Firefox keine Rückmeldung | Infizierter Registrierungswert \CurrentVersion\Policies\Explorer\Run|10639

# AdwCleaner v2.303 - Datei am 21/06/2013 um 15:24:21 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzer : Dragonwhisper - SKYNET
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Dragonwhisper\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : Yontoo Desktop Updater

***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeRIP
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Ordner Gelöscht : C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\jetpack
Ordner Gelöscht : C:\Users\Dragonwhisper\AppData\Roaming\Yontoo

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\IGearSettings
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\Software\SoftwareUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v19.0.2 (de)

Datei : C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\prefs.js

C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\user.js ... Gelöscht !

Gelöscht : user_pref("extentions.y2layers.defaultEnableAppsList", "DropDownDeals,buzzdock,YontooNewOffers");
Gelöscht : user_pref("extentions.y2layers.installId", "c8602b31-428b-4719-aa94-697a9ce5783c");

-\\ Google Chrome v27.0.1453.116

Datei : C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [4982 octets] - [21/06/2013 15:24:21]

########## EOF - C:\AdwCleaner[S1].txt - [5042 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Ultimate x64
Ran by Dragonwhisper on 21.06.2013 at 15:33:55,62
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [File] "C:\Users\Dragonwhisper\AppData\Roaming\mozilla\firefox\profiles\xgrcqwtn.default\extensions\jid0-3w5IeNyk2A0kYZWgtBwRAxwtyTo@jetpack.xpi" 
Successfully deleted the following from C:\Users\Dragonwhisper\AppData\Roaming\mozilla\firefox\profiles\xgrcqwtn.default\prefs.js

user_pref("extensions.jid0-3w5IeNyk2A0kYZWgtBwRAxwtyTo@jetpack.install-event-fired", true);
user_pref("extensions.jid0-CGv3ZTbYWQ2h7wvPaFfi7QXoCu8@jetpack.install-event-fired", true);
user_pref("extensions.jid0-LpboU7P2HKPJHjBni6nQJEpzaAI@jetpack.install-event-fired", true);
user_pref("extensions.jid0-OJczISDnLvcSqtzcbF8q5kQrP5o@jetpack.install-event-fired", true);
user_pref("extensions.jid1-CGrc5dzo0BPqQw@jetpack.install-event-fired", true);
user_pref("extensions.jid1-uabu5A9hduqzCw@jetpack.install-event-fired", true);
Emptied folder: C:\Users\Dragonwhisper\AppData\Roaming\mozilla\firefox\profiles\xgrcqwtn.default\minidumps [175 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.06.2013 at 15:44:42,90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-06-2013
Ran by Dragonwhisper (administrator) on 21-06-2013 15:45:55
Running from C:\Users\Dragonwhisper\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

() C:\Windows\system32\DTS.exe
(Lenovo.) C:\Windows\system32\ibmpmsvc.exe
(AuthenTec, Inc.) C:\Windows\system32\ATService.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG10\avgtray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
() C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
() C:\Program Files (x86)\Mobile Broadband Drivers\WMCore\mini_WMCore.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Zoom\TpScrex.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\AMT\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [FingerPrintSoftware] "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s [1582920 2011-05-31] (AuthenTec)
HKLM\...\Run: [TpShocks] TpShocks.exe [382248 2013-02-12] (Lenovo.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-17] (Synaptics Incorporated)
Winlogon\Notify\ATFUS: 
HKCU\...\Run: [EVEREST AutoStart] C:\Program Files (x86)\EVEREST Ultimate Edition\everest_start.exe [334928 2009-05-25] ()
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe [2345592 2012-08-01] (AVG Technologies CZ, s.r.o.)
SSODL-x32: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - C:\Program Files (x86)\Stardock\Object Desktop\IconPackager\iprepair.dll (Stardock.net, Inc)
BootExecute: autocheck autochk * C:\PROGRA~2\AVG\AVG10\avgchsva.exe /syncC:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgppa.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Wörterbuch Deutsch (de-DE), Hunspell-unterstützt - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\de_DE@dicts.j3e.de
FF Extension: Facebook Translate - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\facebook-translate@oliver.schloebe.de
FF Extension: Facefont - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\facefont@mc.com
FF Extension: LastPass - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\support@lastpass.com
FF Extension: FireShot - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
FF Extension: Facebook Toolbar Button - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{72c9fdff-bccd-4fac-a08e-857103c6e721}
FF Extension: DownloadHelper - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Facebook Share Button - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{d4e0dc9c-c356-438e-afbe-dca439f4399d}
FF Extension: facebooktapuzemoticons - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\facebooktapuzemoticons@evyatar.amitay.me.xpi
FF Extension: fbChatNotifier - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\fbChatNotifier@davidebuldrini.com.xpi
FF Extension: fbdislike - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\fbdislike@doweb.fr.xpi
FF Extension: firebug - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: firefox - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\firefox@facebook.com.xpi
FF Extension: hidefbticker - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\hidefbticker@shebo.com.xpi
FF Extension: hoverst - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\hoverst@facebook.com.xpi
FF Extension: https-facebook - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\https-facebook@niyaz.pk.xpi
FF Extension: ikuteteam - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\ikuteteam@gmail.com.xpi
FF Extension: mingapps28 - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\mingapps28@gmail.com.xpi
FF Extension: translator - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\translator@dontfollowme.net.xpi
FF Extension: translator - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\translator@zoli.bod.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{288479BE-1B9E-11E2-80EA-F3246188709B}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{45e16761-660c-41a4-984f-56986fba2137}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{8935f540-b136-11e0-a00b-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{af3ad7cf-6303-42d3-bd23-74e0838b9d2d}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Dragonwhisper\AppData\Roaming\Mozilla\Firefox\Profiles\xgrcqwtn.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi

Chrome: 
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (AVG Internet Security) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\10.0.0.1409_0\plugins/avgnpss.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Extension: (Docs) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Adblock Plus) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.4.1_0
CHR Extension: (Google Search) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Stylish) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\1.1_0
CHR Extension: (FlashBlock) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\gofhjkjmkpinhpoiabjplobcaignabnl\0.9.31_0
CHR Extension: (Giant Translator) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\jabomenogfoilanojpoolflokcjfegld\1.0.2_0
CHR Extension: (Facebook AdBlock) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfpacabphcagfehdgnigmfnbjdampbaa\1.0.9_0
CHR Extension: (My Facebook Colors) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\moeajaekjdlphfakimpkagaabjoaohpc\1.0.9_0
CHR Extension: (Gmail) - C:\Users\Dragonwhisper\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

S3 ADMonitor; C:\Windows\system32\ADMonitor.exe [130048 2011-05-31] ()
R2 ATService; C:\Windows\system32\ATService.exe [2715976 2011-05-31] (AuthenTec, Inc.)
R2 avgfws; C:\Program Files (x86)\AVG\AVG10\avgfws.exe [2708024 2011-03-09] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [7391072 2012-01-31] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [269520 2011-02-08] (AVG Technologies CZ, s.r.o.)
S2 AxAutoMntSrv; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2013-04-23] (Lenovo.)
R2 dtsvc; C:\Windows\system32\DTS.exe [117760 2011-05-31] ()
R2 LMS; C:\Program Files (x86)\Intel\AMT\LMS.exe [174616 2010-02-04] (Intel Corporation)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-04-11] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143552 2012-04-05] (TuneUp Software)
R2 UNS; C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2058776 2010-02-04] (Intel Corporation)
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband Drivers\WMCore\mini_WMCore.exe [438272 2009-10-09] ()

==================== Drivers (Whitelisted) ====================

R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57696 2010-07-12] (AVG Technologies CZ, s.r.o.)
R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [118864 2011-05-27] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [26704 2011-02-22] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [29264 2011-02-10] (AVG Technologies CZ, s.r.o. )
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [312160 2012-11-12] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [41552 2011-03-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [37456 2011-03-16] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [377936 2011-04-05] (AVG Technologies CZ, s.r.o.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2013-02-23] (DT Soft Ltd)
R3 e36gbus; C:\Windows\System32\DRIVERS\e36gbus.sys [328704 2009-06-30] (MCCI Corporation)
R3 e36gmdfl; C:\Windows\System32\DRIVERS\e36gmdfl.sys [19456 2009-06-30] (MCCI Corporation)
R3 e36gmdm; C:\Windows\System32\DRIVERS\e36gmdm.sys [432128 2009-06-30] (MCCI Corporation)
R3 e36gmgmt; C:\Windows\System32\DRIVERS\e36gmgmt.sys [376320 2009-06-30] (MCCI Corporation)
R3 e36wgps; C:\Windows\System32\DRIVERS\e36wgps64.sys [96296 2009-07-10] (Ericsson AB)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [12800 2009-09-22] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [17408 2009-09-22] (Ericsson AB)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [44784 2013-04-17] (Synaptics Incorporated)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2013-03-29] (Duplex Secure Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-03-29] (TuneUp Software)
R2 WinRing0_1_2_0; C:\Program Files\Windows Sidebar\Gadgets\IntelCoreSeries.gadget\WinRing0x64.sys [14544 2008-07-27] (OpenLibSys.org)
R3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [259624 2009-10-13] (Ericsson AB)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U4 SR; 
S3 VGPU; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-21 15:44 - 2013-06-21 15:44 - 00001605 ____A C:\Users\Dragonwhisper\Desktop\JRT.txt
2013-06-21 15:33 - 2013-06-21 15:33 - 00000000 ____D C:\Windows\ERUNT
2013-06-21 15:33 - 2013-06-21 15:33 - 00000000 ____D C:\JRT
2013-06-21 15:24 - 2013-06-21 15:25 - 00005093 ____A C:\AdwCleaner[S1].txt
2013-06-21 15:19 - 2013-06-21 15:20 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Dragonwhisper\Desktop\JRT.exe
2013-06-21 15:16 - 2013-06-21 15:18 - 00648201 ____A C:\Users\Dragonwhisper\Desktop\adwcleaner.exe
2013-06-20 19:34 - 2013-06-20 19:34 - 00033473 ____A C:\Users\Dragonwhisper\Desktop\ComboFix.txt
2013-06-20 19:33 - 2013-06-20 19:33 - 00033473 ____A C:\ComboFix.txt
2013-06-20 16:19 - 2013-06-20 19:33 - 00000000 ____D C:\Qoobox
2013-06-20 16:19 - 2013-06-20 19:32 - 00000000 ____D C:\Windows\erdnt
2013-06-20 16:19 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-20 16:19 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-20 16:19 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-20 16:19 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-20 16:19 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-20 16:19 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-20 16:19 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-20 16:19 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-20 16:05 - 2013-06-20 16:17 - 05081444 ____R (Swearware) C:\Users\Dragonwhisper\Desktop\ComboFix.exe
2013-06-20 12:44 - 2013-06-20 12:44 - 00026463 ____A C:\Users\Dragonwhisper\Desktop\Addition.txt
2013-06-20 12:42 - 2013-06-20 12:42 - 00000000 ____D C:\FRST
2013-06-20 12:35 - 2013-06-20 12:40 - 01929572 ____A (Farbar) C:\Users\Dragonwhisper\Desktop\FRST64.exe
2013-06-20 02:35 - 2013-06-20 21:48 - 00000000 ____D C:\Program Files (x86)\ MALWAREBYTES ANTI-MALWARE 
2013-06-19 23:57 - 2013-06-19 23:57 - 00279544 ____A C:\Windows\Minidump\061913-33821-01.dmp
2013-06-19 23:57 - 2013-06-19 23:57 - 00000000 ____D C:\Windows\Minidump
2013-06-19 23:52 - 2013-06-20 00:11 - 00000000 ____D C:\Users\Dragonwhisper\trojaner-board
2013-06-19 22:42 - 2013-06-19 22:42 - 00018280 ____A C:\Users\Dragonwhisper\Desktop\GMER.Txt
2013-06-19 22:19 - 2013-06-19 22:19 - 00000598 ____A C:\Users\Dragonwhisper\Downloads\defogger_disable.log
2013-06-19 22:19 - 2013-06-19 22:19 - 00000020 ____A C:\Users\Dragonwhisper\defogger_reenable
2013-06-19 22:03 - 2013-06-19 22:03 - 00050477 ____A C:\Users\Dragonwhisper\Downloads\Defogger.exe
2013-06-19 21:39 - 2013-06-19 21:39 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\Malwarebytes
2013-06-19 21:38 - 2013-06-20 02:45 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-19 21:38 - 2013-06-19 21:38 - 00001115 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-19 21:38 - 2013-06-19 21:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-06-19 21:38 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-19 20:31 - 2013-06-19 21:10 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Dragonwhisper\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-19 19:05 - 2013-06-19 19:05 - 00267938 ____A C:\Users\Dragonwhisper\Desktop\OTL.Txt
2013-06-19 19:05 - 2013-06-19 19:05 - 00060308 ____A C:\Users\Dragonwhisper\Desktop\Extras.Txt
2013-06-19 18:56 - 2013-06-19 18:56 - 00011654 ____A C:\Users\Dragonwhisper\Downloads\hijackthis.log
2013-06-19 18:48 - 2013-06-19 18:49 - 00602112 ____A (OldTimer Tools) C:\Users\Dragonwhisper\Desktop\OTL.exe
2013-06-19 18:47 - 2013-06-19 18:48 - 00388608 ____A (Trend Micro Inc.) C:\Users\Dragonwhisper\Downloads\HijackThis.exe
2013-06-19 16:38 - 2013-06-21 15:29 - 00002636 ____A C:\Windows\setupact.log
2013-06-19 16:38 - 2013-06-20 19:27 - 00005454 ____A C:\Windows\PFRO.log
2013-06-19 16:38 - 2013-06-19 16:38 - 00000000 ____A C:\Windows\setuperr.log
2013-06-19 03:20 - 2013-05-17 05:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-19 03:20 - 2013-05-17 05:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-19 03:20 - 2013-05-17 05:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-19 03:20 - 2013-05-17 05:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-19 03:20 - 2013-05-17 05:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-19 03:20 - 2013-05-17 04:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-19 03:20 - 2013-05-17 04:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-19 03:20 - 2013-05-17 04:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-19 03:20 - 2013-05-17 04:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-19 03:20 - 2013-05-17 04:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-19 03:20 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-19 03:20 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-19 03:20 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-19 03:20 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-19 03:20 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-19 03:20 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-19 03:20 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-19 03:20 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-19 03:20 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-19 03:20 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-19 03:19 - 2013-05-17 06:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-19 03:19 - 2013-05-17 05:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-19 03:19 - 2013-05-17 04:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-19 03:19 - 2013-05-17 04:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-19 03:19 - 2013-05-17 04:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-19 03:19 - 2013-05-17 04:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-19 03:19 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-19 03:19 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-19 03:19 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-19 03:19 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-19 03:19 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-19 03:19 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-19 01:30 - 2013-06-19 01:30 - 00011662 ____A C:\Users\Dragonwhisper\Documents\cc_20130619_013007.reg
2013-06-19 01:23 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-19 01:23 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-19 01:21 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-19 01:21 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-19 01:21 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-19 01:21 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-19 01:21 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-19 01:21 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-19 01:21 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-19 01:21 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-19 01:21 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-19 01:21 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-19 01:21 - 2013-02-15 08:08 - 00044032 ____A (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2013-06-19 01:21 - 2013-02-15 08:06 - 03717632 ____A (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2013-06-19 01:21 - 2013-02-15 08:02 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\aaclient.dll
2013-06-19 01:21 - 2013-02-15 06:37 - 03217408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-06-19 01:21 - 2013-02-15 06:34 - 00131584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-06-19 01:21 - 2013-02-15 05:25 - 00036864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-06-19 01:00 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-19 01:00 - 2013-04-10 08:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-06-19 01:00 - 2013-04-10 08:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-06-19 01:00 - 2011-02-03 13:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-06-19 00:58 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-19 00:58 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-19 00:58 - 2013-04-12 16:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2013-06-19 00:53 - 2013-03-19 07:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-06-19 00:53 - 2013-03-19 07:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-06-18 19:37 - 2011-03-03 20:06 - 00000959 ____A C:\users\userChrome.css
2013-06-18 04:43 - 2013-06-21 15:29 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-18 04:43 - 2013-06-21 15:10 - 00001124 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-17 20:22 - 2013-06-17 20:22 - 00000000 ____D C:\Users\Dragonwhisper\Downloads\FirefoxPortable
2013-06-17 20:21 - 2013-06-17 20:21 - 00000000 ____D C:\Users\Dragonwhisper\FirefoxPortable
2013-06-17 12:44 - 2013-06-17 14:13 - 23173536 ____A (PortableApps.com) C:\Users\Dragonwhisper\Downloads\FirefoxPortable_21.0_German.paf.exe
2013-06-16 20:30 - 2013-06-16 20:36 - 04167680 ____A C:\Program Files (x86)\GUT32C8.tmp
2013-06-16 20:30 - 2013-06-16 20:30 - 00000000 ____D C:\Program Files (x86)\GUM32C7.tmp
2013-06-16 02:17 - 2009-12-19 11:18 - 02395648 ____A (AD © 2009) C:\Windows\SysWOW64\SYNSOEMU.DLL
2013-06-16 02:16 - 2013-06-16 02:16 - 00001065 ____A C:\Users\Public\Desktop\WaveLab 6.lnk
2013-06-16 02:15 - 2013-06-16 02:15 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-06-15 03:01 - 2013-06-18 06:16 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-07 15:06 - 2013-03-19 08:04 - 05550424 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-07 15:06 - 2013-03-19 07:46 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2013-06-07 15:06 - 2013-03-19 07:04 - 03968856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-06-07 15:06 - 2013-03-19 07:04 - 03913560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-06-07 15:06 - 2013-03-19 06:47 - 00006656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-06-07 15:06 - 2013-03-19 05:06 - 00112640 ____A (Microsoft Corporation) C:\Windows\System32\smss.exe
2013-06-07 14:59 - 2013-01-24 08:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys
2013-06-07 14:57 - 2013-04-10 05:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-06-07 14:49 - 2013-02-27 08:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-06-07 14:49 - 2013-02-27 07:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-06-07 14:49 - 2013-02-27 07:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-06-07 14:49 - 2013-02-27 07:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-06-07 14:49 - 2013-02-27 07:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
2013-06-07 14:49 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-06-07 14:49 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-06-07 14:49 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-06-06 12:17 - 2013-06-18 06:17 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Local\Google
2013-06-02 09:49 - 2013-06-02 09:49 - 00000000 ____D C:\Program Files (x86)\ThinkVantage
2013-06-02 09:48 - 2013-06-02 09:48 - 00000000 ____D C:\Program Files\Common Files\Lenovo
2013-06-02 09:47 - 2013-04-17 22:16 - 01048816 ____A (Synaptics Incorporated) C:\Windows\System32\SynCOM.dll
2013-06-02 09:47 - 2013-04-17 22:16 - 00540400 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2013-06-02 09:47 - 2013-04-17 22:16 - 00460528 ____A (Synaptics Incorporated) C:\Windows\System32\Drivers\SynTP.sys
2013-06-02 09:47 - 2013-04-17 22:16 - 00229616 ____A (Synaptics Incorporated) C:\Windows\System32\SynTPAPI.dll
2013-06-02 09:47 - 2013-04-17 22:16 - 00178416 ____A (Synaptics Incorporated) C:\Windows\System32\SynTPCo14.dll
2013-06-02 09:47 - 2013-04-17 22:16 - 00114416 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2013-06-02 09:47 - 2013-04-17 22:16 - 00044784 ____A (Synaptics Incorporated) C:\Windows\System32\Drivers\Smb_driver_Intel.sys
2013-06-01 12:50 - 2013-06-01 12:53 - 00000132 ____A C:\Users\Dragonwhisper\AppData\Roaming\Adobe BMP Format CS5 Prefs
2013-05-23 10:36 - 2013-05-23 10:36 - 00000000 ____D C:\$AVG
2013-05-22 13:42 - 2013-05-22 13:42 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf

==================== One Month Modified Files and Folders =======

2013-06-21 15:44 - 2013-06-21 15:44 - 00001605 ____A C:\Users\Dragonwhisper\Desktop\JRT.txt
2013-06-21 15:38 - 2009-07-14 06:45 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-21 15:38 - 2009-07-14 06:45 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-21 15:34 - 2013-02-23 13:05 - 01749804 ____A C:\Windows\WindowsUpdate.log
2013-06-21 15:33 - 2013-06-21 15:33 - 00000000 ____D C:\Windows\ERUNT
2013-06-21 15:33 - 2013-06-21 15:33 - 00000000 ____D C:\JRT
2013-06-21 15:30 - 2013-02-26 01:13 - 00000061 ____A C:\Windows\SysWOW64\everest_cpl.ini
2013-06-21 15:29 - 2013-06-19 16:38 - 00002636 ____A C:\Windows\setupact.log
2013-06-21 15:29 - 2013-06-18 04:43 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-21 15:29 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-21 15:25 - 2013-06-21 15:24 - 00005093 ____A C:\AdwCleaner[S1].txt
2013-06-21 15:20 - 2013-06-21 15:19 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Dragonwhisper\Desktop\JRT.exe
2013-06-21 15:18 - 2013-06-21 15:16 - 00648201 ____A C:\Users\Dragonwhisper\Desktop\adwcleaner.exe
2013-06-21 15:15 - 2013-03-13 20:29 - 00000000 ____D C:\Windows\System32\Drivers\AVG
2013-06-21 15:10 - 2013-06-18 04:43 - 00001124 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-20 21:48 - 2013-06-20 02:35 - 00000000 ____D C:\Program Files (x86)\ MALWAREBYTES ANTI-MALWARE 
2013-06-20 19:34 - 2013-06-20 19:34 - 00033473 ____A C:\Users\Dragonwhisper\Desktop\ComboFix.txt
2013-06-20 19:33 - 2013-06-20 19:33 - 00033473 ____A C:\ComboFix.txt
2013-06-20 19:33 - 2013-06-20 16:19 - 00000000 ____D C:\Qoobox
2013-06-20 19:32 - 2013-06-20 16:19 - 00000000 ____D C:\Windows\erdnt
2013-06-20 19:30 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-06-20 19:27 - 2013-06-19 16:38 - 00005454 ____A C:\Windows\PFRO.log
2013-06-20 19:26 - 2009-07-14 04:34 - 64225280 ____A C:\Windows\System32\config\software.bak
2013-06-20 19:26 - 2009-07-14 04:34 - 16515072 ____A C:\Windows\System32\config\system.bak
2013-06-20 19:26 - 2009-07-14 04:34 - 00503808 ____A C:\Windows\System32\config\default.bak
2013-06-20 19:26 - 2009-07-14 04:34 - 00065536 ____A C:\Windows\System32\config\sam.bak
2013-06-20 19:26 - 2009-07-14 04:34 - 00028672 ____A C:\Windows\System32\config\security.bak
2013-06-20 19:25 - 2013-02-23 13:31 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-20 16:48 - 2013-02-24 12:39 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\vlc
2013-06-20 16:17 - 2013-06-20 16:05 - 05081444 ____R (Swearware) C:\Users\Dragonwhisper\Desktop\ComboFix.exe
2013-06-20 13:24 - 2013-03-22 23:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-20 12:44 - 2013-06-20 12:44 - 00026463 ____A C:\Users\Dragonwhisper\Desktop\Addition.txt
2013-06-20 12:42 - 2013-06-20 12:42 - 00000000 ____D C:\FRST
2013-06-20 12:40 - 2013-06-20 12:35 - 01929572 ____A (Farbar) C:\Users\Dragonwhisper\Desktop\FRST64.exe
2013-06-20 03:32 - 2013-03-13 05:10 - 00000193 ____A C:\Windows\WORDPAD.INI
2013-06-20 03:12 - 2010-11-21 08:50 - 07913216 ____A C:\Windows\System32\perfh007.dat
2013-06-20 03:12 - 2010-11-21 08:50 - 02457152 ____A C:\Windows\System32\perfc007.dat
2013-06-20 03:12 - 2009-07-14 07:13 - 00006208 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-20 02:45 - 2013-06-19 21:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-20 00:11 - 2013-06-19 23:52 - 00000000 ____D C:\Users\Dragonwhisper\trojaner-board
2013-06-19 23:57 - 2013-06-19 23:57 - 00279544 ____A C:\Windows\Minidump\061913-33821-01.dmp
2013-06-19 23:57 - 2013-06-19 23:57 - 00000000 ____D C:\Windows\Minidump
2013-06-19 23:52 - 2013-02-23 13:33 - 00000000 ____D C:\users\Dragonwhisper
2013-06-19 22:42 - 2013-06-19 22:42 - 00018280 ____A C:\Users\Dragonwhisper\Desktop\GMER.Txt
2013-06-19 22:19 - 2013-06-19 22:19 - 00000598 ____A C:\Users\Dragonwhisper\Downloads\defogger_disable.log
2013-06-19 22:19 - 2013-06-19 22:19 - 00000020 ____A C:\Users\Dragonwhisper\defogger_reenable
2013-06-19 22:03 - 2013-06-19 22:03 - 00050477 ____A C:\Users\Dragonwhisper\Downloads\Defogger.exe
2013-06-19 21:39 - 2013-06-19 21:39 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\Malwarebytes
2013-06-19 21:38 - 2013-06-19 21:38 - 00001115 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-19 21:38 - 2013-06-19 21:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-06-19 21:10 - 2013-06-19 20:31 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Dragonwhisper\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-19 20:20 - 2013-04-11 15:35 - 00001456 ____A C:\Users\Dragonwhisper\AppData\Local\Adobe Für Web speichern 12.0 Prefs
2013-06-19 19:05 - 2013-06-19 19:05 - 00267938 ____A C:\Users\Dragonwhisper\Desktop\OTL.Txt
2013-06-19 19:05 - 2013-06-19 19:05 - 00060308 ____A C:\Users\Dragonwhisper\Desktop\Extras.Txt
2013-06-19 18:56 - 2013-06-19 18:56 - 00011654 ____A C:\Users\Dragonwhisper\Downloads\hijackthis.log
2013-06-19 18:49 - 2013-06-19 18:48 - 00602112 ____A (OldTimer Tools) C:\Users\Dragonwhisper\Desktop\OTL.exe
2013-06-19 18:48 - 2013-06-19 18:47 - 00388608 ____A (Trend Micro Inc.) C:\Users\Dragonwhisper\Downloads\HijackThis.exe
2013-06-19 16:38 - 2013-06-19 16:38 - 00000000 ____A C:\Windows\setuperr.log
2013-06-19 16:36 - 2013-03-14 13:31 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\AVG
2013-06-19 16:16 - 2013-03-23 19:34 - 00000000 ___RD C:\Users\Dragonwhisper\Software
2013-06-19 14:40 - 2013-04-20 16:53 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\Winamp
2013-06-19 12:39 - 2009-07-14 04:34 - 65011712 ____A C:\Windows\System32\config\SOFTWARE_tureg_old
2013-06-19 12:39 - 2009-07-14 04:34 - 16777216 ____A C:\Windows\System32\config\SYSTEM_tureg_old
2013-06-19 12:39 - 2009-07-14 04:34 - 00262144 ____A C:\Windows\System32\config\SECURITY_tureg_old
2013-06-19 12:35 - 2009-07-14 04:34 - 00524288 ____A C:\Windows\System32\config\DEFAULT_tureg_old
2013-06-19 12:35 - 2009-07-14 04:34 - 00262144 ____A C:\Windows\System32\config\SAM_tureg_old
2013-06-19 12:12 - 2009-07-14 06:45 - 04956808 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-19 01:35 - 2013-02-23 13:22 - 00000000 ____D C:\Program Files\CCleaner
2013-06-19 01:30 - 2013-06-19 01:30 - 00011662 ____A C:\Users\Dragonwhisper\Documents\cc_20130619_013007.reg
2013-06-19 01:22 - 2013-03-06 22:06 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\Media Player Classic
2013-06-18 06:17 - 2013-06-06 12:17 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Local\Google
2013-06-18 06:16 - 2013-06-15 03:01 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-18 04:18 - 2013-02-23 15:07 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\Mozilla
2013-06-18 00:23 - 2013-04-09 19:34 - 00000000 ___RD C:\Users\Dragonwhisper\Bibliothek
2013-06-17 20:22 - 2013-06-17 20:22 - 00000000 ____D C:\Users\Dragonwhisper\Downloads\FirefoxPortable
2013-06-17 20:21 - 2013-06-17 20:21 - 00000000 ____D C:\Users\Dragonwhisper\FirefoxPortable
2013-06-17 14:13 - 2013-06-17 12:44 - 23173536 ____A (PortableApps.com) C:\Users\Dragonwhisper\Downloads\FirefoxPortable_21.0_German.paf.exe
2013-06-16 20:36 - 2013-06-16 20:30 - 04167680 ____A C:\Program Files (x86)\GUT32C8.tmp
2013-06-16 20:30 - 2013-06-16 20:30 - 00000000 ____D C:\Program Files (x86)\GUM32C7.tmp
2013-06-16 02:16 - 2013-06-16 02:16 - 00001065 ____A C:\Users\Public\Desktop\WaveLab 6.lnk
2013-06-16 02:15 - 2013-06-16 02:15 - 00000000 ____D C:\Program Files (x86)\Steinberg
2013-06-15 00:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-14 20:47 - 2013-04-17 15:59 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\Mp3tag
2013-06-06 17:36 - 2013-02-24 19:47 - 00001936 ____A C:\Users\Public\Desktop\Traktor.lnk
2013-06-06 16:08 - 2013-05-16 15:44 - 00000000 ____D C:\Users\Dragonwhisper\.dvdcss
2013-06-06 12:23 - 2013-02-24 06:26 - 00000000 ____D C:\Windows\W7SOC
2013-06-06 12:20 - 2013-05-11 16:06 - 00925184 ____A C:\Windows\expstart.exe
2013-06-05 21:40 - 2013-04-07 03:26 - 00000132 ____A C:\Users\Dragonwhisper\AppData\Roaming\Adobe PNG Format CS5 Prefs
2013-06-04 02:25 - 2013-02-23 20:25 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\Adobe
2013-06-02 17:11 - 2013-02-23 17:33 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-02 09:49 - 2013-06-02 09:49 - 00000000 ____D C:\Program Files (x86)\ThinkVantage
2013-06-02 09:48 - 2013-06-02 09:48 - 00000000 ____D C:\Program Files\Common Files\Lenovo
2013-06-02 09:46 - 2009-07-14 05:20 - 00000000 __RSD C:\Windows\Media
2013-06-02 09:44 - 2013-02-28 22:16 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-02 03:12 - 2013-02-23 20:59 - 00000000 ____D C:\Program Files (x86)\Lenovo
2013-06-02 03:04 - 2013-04-08 14:33 - 00000069 ____A C:\Windows\NeroDigital.ini
2013-06-01 12:53 - 2013-06-01 12:50 - 00000132 ____A C:\Users\Dragonwhisper\AppData\Roaming\Adobe BMP Format CS5 Prefs
2013-05-31 12:04 - 2013-02-24 09:19 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\IrfanView
2013-05-31 12:04 - 2013-02-23 15:10 - 00000000 ____D C:\Users\Dragonwhisper\AppData\Roaming\GHISLER
2013-05-31 12:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-05-31 12:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-05-23 10:36 - 2013-05-23 10:36 - 00000000 ____D C:\$AVG
2013-05-23 04:32 - 2013-02-23 13:33 - 00118680 ____A C:\Users\Dragonwhisper\AppData\Local\GDIPFONTCACHEV1.DAT
2013-05-22 13:42 - 2013-05-22 13:42 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf
2013-05-22 13:42 - 2013-03-01 00:53 - 00000000 ____D C:\ProgramData\PC Suite

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-14 11:23

==================== End Of Log ============================