GVU Trojaner, Anmeldung im abgesicherten Modus nicht möglich

Sabine99 · 06.07.2013, 15:21

Hallo Schrauber,

und hier das file:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 04-07-2013
Ran by ***** at 2013-07-06 16:13:47 Run:2
Running from C:\Users\*****\Desktop
Boot Mode: Normal

==============================================

"C:\Users\*****\AppData\Roaming\Microsoft\Windows\Templates\2433f433" => File/Directory not found.
"C:\Program Files\WhiteSmoke" => File/Directory not found.
"C:\Users\*****\AppData\Roaming\WhiteSmoke" => File/Directory not found.
"C:\Windows.old" => File/Directory not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\SearchEngineProtection => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\AOL Dialer => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{3775afd7-5921-4571-968f-85a631203d1c} => Value deleted successfully.
HKCR\CLSID\{3775afd7-5921-4571-968f-85a631203d1c} => Key deleted successfully.
CHR HomePage: hxxp://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=TJ&userid=dea475c8-3714-4b9c-9dc7-bc9f234f8bb6&searchtype=hp&installDate=22/06/2013 ==> The Chrome "Settings" can be used to fix the entry.
CHR RestoreOnStartup: "hxxp://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=TJ&userid=dea475c8-3714-4b9c-9dc7-bc9f234f8bb6&searchtype=hp&installDate=22/06/2013" ==> The Chrome "Settings" can be used to fix the entry.
NAVENG => Service deleted successfully.
NAVEX15 => Service deleted successfully.

"C:\ProgramData\Norton" directory move:

C:\ProgramData\Norton\FSDUI-2011-04-17-19h22m41s.log => Moved successfully.
C:\ProgramData\Norton\FSDUI-2011-04-17-19h29m40s.log => Moved successfully.
C:\ProgramData\Norton\FSDUI-2013-04-14-14h50m47s.log => Moved successfully.
C:\ProgramData\Norton\FSDUI-2013-04-14-14h50m50s.log => Moved successfully.
C:\ProgramData\Norton\FSDUI-2013-04-14-15h00m58s.log => Moved successfully.
C:\ProgramData\Norton\symdata.xml => Moved successfully.
C:\ProgramData\Norton\telemetry.txt => Moved successfully.
C:\ProgramData\Norton\URLS-{N360203036-SHPD-FSD33017}-S-1-5-21-1346077651-4163414706-2657881005-1000.txt => Moved successfully.
C:\ProgramData\Norton\URLS-{N360620009-SHPD-FSD25037}-0.txt => Moved successfully.
C:\ProgramData\Norton\URLS-{N360621005-SHPD-FSD25037}-0.txt => Moved successfully.
C:\ProgramData\Norton\URLS-{N360S_prod_1.6.18_5.0.2.1}-1.txt => Moved successfully.
C:\ProgramData\Norton\URLS-{NIS_prod_UPG_1.5.30_18.1.0.37}-1.txt => Moved successfully.
C:\ProgramData\Norton\{N360620009-SHPD-FSD25037}-0.dat => Moved successfully.
C:\ProgramData\Norton\{N360621005-SHPD-FSD25037}-0.dat => Moved successfully.
C:\ProgramData\Norton\{N360S_prod_1.6.18_5.0.2.1}-1.dat => Moved successfully.
C:\ProgramData\Norton\{NIS_prod_UPG_1.5.30_18.1.0.37}-1.log => Moved successfully.
C:\ProgramData\Norton\{B7B64E4E-97E8-48AA-AF62-F11B5FF9819D}\common.dat => Moved successfully.
C:\ProgramData\Norton\{B7B64E4E-97E8-48AA-AF62-F11B5FF9819D}\5449AE24CA6CB82D53A9B2BC0159B884\shared_1.0.dat => Moved successfully.
C:\ProgramData\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963}\LC.INI => Moved successfully.
C:\ProgramData\Norton\00000082\KeyHist.dat => Moved successfully.
C:\ProgramData\Norton\00000082\0000012a\key.txt => Moved successfully.
C:\ProgramData\Norton\00000082\0000012a\00000657\cltLMS1.dat => Moved successfully.
C:\ProgramData\Norton\00000082\0000012a\00000657\cltLMS2.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000123\cltupgrade.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000123\key.txt => Moved successfully.
C:\ProgramData\Norton\00000082\00000123\000005e0\cltLMS1.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000123\000005e0\cltLMS2.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000121\cltupgrade.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000121\key.txt => Moved successfully.
C:\ProgramData\Norton\00000082\00000121\000005d6\cltLMS1.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000121\000005d6\cltLMS2.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000114\key.txt => Moved successfully.
C:\ProgramData\Norton\00000082\00000114\000004e7\cltLMS1.dat => Moved successfully.
C:\ProgramData\Norton\00000082\00000114\000004e7\cltLMS2.dat => Moved successfully.
C:\ProgramData\Norton\00000082\000000fb\cltupgrade.dat => Moved successfully.
C:\ProgramData\Norton\00000082\000000fb\key.txt => Moved successfully.
C:\ProgramData\Norton\00000082\000000fb\000002bf\cltLMS1.dat => Moved successfully.
C:\ProgramData\Norton\00000082\000000fb\000002bf\cltLMS2.dat => Moved successfully.
Could not move "C:\ProgramData\Norton" directory. => Scheduled to move on reboot.


=========== Result of Scheduled Files to move ===========
"C:\ProgramData\Norton" => Directory could not move.

==== End of Fixlog ====

Was hat es eigentlich mit window.old auf sich?

Beim Neustart, kam die Meldung "Aufgabenplanungsmodul funktioniert nicht mehr"

Bis später

Sabine99

schrauber · 06.07.2013, 17:31

Kommt die immer noch? Bitte ein frisches FRST log.

Windows.old entsteht wenn Du Windows neu installierst, aber ohne zu formatieren über die alte version drüber. Oder bei nem Upgrade von Vista auf 7 oder so.
Das ist dein komplettes altes Windows. Eventuell noch mit Seuche drin, auf jeden Fall en Speicherplatz-Fresser.

Sabine99 · 06.07.2013, 17:46

Hallo Schrauber,

anbei das neue FRST.

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-07-2013
Ran by ***** (administrator) on 06-07-2013 18:41:56
Running from C:\Users\*****\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Emsisoft GmbH) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Emsisoft GmbH) C:\Program Files\Online Armor\OAcat.exe
(Emsisoft GmbH) C:\Program Files\Online Armor\oasrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Secunia) C:\Program Files\Secunia\PSI\PSIA.exe
(Buhl Data Service GmbH) C:\Program Files\Sceneo\AbsolutTV\Services\PVR\PVRService.exe
(COMPANYVERS_NAME) C:\PROGRA~1\UTILIT~2\bar\1.bin\49barsvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Lexware GmbH & Co. KG) C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe
(Cyberlink Corp.) C:\Program Files\HomeCinema\PowerDVD\PDVDServ.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ODSoft multimedia) C:\Program Files\Sceneo\AbsolutTV\Services\ODSBC\ODSBCApp.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(VER_COMPANY_NAME) C:\Program Files\UtilityChest_49\bar\1.bin\49brmon.exe
(Emsisoft GmbH) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Emsisoft GmbH) C:\Program Files\Online Armor\oaui.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Emsisoft GmbH) C:\Program Files\Online Armor\OAhlp.exe
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Hewlett-Packard Co.) C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
(Ralink Technology, Corp.) C:\Program Files\Ralink\Common\RaUI.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\Windows\system32\Taskmgr.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [UpdatePPShortCut] "C:\Program Files\HomeCinema\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\HomeCinema\PowerProducer" update "Software\CyberLink\PowerProducer\4.0" [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [Windows Defender] %programfiles%\windows defender\msascui.exe -hide [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [LexwareInfoService] c:\program files\common files\lexware\update manager\lxupdatemanager.exe /autostart [339240 2008-11-03] (Lexware GmbH & Co. KG)
HKLM\...\Run: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\nbkeyscan.exe" [1836328 2007-09-20] (Nero AG)
HKLM\...\Run: [RemoteControl] "c:\program files\homecinema\powerdvd\pdvdserv.exe" [71216 2007-02-09] (Cyberlink Corp.)
HKLM\...\Run: [TVBroadcast] c:\program files\sceneo\absoluttv\services\odsbc\odsbcapp.exe [797696 2007-08-08] (ODSoft multimedia)
HKLM\...\Run: [Ulead AutoDetector v2] c:\program files\common files\ulead systems\autodetector\monitor.exe [90112 2006-11-29] (Ulead Systems, Inc.)
HKLM\...\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [InboxAce Search Scope Monitor] "C:\PROGRA~1\INBOXA~2\bar\1.bin\1gsrchmn.exe" /m=2 /w /h [x]
HKLM\...\Run: [InboxAce_1g Browser Plugin Loader] C:\PROGRA~1\INBOXA~2\bar\1.bin\1gbrmon.exe [x]
HKLM\...\Run: [Utility Chest Search Scope Monitor] "C:\PROGRA~1\UTILIT~2\bar\1.bin\49srchmn.exe" /m=2 /w /h [44784 2013-06-25] (MindSpark)
HKLM\...\Run: [UtilityChest_49 Browser Plugin Loader] C:\PROGRA~1\UTILIT~2\bar\1.bin\49brmon.exe [30096 2013-06-25] (VER_COMPANY_NAME)
HKLM\...\Run: [NortonSupport] "C:\Program Files\Norton 360\Engine\20.4.0.40\symerr.exe" /supportreboot [x]
HKLM\...\Run: [emsisoft anti-malware] "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60 [2928040 2013-07-02] (Emsisoft GmbH)
HKLM\...\Run: [@OnlineArmor GUI] "C:\Program Files\Online Armor\oaui.exe" [2415104 2012-10-02] (Emsisoft GmbH)
HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\nmbgmonitor.exe" [202024 2007-10-15] (Nero AG)
HKCU\...\Run: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autorun [1233920 2009-04-11] (Microsoft Corporation)
HKCU\...\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot [423144 2013-04-27] (BillP Studios)
HKCU\...\Policies\system: [disableregistrytools] 0
MountPoints2: {efcd0c81-082c-11df-b5e6-806e6f6e6963} - H:\setup.exe
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files\Ralink\Common\RaUI.exe (Ralink Technology, Corp.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
URLSearchHook: (No Name) - {7a55cbb2-2b2e-4a41-9de1-6ac5d2c2be0a} - C:\Program Files\UtilityChest_49\bar\1.bin\49SrcAs.dll (MindSpark)
URLSearchHook: (No Name) - {5fdb0cd8-5760-44d1-8d13-a78bf558c3c7} - C:\Program Files\InboxAce_1g\bar\1.bin\1gSrcAs.dll No File
HKCU SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 
BHO: Search Assistant BHO - {06e05b40-77fa-40b6-9077-ed1a7577b1ef} - C:\Program Files\UtilityChest_49\bar\1.bin\49SrcAs.dll (MindSpark)
BHO: GamesBar (W) - {2e94b700-eafb-4c9e-a696-77200aa3f89b} - C:\Program Files\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll ()
BHO: Toolbar BHO - {58f7b5ca-1162-42e8-8bbc-d543b4edd780} - C:\PROGRA~1\UTILIT~2\bar\1.bin\49bar.dll (MindSpark)
BHO: No Name - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -  No File
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\20.4.0.40\IPS\IPSBHO.DLL No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Search Assistant BHO - {9359da42-06fb-46f2-9e4a-05c05b98a5ef} - C:\Program Files\InboxAce_1g\bar\1.bin\1gSrcAs.dll No File
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Toolbar BHO - {d5a1d22b-9e17-454f-8ecd-83c578fb3983} - C:\PROGRA~1\INBOXA~2\bar\1.bin\1gbar.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - GamesBar (W) - {2e94b700-eafb-4c9e-a696-77200aa3f89b} - C:\Program Files\gamesagogo_w3i\encyclopediabritannicagamesbarX.dll ()
Toolbar: HKLM - Utility Chest - {cf67755f-9265-449c-87cf-b945519e073b} - C:\Program Files\UtilityChest_49\bar\1.bin\49bar.dll (MindSpark)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -No Name - {3775AFD7-5921-4571-968F-85A631203D1C} -  No File
Toolbar: HKCU -Utility Chest - {CF67755F-9265-449C-87CF-B945519E073B} - C:\Program Files\UtilityChest_49\bar\1.bin\49bar.dll (MindSpark)
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://oas.support.microsoft.com/ActiveX/MSDcode.cab
DPF: {4FF78044-96B4-4312-A5B7-FDA3CB328095} 
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
ShellExecuteHooks: OA Shell Helper - {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\PROGRA~1\ONLINE~1\oaevent.dll [366440 2012-10-02] (Emsisoft GmbH)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\sgcqplk5.default
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @InboxAce_1g.com/Plugin - C:\Program Files\InboxAce_1g\bar\1.bin\NP1gStub.dll No File
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @UtilityChest_49.com/Plugin - C:\Program Files\UtilityChest_49\bar\1.bin\NP49Stub.dll (MindSpark)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF HKLM\...\Firefox\Extensions: [1gffxtbr@InboxAce_1g.com] C:\Program Files\InboxAce_1g\bar\1.bin
FF HKLM\...\Firefox\Extensions: [49ffxtbr@UtilityChest_49.com] C:\Program Files\UtilityChest_49\bar\1.bin
FF Extension: Utility Chest - C:\Program Files\UtilityChest_49\bar\1.bin
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

Chrome: 
=======
CHR HomePage: hxxp://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=TJ&userid=dea475c8-3714-4b9c-9dc7-bc9f234f8bb6&searchtype=hp&installDate=22/06/2013
CHR RestoreOnStartup: "hxxp://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=TJ&userid=dea475c8-3714-4b9c-9dc7-bc9f234f8bb6&searchtype=hp&installDate=22/06/2013"
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (Norton Identity Protection) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.11.8_0
CHR Extension: (Gmail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

========================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [2938408 2013-07-02] (Emsisoft GmbH)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 OAcat; C:\Program Files\Online Armor\OAcat.exe [216072 2012-10-02] (Emsisoft GmbH)
R2 RalinkRegistryWriter; C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe [75040 2008-09-05] (Ralink Technology, Corp.)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)
S2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)
R2 srvcPVR; C:\Program Files\Sceneo\AbsolutTV\Services\PVR\PVRService.exe [1681408 2007-08-16] (Buhl Data Service GmbH)
R2 SvcOnlineArmor; C:\Program Files\Online Armor\oasrv.exe [4463864 2012-10-02] (Emsisoft GmbH)
R2 UtilityChest_49Service; C:\PROGRA~1\UTILIT~2\bar\1.bin\49barsvc.exe [42504 2013-06-25] (COMPANYVERS_NAME)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys [54072 2012-04-30] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys [22056 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files\Emsisoft Anti-Malware\a2dix86.sys [37856 2012-04-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files\Emsisoft Anti-Malware\a2util32.sys [14432 2013-03-28] (Emsisoft GmbH)
S3 CH375; C:\Windows\System32\Drivers\CH375WDM.SYS [28403 2011-03-14] (www.winchiphead.com)
R3 cleanhlp; C:\Program Files\Emsisoft Anti-Malware\cleanhlp32.sys [50208 2013-07-02] (Emsisoft GmbH)
S3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [645120 2008-08-21] (Ralink Technology Corp.)
R1 OADevice; C:\Windows\system32\drivers\OADriver.sys [208320 2012-10-02] ()
R1 oahlpXX; C:\Windows\system32\drivers\oahlp32.sys [44992 2012-10-02] ()
R1 OAmon; C:\Windows\system32\drivers\OAmon.sys [27648 2012-10-02] (Emsisoft)
R3 OAnet; C:\Windows\System32\DRIVERS\oanet.sys [31768 2012-10-02] (Emsisoft)
R3 Ph3xIB32; C:\Windows\System32\DRIVERS\Ph3xIB32.sys [1131136 2007-04-03] (Philips Semiconductors GmbH)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-04-18] (Secunia)
S3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-30] (America Online, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S1 SRTSP; \SystemRoot\system32\drivers\N360\1404000.028\SRTSP.SYS [x]
S1 SymIM; system32\DRIVERS\SymIMv.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-06 12:58 - 2013-07-06 12:58 - 00022676 ____A C:\Users\*****\Desktop\Addition.txt
2013-07-06 12:57 - 2013-07-06 16:17 - 00000000 ____D C:\FRST
2013-07-06 12:54 - 2013-07-06 12:55 - 01373373 ____A (Farbar) C:\Users\*****\Desktop\FRST.exe
2013-07-04 21:30 - 2013-07-04 21:42 - 00000000 ____D C:\ProgramData\OnlineArmor
2013-07-04 21:30 - 2013-07-04 21:30 - 00000000 ____D C:\Users\*****\AppData\Roaming\OnlineArmor
2013-07-04 21:28 - 2013-07-06 11:02 - 00000000 ____D C:\Program Files\Online Armor
2013-07-04 21:28 - 2012-10-02 15:03 - 00044992 ____A C:\Windows\System32\Drivers\oahlp32.sys
2013-07-04 21:28 - 2012-10-02 15:02 - 00208320 ____A C:\Windows\System32\Drivers\OADriver.sys
2013-07-04 21:28 - 2012-10-02 15:02 - 00031768 ____A (Emsisoft) C:\Windows\System32\Drivers\OAnet.sys
2013-07-04 21:28 - 2012-10-02 15:02 - 00027648 ____A (Emsisoft) C:\Windows\System32\Drivers\OAmon.sys
2013-07-04 21:27 - 2013-07-06 18:41 - 00000000 ____D C:\Program Files\Emsisoft Anti-Malware
2013-07-04 21:27 - 2013-07-04 21:27 - 00000852 ____A C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2013-07-04 21:27 - 2013-07-04 21:27 - 00000000 ____D C:\Users\*****\Documents\Anti-Malware
2013-07-04 21:26 - 2013-07-04 21:26 - 221077448 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftInternetSecuritySetup(1).exe
2013-07-04 20:32 - 2013-07-04 20:49 - 221077448 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftInternetSecuritySetup.exe
2013-07-04 20:31 - 2013-07-04 20:48 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(4).exe
2013-07-04 20:31 - 2013-07-04 20:48 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(3).exe
2013-07-04 20:30 - 2013-07-04 20:48 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(1).exe
2013-07-04 20:30 - 2013-07-04 20:46 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup.exe
2013-07-04 20:30 - 2013-07-04 20:45 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(2).exe
2013-07-04 20:02 - 2013-07-04 20:02 - 00867880 ____A C:\Users\*****\Downloads\Norton20_Removal_Tool(1).exe
2013-07-04 19:59 - 2013-07-04 20:01 - 00269952 ____A C:\Windows\msxml4-KB2758694-enu.LOG
2013-07-04 19:58 - 2013-07-04 19:59 - 00867880 ____A C:\Users\*****\Downloads\Norton20_Removal_Tool.exe
2013-07-01 21:20 - 2013-07-01 21:21 - 00000000 ____D C:\Users\*****\Desktop\wot_safe_surfing-20130515-fx
2013-07-01 20:17 - 2013-07-01 20:17 - 00000209 ____A C:\Users\*****\Desktop\AOL.de Kostenlose Email, Nachrichten & Wetter, Finanzen , Sport und Star-News auf AOL.de.URL
2013-07-01 19:58 - 2013-07-01 19:58 - 02434048 ____A C:\Users\*****\Downloads\msxml.msi
2013-07-01 19:58 - 2013-07-01 19:58 - 02434048 ____A C:\Users\*****\Downloads\msxml(1).msi
2013-07-01 19:49 - 2013-07-01 19:49 - 00000000 ____D C:\Users\*****\AppData\Local\Secunia PSI
2013-07-01 19:28 - 2013-07-01 19:28 - 00448512 ____A (OldTimer Tools) C:\Users\*****\Downloads\TFC.exe
2013-07-01 19:22 - 2013-07-03 18:59 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-01 19:22 - 2013-07-01 19:57 - 00000810 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-07-01 19:22 - 2013-07-01 19:22 - 00000000 ____D C:\Users\*****\AppData\Roaming\Mozilla
2013-07-01 19:22 - 2013-07-01 19:22 - 00000000 ____D C:\Users\*****\AppData\Local\Mozilla
2013-07-01 19:22 - 2013-07-01 19:22 - 00000000 ____D C:\ProgramData\Mozilla
2013-07-01 19:18 - 2013-07-01 19:18 - 00376576 ____A C:\Users\*****\Desktop\wot_safe_surfing-20130515-fx.zip
2013-07-01 19:12 - 2013-07-01 19:12 - 00140125 ____A C:\Users\*****\Desktop\hosts.zip
2013-07-01 18:44 - 2013-07-01 18:44 - 00000000 ____D C:\ProgramData\Licenses
2013-07-01 18:44 - 2013-07-01 18:43 - 00867240 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-07-01 18:44 - 2013-07-01 18:43 - 00263592 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-07-01 18:44 - 2013-07-01 18:43 - 00175016 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-07-01 18:44 - 2013-07-01 18:43 - 00175016 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-07-01 18:44 - 2013-07-01 18:43 - 00094632 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-07-01 18:43 - 2013-07-01 18:49 - 00000000 ____D C:\Program Files\SpywareBlaster
2013-07-01 18:43 - 2013-07-01 18:43 - 04095448 ____A (BrightFort LLC                                              ) C:\Users\*****\Downloads\spywareblastersetup50.exe
2013-07-01 18:43 - 2013-07-01 18:43 - 00000840 ____A C:\Users\Public\Desktop\SpywareBlaster.lnk
2013-07-01 18:41 - 2013-07-01 21:20 - 00000000 ____D C:\ProgramData\InstallMate
2013-07-01 18:41 - 2013-07-01 18:41 - 00000000 ____D C:\Users\*****\AppData\Roaming\WinPatrol
2013-07-01 18:41 - 2013-07-01 18:41 - 00000000 ____D C:\Program Files\BillP Studios
2013-07-01 18:40 - 2013-07-01 18:40 - 00906440 ____A (BillP Studios) C:\Users\*****\Desktop\wpsetup.exe
2013-07-01 18:39 - 2013-07-01 18:39 - 00906440 ____A (BillP Studios) C:\Users\*****\Downloads\wpsetup.exe
2013-07-01 18:35 - 2013-07-01 18:35 - 00000870 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-01 18:35 - 2013-07-01 18:35 - 00000000 ____D C:\Users\*****\AppData\Roaming\Malwarebytes
2013-07-01 18:35 - 2013-07-01 18:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-01 18:35 - 2013-07-01 18:35 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-01 18:35 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-07-01 18:34 - 2013-07-01 18:34 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\*****\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-01 18:33 - 2013-07-01 18:33 - 00000000 ____D C:\Program Files\Secunia
2013-07-01 18:20 - 2013-07-01 18:20 - 00000000 ____D C:\Windows\ERUNT
2013-06-28 18:35 - 2013-06-28 18:35 - 00000000 ____D C:\Windows\erdnt
2013-06-25 06:39 - 2013-06-25 06:39 - 00000000 ____D C:\Users\*****\AppData\Local\UtilityChest_49
2013-06-25 06:39 - 2013-06-25 06:39 - 00000000 ____D C:\Program Files\UtilityChest_49
2013-06-23 11:46 - 2013-06-23 11:46 - 00032092 ____A C:\Users\*****\Documents\FRST.txt
2013-06-23 11:46 - 2013-06-23 11:46 - 00019001 ____A C:\Users\*****\Documents\Addition.txt
2013-06-23 11:26 - 2013-06-23 11:26 - 00000000 ____D C:\Users\*****\AppData\Local\InboxAce_1g
2013-06-23 11:26 - 2013-06-23 11:26 - 00000000 ____D C:\Users\*****\AppData\Local\IAC
2013-06-22 20:23 - 2013-06-22 20:23 - 00000000 ____D C:\Program Files\7-Zip
2013-06-22 20:17 - 2013-06-27 18:44 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-06-22 20:16 - 2013-06-22 20:16 - 00000000 ____D C:\Users\*****\AppData\Roaming\Opera
2013-06-22 20:08 - 2013-06-22 20:08 - 00006252 ____A C:\Windows\System32\PerfStringBackup.TMP
2013-06-22 19:58 - 2013-07-01 18:19 - 00000680 ____A C:\Users\*****\AppData\Local\d3d9caps.dat
2013-06-17 06:19 - 2013-06-17 06:19 - 00001628 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-17 06:18 - 2012-08-21 13:01 - 00026840 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys
2013-06-17 06:17 - 2013-06-17 06:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-17 06:17 - 2013-06-17 06:17 - 00000000 ____D C:\Program Files\iPod
2013-06-17 06:13 - 2013-06-17 06:13 - 00000000 ____D C:\Program Files\Bonjour
2013-06-17 06:09 - 2013-06-17 06:17 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 13:38 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 13:38 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 13:38 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 13:38 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 13:38 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 13:38 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-14 13:38 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-14 13:38 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 13:38 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 13:38 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-14 13:38 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-14 13:38 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 13:38 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 13:38 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-14 13:38 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 13:38 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 13:32 - 2013-05-08 06:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-14 13:31 - 2013-05-03 00:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-14 13:31 - 2013-05-03 00:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-14 13:31 - 2013-05-02 06:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-14 13:31 - 2013-05-02 06:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-14 13:31 - 2013-04-24 06:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-14 13:31 - 2013-04-24 06:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-14 13:31 - 2013-04-24 06:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-14 13:31 - 2013-04-24 06:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-14 13:31 - 2013-04-24 03:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-14 13:31 - 2013-04-17 14:30 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll

==================== One Month Modified Files and Folders ========

2013-07-06 18:41 - 2013-07-04 21:27 - 00000000 ____D C:\Program Files\Emsisoft Anti-Malware
2013-07-06 18:40 - 2010-01-23 16:48 - 02005731 ____A C:\Windows\WindowsUpdate.log
2013-07-06 18:36 - 2011-11-22 19:11 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-06 18:35 - 2010-01-24 10:55 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-06 18:35 - 2006-11-02 15:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-06 18:35 - 2006-11-02 14:47 - 00003264 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-06 18:35 - 2006-11-02 14:47 - 00003264 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-06 18:34 - 2006-11-02 15:01 - 00032534 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-06 17:51 - 2011-11-22 19:11 - 00001112 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-06 17:50 - 2012-08-22 20:11 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-06 16:17 - 2013-07-06 12:57 - 00000000 ____D C:\FRST
2013-07-06 16:16 - 2010-12-28 12:53 - 00000000 ____D C:\Users\*****\AppData\Local\CrashDumps
2013-07-06 16:13 - 2010-01-24 11:15 - 00000000 ____D C:\ProgramData\Norton
2013-07-06 12:58 - 2013-07-06 12:58 - 00022676 ____A C:\Users\*****\Desktop\Addition.txt
2013-07-06 12:55 - 2013-07-06 12:54 - 01373373 ____A (Farbar) C:\Users\*****\Desktop\FRST.exe
2013-07-06 11:02 - 2013-07-04 21:28 - 00000000 ____D C:\Program Files\Online Armor
2013-07-04 21:42 - 2013-07-04 21:30 - 00000000 ____D C:\ProgramData\OnlineArmor
2013-07-04 21:30 - 2013-07-04 21:30 - 00000000 ____D C:\Users\*****\AppData\Roaming\OnlineArmor
2013-07-04 21:29 - 2010-01-23 17:06 - 00000000 ___AD C:\users\*****
2013-07-04 21:27 - 2013-07-04 21:27 - 00000852 ____A C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2013-07-04 21:27 - 2013-07-04 21:27 - 00000000 ____D C:\Users\*****\Documents\Anti-Malware
2013-07-04 21:26 - 2013-07-04 21:26 - 221077448 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftInternetSecuritySetup(1).exe
2013-07-04 20:49 - 2013-07-04 20:32 - 221077448 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftInternetSecuritySetup.exe
2013-07-04 20:48 - 2013-07-04 20:31 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(4).exe
2013-07-04 20:48 - 2013-07-04 20:31 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(3).exe
2013-07-04 20:48 - 2013-07-04 20:30 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(1).exe
2013-07-04 20:46 - 2013-07-04 20:30 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup.exe
2013-07-04 20:45 - 2013-07-04 20:30 - 190580728 ____A (Emsisoft GmbH                                               ) C:\Users\*****\Downloads\EmsisoftAntiMalwareSetup(2).exe
2013-07-04 20:19 - 2010-01-23 17:02 - 01324818 ____A C:\Windows\PFRO.log
2013-07-04 20:17 - 2010-01-24 11:16 - 00000000 ____D C:\ProgramData\Symantec
2013-07-04 20:02 - 2013-07-04 20:02 - 00867880 ____A C:\Users\*****\Downloads\Norton20_Removal_Tool(1).exe
2013-07-04 20:01 - 2013-07-04 19:59 - 00269952 ____A C:\Windows\msxml4-KB2758694-enu.LOG
2013-07-04 19:59 - 2013-07-04 19:58 - 00867880 ____A C:\Users\*****\Downloads\Norton20_Removal_Tool.exe
2013-07-03 19:16 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-07-03 18:59 - 2013-07-01 19:22 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-01 21:58 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-01 21:21 - 2013-07-01 21:20 - 00000000 ____D C:\Users\*****\Desktop\wot_safe_surfing-20130515-fx
2013-07-01 21:20 - 2013-07-01 18:41 - 00000000 ____D C:\ProgramData\InstallMate
2013-07-01 20:17 - 2013-07-01 20:17 - 00000209 ____A C:\Users\*****\Desktop\AOL.de Kostenlose Email, Nachrichten & Wetter, Finanzen , Sport und Star-News auf AOL.de.URL
2013-07-01 20:14 - 2010-01-26 15:52 - 00002633 ____A C:\Users\*****\Desktop\Microsoft Office PowerPoint 2007.lnk
2013-07-01 20:12 - 2012-08-07 19:40 - 00000000 ____D C:\Program Files\EcrSystem
2013-07-01 19:59 - 2007-09-26 14:08 - 00000000 ____D C:\Program Files\MSXML 4.0
2013-07-01 19:58 - 2013-07-01 19:58 - 02434048 ____A C:\Users\*****\Downloads\msxml.msi
2013-07-01 19:58 - 2013-07-01 19:58 - 02434048 ____A C:\Users\*****\Downloads\msxml(1).msi
2013-07-01 19:57 - 2013-07-01 19:22 - 00000810 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-07-01 19:57 - 2011-10-21 13:08 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-01 19:49 - 2013-07-01 19:49 - 00000000 ____D C:\Users\*****\AppData\Local\Secunia PSI
2013-07-01 19:28 - 2013-07-01 19:28 - 00448512 ____A (OldTimer Tools) C:\Users\*****\Downloads\TFC.exe
2013-07-01 19:22 - 2013-07-01 19:22 - 00000000 ____D C:\Users\*****\AppData\Roaming\Mozilla
2013-07-01 19:22 - 2013-07-01 19:22 - 00000000 ____D C:\Users\*****\AppData\Local\Mozilla
2013-07-01 19:22 - 2013-07-01 19:22 - 00000000 ____D C:\ProgramData\Mozilla
2013-07-01 19:18 - 2013-07-01 19:18 - 00376576 ____A C:\Users\*****\Desktop\wot_safe_surfing-20130515-fx.zip
2013-07-01 19:12 - 2013-07-01 19:12 - 00140125 ____A C:\Users\*****\Desktop\hosts.zip
2013-07-01 18:49 - 2013-07-01 18:43 - 00000000 ____D C:\Program Files\SpywareBlaster
2013-07-01 18:44 - 2013-07-01 18:44 - 00000000 ____D C:\ProgramData\Licenses
2013-07-01 18:43 - 2013-07-01 18:44 - 00867240 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-07-01 18:43 - 2013-07-01 18:44 - 00263592 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-07-01 18:43 - 2013-07-01 18:44 - 00175016 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-07-01 18:43 - 2013-07-01 18:44 - 00175016 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-07-01 18:43 - 2013-07-01 18:44 - 00094632 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-07-01 18:43 - 2013-07-01 18:43 - 04095448 ____A (BrightFort LLC                                              ) C:\Users\*****\Downloads\spywareblastersetup50.exe
2013-07-01 18:43 - 2013-07-01 18:43 - 00000840 ____A C:\Users\Public\Desktop\SpywareBlaster.lnk
2013-07-01 18:43 - 2010-06-23 08:47 - 00789416 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-07-01 18:43 - 2010-01-23 18:54 - 00000000 ____D C:\Program Files\Java
2013-07-01 18:41 - 2013-07-01 18:41 - 00000000 ____D C:\Users\*****\AppData\Roaming\WinPatrol
2013-07-01 18:41 - 2013-07-01 18:41 - 00000000 ____D C:\Program Files\BillP Studios
2013-07-01 18:40 - 2013-07-01 18:40 - 00906440 ____A (BillP Studios) C:\Users\*****\Desktop\wpsetup.exe
2013-07-01 18:39 - 2013-07-01 18:39 - 00906440 ____A (BillP Studios) C:\Users\*****\Downloads\wpsetup.exe
2013-07-01 18:35 - 2013-07-01 18:35 - 00000870 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-01 18:35 - 2013-07-01 18:35 - 00000000 ____D C:\Users\*****\AppData\Roaming\Malwarebytes
2013-07-01 18:35 - 2013-07-01 18:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-01 18:35 - 2013-07-01 18:35 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-01 18:34 - 2013-07-01 18:34 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\*****\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-01 18:33 - 2013-07-01 18:33 - 00000000 ____D C:\Program Files\Secunia
2013-07-01 18:20 - 2013-07-01 18:20 - 00000000 ____D C:\Windows\ERUNT
2013-07-01 18:19 - 2013-06-22 19:58 - 00000680 ____A C:\Users\*****\AppData\Local\d3d9caps.dat
2013-06-30 21:49 - 2012-05-21 20:02 - 00000000 ____D C:\Users\*****\AppData\Roaming\Apple Computer
2013-06-28 18:35 - 2013-06-28 18:35 - 00000000 ____D C:\Windows\erdnt
2013-06-27 18:59 - 2010-01-26 15:57 - 00002591 ____A C:\Users\*****\Desktop\Microsoft Office Word 2007.lnk
2013-06-27 18:44 - 2013-06-22 20:17 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-06-25 06:39 - 2013-06-25 06:39 - 00000000 ____D C:\Users\*****\AppData\Local\UtilityChest_49
2013-06-25 06:39 - 2013-06-25 06:39 - 00000000 ____D C:\Program Files\UtilityChest_49
2013-06-23 11:46 - 2013-06-23 11:46 - 00032092 ____A C:\Users\*****\Documents\FRST.txt
2013-06-23 11:46 - 2013-06-23 11:46 - 00019001 ____A C:\Users\*****\Documents\Addition.txt
2013-06-23 11:26 - 2013-06-23 11:26 - 00000000 ____D C:\Users\*****\AppData\Local\InboxAce_1g
2013-06-23 11:26 - 2013-06-23 11:26 - 00000000 ____D C:\Users\*****\AppData\Local\IAC
2013-06-22 20:23 - 2013-06-22 20:23 - 00000000 ____D C:\Program Files\7-Zip
2013-06-22 20:16 - 2013-06-22 20:16 - 00000000 ____D C:\Users\*****\AppData\Roaming\Opera
2013-06-22 20:08 - 2013-06-22 20:08 - 00006252 ____A C:\Windows\System32\PerfStringBackup.TMP
2013-06-22 20:04 - 2011-04-17 19:29 - 00000000 ____D C:\Windows\System32\Drivers\N360
2013-06-22 19:54 - 2013-01-09 21:21 - 00001935 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-17 06:19 - 2013-06-17 06:19 - 00001628 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-17 06:19 - 2010-01-26 10:43 - 00000000 ____D C:\Users\*****\AppData\Local\Apple Computer
2013-06-17 06:18 - 2013-06-17 06:17 - 00000000 ____D C:\Program Files\iTunes
2013-06-17 06:17 - 2013-06-17 06:17 - 00000000 ____D C:\Program Files\iPod
2013-06-17 06:17 - 2013-06-17 06:09 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-17 06:17 - 2010-02-13 14:59 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-17 06:17 - 2010-02-13 14:54 - 00000000 ____D C:\ProgramData\Apple
2013-06-17 06:13 - 2013-06-17 06:13 - 00000000 ____D C:\Program Files\Bonjour
2013-06-17 06:09 - 2012-05-21 06:11 - 00001690 ____A C:\Users\Public\Desktop\QuickTime Player.lnk
2013-06-17 06:09 - 2008-01-23 14:46 - 00000000 ____D C:\Program Files\QuickTime
2013-06-14 16:48 - 2012-08-22 20:11 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-14 16:48 - 2011-09-04 07:42 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-14 16:43 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 13:36 - 2006-11-02 12:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-06 18:41

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Heißt das, dass ich Windows.old wenn wir fertig sind einfach löschen kann?
Die Meldung kommt nicht mehr, habe eben neu gestartet.

Grüße
Sabine99

schrauber · 06.07.2013, 17:55

Genau

Wie kann ich den Ordner "Windows.old" entfernen?

Sabine99 · 06.07.2013, 18:27

HI Schrauber,

vielleicht bin ich je ein bischen dumm, aber ich finde keine Möglichkeit Systemdateien zu bereinigen.
Zuerst kommt nur eigene Dateien oder alle Benutzer, danach erscheinen nur zwei Registerkarten: Datenträgerbereinigung und weitere Optionen. Von Systemdateien bereinigen finde ich leider nichts. Bin vielleicht einfach blind?

Grüße

Sabine99

schrauber · 07.07.2013, 06:08

Mach mir mal bitte nen Screenshot von dem was Du siehst

Sabine99 · 07.07.2013, 09:55

Hallo Schrauber,

ich habe gerade bemerkt, dass der link für windows 7 war, ich habe auf dem PC Vista.
Brauchst Du den screen shot noch, sorry, das hab ich gestern nicht bemerkt.

Ich füge ihn einfach mal ein.

Grüße
Sabine99

schrauber · 07.07.2013, 10:10

Versuch das mal, aber in der Regel geht es auf allen Betriebssystemen gleich

Entfernen des Windows.old-Ordners, der generiert wird, wenn Sie eine benutzerdefinierte Installation von Windows Vista so durchführen

Sabine99 · 07.07.2013, 10:28

Hallo Schrauber,

ich habe es jetzt nach der anderen Aleitung versucht. Ich finde auch hier keine früheren Windows Installationen. Kann es sein, dass es nicht funktioniert, da sich Windows.old nun unter C:FRST in Quarantäne befindet?

Sorry für meine "dummen" Fragen.

Sabine99

schrauber · 07.07.2013, 10:32

Ja wenn der Ordner C:\Windows.old gar nicht mehr da ist kanns auch nit gehen

06.07.2013, 17:55	#64
schrauber /// the machine /// TB-Ausbilder	GVU Trojaner, Anmeldung im abgesicherten Modus nicht möglich Genau Wie kann ich den Ordner "Windows.old" entfernen? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

07.07.2013, 06:08	#66
schrauber /// the machine /// TB-Ausbilder	GVU Trojaner, Anmeldung im abgesicherten Modus nicht möglich Mach mir mal bitte nen Screenshot von dem was Du siehst __________________ --> GVU Trojaner, Anmeldung im abgesicherten Modus nicht möglich

07.07.2013, 10:32	#70
schrauber /// the machine /// TB-Ausbilder	GVU Trojaner, Anmeldung im abgesicherten Modus nicht möglich Ja wenn der Ordner C:\Windows.old gar nicht mehr da ist kanns auch nit gehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

GVU Trojaner, Anmeldung im abgesicherten Modus nicht möglich

Log-Analyse und Auswertung: GVU Trojaner, Anmeldung im abgesicherten Modus nicht möglich