\Tasks\Funmoods Chat.job, , [5031df108eed3afcbc76e52fb74c17e9], 

PUP.Optional.Superfish.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [b2cf08e793e83ef87238ee320af9d22e], 

PUP.Optional.Superfish.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, , [1170a14e5625bc7a3971e7397a8901ff], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0.localstorage-journal, , [f68baf40f883ab8b63c7df495ba8f808], 

PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jpmbfleldcgkldadpdinhjjopdfpjfjp_0.localstorage, , [e79ad11e39422a0ca74481a98281a759], 

PUP.Optional.Wajam.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_jpmbfleldcgkldadpdinhjjopdfpjfjp_0.localstorage-journal, , [96ebe30c552662d4d81337f31ce749b7], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Local\funmoods_2.3.1.crx, , [bcc5c72886f57fb7d567dd8e9b69639d], 

PUP.Optional.Funmoods.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage-journal, , [38496c836f0c1422a239b2b908fc8878], 

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\CT3202918.txt, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\initData.json, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.Conduit.A, C:\Users\acer\AppData\Local\Temp\CT3202918\manifest.json, , [94ed25ca067566d0a4aaa92d21e17c84], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\apnuserid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\appid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\geodata.xml, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\setupCfg.xml, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\sysid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.MoviesToolBar.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\koyotesoftmoviestoolbarha\trackid.dat, , [730e5e91ea915dd992effbe015edb34d], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\config.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\info.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\src.dat, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\STTL.DAT, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.FunMoods.A, C:\Users\acer\AppData\Roaming\FunmoodsChat\UpdateProc\TTL.DAT, , [0b76ae41abd0ce68db3827b611f1cd33], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001887.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001898.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001903.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001918.ldb, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\001919.log, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\CURRENT, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOCK, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOG, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\LOG.old, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.CrossRider.A, C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mpfapcdfbbledbojijcbcclmlieaoogk\MANIFEST-001917, , [532edf10c3b831056f79776756acb848], 

PUP.Optional.MoviesToolbar.A, C:\Users\acer\AppData\Local\koyotesoftmoviestoolbarha\GC\toolbar.crx, , [176a42ad007b03331c614a9c42c040c0], 

PUP.Optional.SweetPage.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "hxxp://www.sweet-page.com/newtab/?type=nt&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB");), ,[0a7719d61b6085b134c048f160a56997]

PUP.Optional.SweetPage.A, C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\mo5qape1.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.sweet-page.com/?type=hp&ts=1411906429&from=cor&uid=TOSHIBAXMQ01ABD032_91HFB6QYBXX91HFB6QYB");), ,[88f988673a4174c2fafb58e1ab5a6f91]
 

Physische Sektoren: 0

(Keine schädliche Elemente erkannt)
 
 

(end)

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009

C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB

EmptyTemp:

Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-11-2014

Ran by acer at 2014-11-02 21:45:07 Run:2

Running from C:\Users\acer\Desktop

Loaded Profile: acer (Available profiles: acer)

Boot Mode: Normal

==============================================
 

Content of fixlist:

*****************

C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009

C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB

EmptyTemp:

Hosts:

*****************
 

C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009 => Moved successfully.

"C:\Windows\System32\config\systemprofile\AppData\LocalLow\DVDVideoSoftTB" => File/Directory not found.

"C:\Windows\System32\Drivers\etc\hosts" => Could not move.

Could not reset Hosts.

EmptyTemp: => Removed 23.9 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog ====

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Ich habe immer noch Werbung und Wörter sind auch unterstrichen.
Kann noch nicht feststellen ob es besser geworden ist oder nicht, aber ganz sind die nicht verschwunden.
Was sind eig. Cookies?
Und kann es sein das ich den js/kryptik.I Trojan eingefangen hab?

Dann musst du schonmal mitteilen in welchen Browsern du das Problem noch hast. Bei hartnäckiger Junkware hilft oft nur ein Zurücksetzen des Browserprofils.

Zitat:

Und kann es sein das ich den js/kryptik.I Trojan eingefangen hab?

Wer sagt das, wie bitte kommst du dadrauf?

Also ich nutze meistens nur Chrome.

Und das wegen Trojan merkte ich beim Scannen mit Eset.
Unter "Aktuelles Prüfergebnis" habe ich js/kryptik.I Trojan in roter Farbe gelesen.

Zitat:

Also ich nutze meistens nur Chrome.

Browser zurücksetzen müsste helfen

Zitat:

Unter "Aktuelles Prüfergebnis" habe ich js/kryptik.I Trojan in roter Farbe gelesen.

Schau mal in den letzen FRST Fix. Das was ESET gefunden hat, wurde mti FRST weggfixt.

Werden nach dem zurücksetzen auch alle Lesezeichen gelöscht?

Im Fixlog hab ich nichts gefunden und in der FRST.txt auch nichts.

Browser zurücksetzen hat geholfen, die ganze Werbung ist verschwunden =)))
Ich bedanke mich:applaus:

Dann wären wir durch! :daumenhoc

Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Es empfiehlt sich Malwarebytes Anti-Malware zu behalten und damit wöchentlich nach Malware zu scannen.

Helfen kann dir dabei delfix:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.