Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
BKA Trojaner endgültig entfernen

BKA Trojaner endgültig entfernen


Log-Analyse und Auswertung: BKA Trojaner endgültig entfernen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Seite 1 von 2 1 2
Alt 30.06.2013, 19:00   #1
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Hallo,

Leider wurde ich Opfer des BKA Trojaners. Um auf meinen Laptop wieder zugreifen zu können habe ich im abgsichertem Modus eine Systemwiederhestellung gemacht, dies hat soweit auch geklappt.
Als nächsten Schritt habe ich ein Systemscan mit Hilfe von Malewarebytes Anti Malware vorgenommen! Hier die Ergebnisse :

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.06.30.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Pierre :: LAPTOP [Administrator]

Schutz: Aktiviert

30.06.2013 16:17:39
mbam-log-2013-06-30 (16-17-39).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 419043
Laufzeit: 1 Stunde(n), 53 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)


bzw.

Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.06.30.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Pierre :: LAPTOP [Administrator]

Schutz: Aktiviert

30.06.2013 16:17:39
MBAM-log-2013-06-30 (18-15-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 419043
Laufzeit: 1 Stunde(n), 53 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)


2013/06/30 16:16:23 +0200 LAPTOP Pierre MESSAGE Starting protection
2013/06/30 16:16:23 +0200 LAPTOP Pierre MESSAGE Protection started successfully
2013/06/30 16:16:23 +0200 LAPTOP Pierre MESSAGE Starting IP protection
2013/06/30 16:16:54 +0200 LAPTOP Pierre MESSAGE IP Protection started successfully
2013/06/30 16:17:10 +0200 LAPTOP Pierre MESSAGE Starting database refresh
2013/06/30 16:17:10 +0200 LAPTOP Pierre MESSAGE Stopping IP protection
2013/06/30 16:17:22 +0200 LAPTOP Pierre MESSAGE IP Protection stopped successfully
2013/06/30 16:17:26 +0200 LAPTOP Pierre MESSAGE Database refreshed successfully
2013/06/30 16:17:26 +0200 LAPTOP Pierre MESSAGE Starting IP protection
2013/06/30 16:17:31 +0200 LAPTOP Pierre MESSAGE IP Protection started successfully
2013/06/30 16:24:08 +0200 LAPTOP Pierre MESSAGE Executing scheduled update: Daily
2013/06/30 16:24:10 +0200 LAPTOP Pierre MESSAGE Database already up-to-date
2013/06/30 18:18:12 +0200 LAPTOP Pierre MESSAGE Starting protection
2013/06/30 18:18:12 +0200 LAPTOP Pierre MESSAGE Protection started successfully
2013/06/30 18:18:12 +0200 LAPTOP Pierre MESSAGE Starting IP protection
2013/06/30 18:18:19 +0200 LAPTOP Pierre MESSAGE IP Protection started successfully



Wie verfahre ich weiter ? Vielen Dank schonmal für eure Hilfe

Alt 30.06.2013, 19:09   #2
schrauber
/// the machine
/// TB-Ausbilder
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)
__________________

__________________
Alt 30.06.2013, 20:38   #3
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-06-2013 01
Ran by Pierre (administrator) on 30-06-2013 21:29:19
Running from C:\Users\Pierre\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
() C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(NVIDIA Corporation) C:\Windows\SysWOW64\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\BM\TMBMSRV.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Wajam) C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EeeStorageBackup] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe MySyncFolder [1732608 2009-11-26] ()
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [16414824 2009-12-11] (NVIDIA Corporation)
HKLM\...\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe [621440 2009-09-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-02] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [1022368 2009-09-29] (Trend Micro Inc.)
HKLM-x32\...\Runonce: [Del1562880] cmd.exe /Q /D /c del "C:\Users\Pierre\AppData\Local\Temp\0.del" [x]
HKLM-x32\...\Runonce: [Del1576405] cmd.exe /Q /D /c del "C:\Users\Pierre\AppData\Local\Temp\0.del" [x]
HKCU\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [3872080 2010-04-16] (Microsoft Corporation)
HKCU\...\Run: [Facebook Update] "C:\Users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2013-01-11] (Facebook Inc.)
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Runonce: [Del1562880] cmd.exe /Q /D /c del "C:\Users\Pierre\AppData\Local\Temp\0.del" [x]
HKCU\...\Runonce: [Qtrax] C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe 2783365012.portal.qtrax.com [x]
HKCU\...\Runonce: [Del1576405] cmd.exe /Q /D /c del "C:\Users\Pierre\AppData\Local\Temp\0.del" [x]
HKLM-x32\...\Run: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [6998656 2009-10-27] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2009-08-20] (ASUS)
HKLM-x32\...\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [248040 2010-02-18] (Sun Microsystems, Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\FancyStart daemon.lnk
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\SRS Premium Sound.lnk
ShortcutTarget: SRS Premium Sound.lnk -> C:\Windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe (Acresso Software Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.holasearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Lyrics Finder - {398C01F1-E584-46AD-A649-4F78B435DCFE} - C:\Program Files (x86)\LyricsFinder\lfind.dll (Nijad Software)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: holasearch Helper Object - {DFF9B2DA-EF99-4B26-83CB-7058299999D8} - C:\Program Files (x86)\holasearch\holasearch\1.8.16.16\bh\holasearch.dll (holasearch.com)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
BHO-x32: DealPly - {EF7BD87A-8024-11E2-F316-F3E56188709B} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Holasearch Toolbar - {C510DFFB-0AFE-484C-BA40-CED5B74C4EEF} - C:\Program Files (x86)\holasearch\holasearch\1.8.16.16\holasearchTlbr.dll (holasearch.com)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default
FF user.js: detected! => C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\user.js
FF NewTab: hxxp://www.holasearch.com/?babsrc=NT_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929
FF SearchEngine: Hola Search
FF Homepage: hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929
FF Keyword.URL: hxxp://www.holasearch.com/?babsrc=SP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Pierre\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Extension: No Name - C:\Users\Pierre\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: HolaSearch - C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\Extensions\ffxtlbr@holasearch.com
FF Extension: Yahoo! Toolbar - C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF Extension: No Name - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF HKCU\...\Firefox\Extensions: [lfind@nijadsoft.net] C:\Program Files (x86)\LyricsFinder\FF\
FF Extension: No Name - C:\Program Files (x86)\LyricsFinder\FF\

Chrome: 
=======
CHR RestoreOnStartup: "hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929"
CHR Extension: (DealPly Shopping  ) - C:\Users\Pierre\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmfnfnpmhcllokmkepffndflpnadjmma\3.5.0.0_0

==================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 OberonGameConsoleService; C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
R2 SfCtlCom; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [838528 2009-09-29] (Trend Micro Inc.)
R2 Stereo Service; C:\Windows\SysWOW64\nvSCPAPISvr.exe [239208 2009-12-11] (NVIDIA Corporation)
R3 TMBMServer; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [570632 2009-09-29] (Trend Micro Inc.)
R3 TmProxy; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [917768 2009-09-29] (Trend Micro Inc.)
R2 WajamUpdater; C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [109064 2013-05-02] (Wajam)

==================== Drivers (Whitelisted) ====================

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-08-12] ()
R2 tmpreflt; C:\Windows\System32\DRIVERS\tmpreflt.sys [42000 2009-12-04] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [107536 2009-09-29] (Trend Micro Inc.)
R2 tmxpflt; C:\Windows\System32\DRIVERS\tmxpflt.sys [265744 2009-12-04] (Trend Micro Inc.)
R2 vsapint; C:\Windows\System32\DRIVERS\vsapint.sys [2007056 2009-12-04] (Trend Micro Inc.)
U3 tmlwf; 
U3 tmwfp; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-30 21:29 - 2013-06-30 21:29 - 00000000 ____D C:\FRST
2013-06-30 21:28 - 2013-06-30 21:28 - 01933594 ____A (Farbar) C:\Users\Pierre\Downloads\FRST64.exe
2013-06-30 21:25 - 2013-06-30 21:25 - 00000414 ____A C:\Windows\Tasks\Lyrics Finder Update.job
2013-06-30 21:25 - 2013-06-30 21:25 - 00000000 ____D C:\Program Files (x86)\LyricsFinder
2013-06-30 21:24 - 2013-06-30 21:24 - 00000290 ____A C:\Windows\Tasks\DSite.job
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Zip Opener Packages
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\holasearch
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\DSite
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\DealPly
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Babylon
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\BabSolution
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Local\Wajam
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\ProgramData\Babylon
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\Wajam
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\holasearch
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-06-30 21:23 - 2013-06-30 21:23 - 00793536 ____A C:\Users\Pierre\Downloads\ZipOpenerSetup.exe
2013-06-30 19:15 - 2013-06-30 19:15 - 00112922 ____A C:\Users\Pierre\Desktop\Extras.Txt
2013-06-30 19:13 - 2013-06-30 19:17 - 00093102 ____A C:\Users\Pierre\Desktop\OTL.Txt
2013-06-30 18:51 - 2013-06-30 18:51 - 00602112 ____A (OldTimer Tools) C:\Users\Pierre\Desktop\OTL.exe
2013-06-30 16:16 - 2013-06-30 16:16 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00001111 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-06-30 16:15 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-30 16:14 - 2013-06-30 16:14 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Pierre\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-23 22:35 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-23 22:35 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-23 22:35 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-23 22:35 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-23 22:34 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-23 22:34 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 22:47 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 22:47 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 22:47 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 22:47 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 22:47 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-13 15:43 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 15:43 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 15:43 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 15:43 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 15:43 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 15:43 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-13 15:43 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 15:42 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 15:42 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 15:42 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 15:42 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 15:42 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-13 15:42 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-03 20:34 - 2013-06-26 10:48 - 00002223 ____A C:\Users\Pierre\Desktop\achtung kontrolle mery.txt
2013-06-02 20:26 - 2013-06-02 20:26 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

==================== One Month Modified Files and Folders =======

2013-06-30 21:30 - 2012-11-18 11:43 - 00000824 ____A C:\Windows\System32\Drivers\etc\tmvsthfud.bin
2013-06-30 21:29 - 2013-06-30 21:29 - 00000000 ____D C:\FRST
2013-06-30 21:29 - 2010-03-13 16:32 - 00000824 ____A C:\Windows\System32\Drivers\etc\tmvsthfss.bin
2013-06-30 21:28 - 2013-06-30 21:28 - 01933594 ____A (Farbar) C:\Users\Pierre\Downloads\FRST64.exe
2013-06-30 21:28 - 2013-04-27 21:09 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-30 21:27 - 2009-07-14 06:45 - 00010240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-30 21:27 - 2009-07-14 06:45 - 00010240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-30 21:25 - 2013-06-30 21:25 - 00000414 ____A C:\Windows\Tasks\Lyrics Finder Update.job
2013-06-30 21:25 - 2013-06-30 21:25 - 00000000 ____D C:\Program Files (x86)\LyricsFinder
2013-06-30 21:25 - 2010-03-13 16:00 - 00001124 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-30 21:24 - 2013-06-30 21:24 - 00000290 ____A C:\Windows\Tasks\DSite.job
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Zip Opener Packages
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\holasearch
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\DSite
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\DealPly
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Babylon
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\BabSolution
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Local\Wajam
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\ProgramData\Babylon
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\Wajam
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\holasearch
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-06-30 21:23 - 2013-06-30 21:23 - 00793536 ____A C:\Users\Pierre\Downloads\ZipOpenerSetup.exe
2013-06-30 21:13 - 2013-01-23 21:41 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Skype
2013-06-30 21:02 - 2010-03-13 15:26 - 01305266 ____A C:\Windows\WindowsUpdate.log
2013-06-30 20:59 - 2010-04-29 19:50 - 00000000 ____D C:\Users\Pierre\Tracing
2013-06-30 20:59 - 2010-03-13 16:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-30 20:59 - 2010-03-13 16:00 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-30 20:58 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-30 20:58 - 2009-07-14 06:51 - 00114674 ____A C:\Windows\setupact.log
2013-06-30 19:17 - 2013-06-30 19:13 - 00093102 ____A C:\Users\Pierre\Desktop\OTL.Txt
2013-06-30 19:15 - 2013-06-30 19:15 - 00112922 ____A C:\Users\Pierre\Desktop\Extras.Txt
2013-06-30 19:07 - 2013-01-11 17:02 - 00000932 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001UA.job
2013-06-30 18:51 - 2013-06-30 18:51 - 00602112 ____A (OldTimer Tools) C:\Users\Pierre\Desktop\OTL.exe
2013-06-30 18:18 - 2010-03-13 16:30 - 00001317 ____A C:\Windows\System32\ServiceFilter.ini
2013-06-30 18:17 - 2010-03-13 16:26 - 00020432 ____A C:\Windows\PFRO.log
2013-06-30 16:16 - 2013-06-30 16:16 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00001111 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-06-30 16:14 - 2013-06-30 16:14 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Pierre\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-30 16:07 - 2013-01-11 17:02 - 00000910 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001Core.job
2013-06-30 16:05 - 2011-12-27 21:10 - 00045056 ____A C:\Windows\System32\acovcnt.exe
2013-06-30 16:05 - 2010-04-24 10:49 - 00000000 ____D C:\users\Pierre
2013-06-30 16:03 - 2011-05-01 21:15 - 00000000 ____D C:\ProgramData\Norton
2013-06-30 16:03 - 2010-03-13 16:30 - 00000000 ____D C:\ProgramData\P4G
2013-06-30 16:03 - 2009-07-14 09:44 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-06-30 16:03 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-06-28 17:10 - 2010-11-26 15:53 - 01522246 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-28 17:10 - 2009-08-04 11:51 - 00654844 ____A C:\Windows\System32\perfh007.dat
2013-06-28 17:10 - 2009-08-04 11:51 - 00130426 ____A C:\Windows\System32\perfc007.dat
2013-06-26 10:48 - 2013-06-03 20:34 - 00002223 ____A C:\Users\Pierre\Desktop\achtung kontrolle mery.txt
2013-06-23 21:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-13 22:50 - 2010-03-13 15:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-13 22:47 - 2010-04-24 11:49 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 15:59 - 2010-06-24 22:06 - 00003584 ____A C:\Users\Pierre\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-11 22:28 - 2013-04-27 21:09 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 22:28 - 2011-10-13 20:31 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-08 16:08 - 2013-06-23 22:35 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-23 22:34 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-23 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-23 22:35 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:40 - 2013-06-23 22:34 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:13 - 2013-06-23 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-08 12:22 - 2012-09-02 15:20 - 00000000 ____D C:\Users\Pierre\Desktop\Grafiken !
2013-06-02 21:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-02 20:33 - 2013-05-29 16:57 - 00015366 ____A C:\Windows\IE10_main.log
2013-06-02 20:26 - 2013-06-02 20:26 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

Files to move or delete:
====================
C:\ProgramData\FullRemove.exe
C:\Users\Pierre\Firefox Setup 3.6.3.exe
C:\Users\Pierre\wlsetup-custom.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-04-24 21:26

==================== End Of Log ============================
--- --- ---



Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-06-2013 01
Ran by Pierre at 2013-06-30 21:32:53
Running from C:\Users\Pierre\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 Update for Microsoft Office 2007 (KB2508958) (x32)
2007 Microsoft Office system (x32 Version: 12.0.6612.1000)
Acrobat.com (x32 Version: 1.6.65)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0)
Activation Assistant for the 2007 Microsoft Office suites (x32)
Actualização do Microsoft Office Excel 2007 Help (KB963678) (x32)
Actualização do Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Actualização do Microsoft Office Word 2007 Help (KB963665) (x32)
Adobe AIR (x32 Version: 3.5.0.600)
Adobe Download Assistant (x32 Version: 1.2.3)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader 9.1 MUI (x32 Version: 9.1.0)
ÅíçìåñùìÝíç Ýêäïóç Microsoft Office Excel 2007 Help (KB963678) (x32)
ÅíçìåñùìÝíç Ýêäïóç Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
ÅíçìåñùìÝíç Ýêäïóç Microsoft Office Word 2007 Help (KB963665) (x32)
Alcor Micro USB Card Reader (x32 Version: 1.5.17.25482)
Alice Greenfingers (x32)
ASUS AI Recovery (x32 Version: 1.0.6)
ASUS AP Bank (x32 Version: 1.0.0.0)
ASUS FancyStart (x32 Version: 1.0.6)
ASUS LifeFrame3 (x32 Version: 3.0.20)
ASUS Live Update (x32 Version: 2.5.9)
ASUS MultiFrame (x32 Version: 1.0.0019)
ASUS Power4Gear Hybrid (Version: 1.1.30)
ASUS SmartLogon (x32 Version: 1.0.0008)
ASUS Splendid Video Enhancement Technology (x32 Version: 1.02.0028)
ASUS USB2.0 UVC VGA WebCam (Version: 5.8.53120.203)
ASUS Virtual Camera (x32 Version: 1.0.19)
ASUS WebStorage (Version: 2.0.36.1260)
ASUS_Screensaver (x32)
ATK Package (x32 Version: 1.0.0001)
bwin Poker (x32)
Chicken Invaders 2 (x32)
City Bus Simulator 2010 - New York (x32 Version: 1.21)
ControlDeck (x32 Version: 1.0.5)
CyberLink LabelPrint (x32 Version: 2.5.1908)
CyberLink Power2Go (x32 Version: 6.1.3509a)
DealPly (HKCU)
DealPly (remove only) (x32 Version: 4.8.6.1)
Dream Day Wedding Married in Manhattan (x32)
ETDWare PS/2-x64 7.0.5.9_WHQL
Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)
Fast Boot (Version: 1.0.4)
Full Tilt Poker (x32 Version: 4.34.4.WIN.FullTilt.COM)
Game Park Console (x32 Version: 5.2.1.4)
Google Chrome (x32 Version: 27.0.1453.116)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32)
Google Update Helper (x32 Version: 1.3.21.145)
hola Chrome Toolbar (x32)
holasearch toolbar  on IE (x32 Version: 1.8.16.16)
Island Wars 2 (x32)
Java Auto Updater (x32 Version: 2.0.2.1)
Java(TM) 6 Update 20 (x32 Version: 6.0.200)
Junk Mail filter update (x32 Version: 14.0.8117.416)
Lyrics Finder (x32)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access MUI (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (x32)
Microsoft Office Excel 2007 Help §ó·sµ{¦¡ (KB963678) (x32)
Microsoft Office Excel 2007 Help Actualización (KB963678) (x32)
Microsoft Office Excel MUI (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Business 2010 - Deutsch (x32 Version: 14.0.5130.5004)
Microsoft Office IME (Chinese (Traditional)) 2007 (Version: 12.0.6612.1000)
Microsoft Office IME (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook 2007 Help - Aggiornamento (KB963677) (x32)
Microsoft Office Outlook 2007 Help Actualización (KB963677) (x32)
Microsoft Office Outlook Connector (x32 Version: 12.0.6423.1000)
Microsoft Office Outlook MUI (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (x32)
Microsoft Office Powerpoint 2007 Help §ó·sµ{¦¡ (KB963669) (x32)
Microsoft Office Powerpoint 2007 Help Actualización (KB963669) (x32)
Microsoft Office PowerPoint MUI (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Professional Hybrid 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Arabic) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Basque) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Catalan) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Galician) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Portuguese (Brazil)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Russian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (Chinese (Traditional)) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (Dutch) 2007 (x32 Version: 12.0.4518.1017)
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (French) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (Greek) 2007 (x32 Version: 12.0.4518.1029)
Microsoft Office Proofing (Hebrew) 2007 (x32 Version: 12.0.4518.1016)
Microsoft Office Proofing (Italian) 2007 (x32 Version: 12.0.4518.1018)
Microsoft Office Proofing (Portuguese (Portugal)) 2007 (x32 Version: 12.0.4518.1029)
Microsoft Office Proofing (Spanish) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Publisher MUI (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (Chinese (Traditional)) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (Dutch) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (Greek) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (Hebrew) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (Portuguese (Portugal)) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (x32)
Microsoft Office Word 2007 Help §ó·sµ{¦¡ (KB963665) (x32)
Microsoft Office Word 2007 Help Actualización (KB963665) (x32)
Microsoft Office Word MUI (Chinese (Traditional)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (Dutch) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (Greek) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (Hebrew) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (Portuguese (Portugal)) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mise à jour Microsoft Office Excel 2007 Help  (KB963678) (x32)
Mise à jour Microsoft Office Outlook 2007 Help  (KB963677) (x32)
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669) (x32)
Mise à jour Microsoft Office Word 2007 Help  (KB963665) (x32)
Mozilla Firefox 21.0 (x86 de) (x32 Version: 21.0)
Mozilla Maintenance Service (x32 Version: 21.0)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
Nero 12 (x32 Version: 12.0.03400)
Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0)
Nero BackItUp (x32 Version: 12.0.6002)
Nero BackItUp Help (CHM) (x32 Version: 12.0.8000)
Nero Blu-ray Player (x32 Version: 12.0.17700)
Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.9000)
Nero Burning ROM (x32 Version: 12.0.28001)
Nero Burning ROM Help (CHM) (x32 Version: 12.0.3000)
Nero ControlCenter (x32 Version: 11.0.15500)
Nero ControlCenter Help (CHM) (x32 Version: 12.0.7000)
Nero Core Components (x32 Version: 11.0.18900)
Nero Disc Menus Basic (x32 Version: 12.0.11500)
Nero Effects Basic (x32 Version: 12.0.11500)
Nero Express (x32 Version: 12.0.28001)
Nero Express Help (CHM) (x32 Version: 12.0.5000)
Nero Kwik Media (x32 Version: 1.18.19600)
Nero Kwik Media Help (CHM) (x32 Version: 12.0.7000)
Nero Kwik Themes Basic (x32 Version: 12.0.11500)
Nero PiP Effects Basic (x32 Version: 12.0.11500)
Nero Recode (x32 Version: 12.0.31001)
Nero Recode Help (CHM) (x32 Version: 12.0.7000)
Nero RescueAgent (x32 Version: 12.0.10002)
Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000)
Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0)
Nero Update (x32 Version: 11.0.11800.31.0)
Nero Video (x32 Version: 12.0.8000)
Nero Video Help (CHM) (x32 Version: 12.0.7000)
Norton Security Scan (x32 Version: 3.5.1.8)
NVIDIA Drivers (Version: 1.9)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.16.11.8836)
òãëåï òáåø îñðï ãåàø äæáì ùì Microsoft Office Excel 2007 Help (KB963678) (x32)
òãëåï òáåø îñðï ãåàø äæáì ùì Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
òãëåï òáåø îñðï ãåàø äæáì ùì Microsoft Office Word 2007 Help (KB963665) (x32)
Open It! (x32 Version: 1.1.1)
Piggly (x32)
Prerequisite installer (x32 Version: 12.0.0003)
Qtrax Player (HKCU)
Realtek Ethernet Controller  Driver (x32 Version: 1.00.0008)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6010)
Skype™ 6.3 (x32 Version: 6.3.105)
Smileyville (x32)
SRS Premium Sound Control Panel (Version: 1.8.2900)
Trend Micro Internet Security (Version: 17.50)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Access 2007 Help (KB963663) (x32)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition (x32)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update for Microsoft Office Publisher 2007 Help (KB963667) (x32)
Update for Microsoft Office Script Editor Help (KB963671) (x32)
Update for Microsoft Office Word 2007 Help (KB963665) (x32)
Update for Zip Opener (HKCU)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Update voor Microsoft Office Excel 2007 Help (KB963678) (x32)
Update voor Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update voor Microsoft Office Word 2007 Help (KB963665) (x32)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0)
Wajam (x32 Version: 1.80)
Welcome App (Start-up experience) (x32 Version: 12.0.15000)
Wepoca.tv (x32 Version: 1.0)
Windows Live Call (x32 Version: 14.0.8117.0416)
Windows Live Communications Platform (x32 Version: 14.0.8117.416)
Windows Live Essentials (x32 Version: 14.0.8117.0416)
Windows Live Essentials (x32 Version: 14.0.8117.416)
Windows Live Family Safety (Version: 14.0.8118.427)
Windows Live Fotogalerie (x32 Version: 14.0.8117.416)
Windows Live ID-Anmelde-Assistent (Version: 6.500.3165.0)
Windows Live Mail (x32 Version: 14.0.8117.0416)
Windows Live Messenger (x32 Version: 14.0.8117.0416)
Windows Live Sync (x32 Version: 14.0.8117.416)
Windows Live Toolbar (x32 Version: 14.0.8117.416)
Windows Live Writer (x32 Version: 14.0.8117.0416)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
WinFlash (x32 Version: 2.29.0)
WinRAR (x32)
Wireless Console 3 (x32 Version: 3.0.14)
Zip Opener Packages (HKCU)
Zip Opener Packages 72 (HKCU)

==================== Restore Points  =========================

29-05-2013 14:56:32 Windows Update
02-06-2013 18:20:47 Windows Update
13-06-2013 20:45:31 Windows Update
23-06-2013 20:34:24 Windows Update
28-06-2013 15:12:26 Windows Modules Installer
28-06-2013 15:13:53 Windows Modules Installer

==================== Scheduled Tasks (whitelisted) =============

Task: {16207B3F-68F7-4542-9B69-084EC31A6F8E} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-01-30] (ATK)
Task: {2F45F3EC-4E8E-4C14-BB62-17C9372B4795} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {367A35BF-3F65-4723-8263-5D7B8E502349} - System32\Tasks\Lyrics Finder Update => C:\Program Files (x86)\LyricsFinder\LyricsFinderUpdater.exe [2013-02-27] (Nijad Software)
Task: {41198295-C0C3-4E84-8C61-66285240E527} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-13] (Google Inc.)
Task: {47AC99DF-433D-4702-989E-75AE45C177B2} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {482788CF-E0F8-4855-9DE7-D53AFD92BD1F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {49413D97-5508-48D4-A67B-93042F549238} - System32\Tasks\DealPly => C:\Users\Pierre\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE [2013-02-27] ()
Task: {4EA27CBE-C16C-4C67-9AF6-061FDE4869A2} - System32\Tasks\QtraxPlayer => C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe [2013-01-24] (Microsoft Corporation)
Task: {558A5952-36A2-447D-B750-FB6DB1D5270B} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)
Task: {565D17C9-8661-45BF-8426-4390658B1A6C} - System32\Tasks\EPUpdater => C:\Users\Pierre\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [2013-06-06] ()
Task: {567D7EF7-D9A5-410E-8FE0-EA79F4A03914} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {723C63DA-7F5D-4AE7-A743-4936964FDCCF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated)
Task: {810AC800-F9BC-4A04-A3A1-DA270068F23D} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001Core => C:\Users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-11] (Facebook Inc.)
Task: {89CAE066-742F-4C24-B79D-7B829CD49EC6} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK)
Task: {8CA042F0-3E04-4317-84D2-4033E5D1E096} - System32\Tasks\DealPlyUpdate => C:\Program No File
Task: {99F4CDD8-B093-49CD-B293-6FF6EA3F345C} - System32\Tasks\Norton Security Scan for Pierre => C:\PROGRA~2\NORTON~2\Engine\351~1.8\Nss.exe [2012-04-03] (Symantec Corporation)
Task: {9D83E73D-4012-4E25-9569-82FC09E89869} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {B694CAA3-52D8-4E46-9A4E-7FCB88F36DF8} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)
Task: {C1641A46-02E3-4479-AA6C-FBFDBD68C440} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe [2009-11-24] ()
Task: {C52D8F14-0E64-404B-A32E-8C6D765ECFE2} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001UA => C:\Users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-11] (Facebook Inc.)
Task: {D606D633-E2B5-4DF0-838D-617669E7F417} - System32\Tasks\WC3 => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2009-11-12] ()
Task: {E0C66FE7-AF14-4BFE-A3C9-06BD2E8C23F4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-13] (Google Inc.)
Task: {E1568063-E15C-4090-ABF7-4CE64A7E759C} - System32\Tasks\DSite => C:\Users\Pierre\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE [2013-06-30] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DSite.job => ?
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001Core.job => C:\Users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001UA.job => C:\Users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Lyrics Finder Update.job => C:\Program Files (x86)\LyricsFinder\LyricsFinderUpdater.exe
Task: C:\Windows\Tasks\Norton Security Scan for Pierre.job => C:\PROGRA~2\NORTON~2\Engine\351~1.8\Nss.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/30/2013 03:56:49 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c92c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000035aaf
ID des fehlerhaften Prozesses: 0x660
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (06/30/2013 02:47:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000273c1
ID des fehlerhaften Prozesses: 0x3f0
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (06/30/2013 02:45:47 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.


Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.
.

Error: (06/30/2013 02:30:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 10.0.9200.16611, Zeitstempel: 0x5191e7aa
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x4a801f90
ID des fehlerhaften Prozesses: 0x1970
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (06/28/2013 05:07:59 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x81000101).

Error: (06/23/2013 07:25:18 PM) (Source: Google Update) (User: Laptop)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (06/23/2013 07:25:05 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0062-0407-0000-0000000FF1CE}): DownloadLatest Failed:

Error: (06/23/2013 07:25:02 PM) (Source: Google Update) (User: Laptop)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (06/19/2013 07:56:38 PM) (Source: Google Update) (User: Laptop)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80

Error: (06/19/2013 04:07:06 PM) (Source: Google Update) (User: Laptop)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80


System errors:
=============
Error: (06/30/2013 03:59:49 PM) (Source: DCOM) (User: )
Description: 1084wuauserv{E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error: (06/30/2013 03:58:37 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
AFD
DfsC
discache
NetBIOS
NetBT
nsiproxy
Psched
rdbss
spldr
tdx
tmtdi
vwififlt
Wanarpv6
WfpLwf

Error: (06/30/2013 03:58:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Client Virtualization Handler" ist vom Dienst "Application Virtualization Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/30/2013 03:58:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/30/2013 03:58:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/30/2013 03:58:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/30/2013 03:58:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB-Miniredirector-Wrapper und -Modul" ist vom Dienst "Umgeleitetes Puffersubsystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%31

Error: (06/30/2013 03:58:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/30/2013 03:58:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Arbeitsstationsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/30/2013 03:58:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkspeicher-Schnittstellendienst" ist vom Dienst "NSI proxy service driver." abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%31


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 40%
Total physical RAM: 4095.27 MB
Available physical RAM: 2435.63 MB
Total Pagefile: 8188.72 MB
Available Pagefile: 6325.06 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:116.44 GB) (Free:42.72 GB) NTFS (Disk=0 Partition=2) ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:334.67 GB) (Free:334.2 GB) NTFS (Disk=0 Partition=3)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 76692CA8)
Partition 1: (Not Active) - (Size=15 GB) - (Type=1C)
Partition 2: (Active) - (Size=116 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=335 GB) - (Type=OF Extended)

==================== End Of Log ============================


erledigt !
__________________
Alt 01.07.2013, 07:25   #4
schrauber
/// the machine
/// TB-Ausbilder
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 01.07.2013, 16:08   #5
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Code:
ATTFilter
ComboFix 13-06-30.01 - Pierre 01.07.2013  16:33:48.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4095.2406 [GMT 2:00]
ausgeführt von:: c:\users\Pierre\Desktop\ComboFix.exe
AV: Trend Micro Internet Security *Disabled/Outdated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
SP: Trend Micro Internet Security *Disabled/Outdated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\DealPly
c:\program files (x86)\DealPly\DealPly.crx
c:\program files (x86)\DealPly\DealPly.xpi
c:\program files (x86)\DealPly\DealPlyIE.dll
c:\program files (x86)\DealPly\DealPlyIE64.dll
c:\program files (x86)\DealPly\DealPlyUpdate.exe
c:\program files (x86)\DealPly\DealPlyUpdateRun.exe
c:\program files (x86)\DealPly\DealPlyUpdateVer.exe
c:\program files (x86)\DealPly\icon.ico
c:\program files (x86)\DealPly\uninst.exe
c:\program files (x86)\LyricsFinder\lfINd.dll
c:\programdata\FullRemove.exe
c:\users\Pierre\AppData\Roaming\.#
c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-06-01 bis 2013-07-01  ))))))))))))))))))))))))))))))
.
.
2013-07-01 14:47 . 2013-07-01 14:47	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-06-30 19:29 . 2013-06-30 19:29	--------	d-----w-	C:\FRST
2013-06-30 19:25 . 2013-07-01 14:42	--------	d-----w-	c:\program files (x86)\LyricsFinder
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\users\Pierre\AppData\Roaming\Zip Opener Packages
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\program files (x86)\holasearch
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\users\Pierre\AppData\Roaming\BabSolution
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\users\Pierre\AppData\Roaming\holasearch
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\users\Pierre\AppData\Roaming\DealPly
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\users\Pierre\AppData\Local\Wajam
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\program files (x86)\Wajam
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\users\Pierre\AppData\Roaming\DSite
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\program files (x86)\OpenIt
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\users\Pierre\AppData\Roaming\Babylon
2013-06-30 19:24 . 2013-06-30 19:24	--------	d-----w-	c:\programdata\Babylon
2013-06-30 14:16 . 2013-06-30 14:16	--------	d-----w-	c:\users\Pierre\AppData\Roaming\Malwarebytes
2013-06-30 14:15 . 2013-06-30 14:15	--------	d-----w-	c:\programdata\Malwarebytes
2013-06-30 14:15 . 2013-06-30 14:15	--------	d-----w-	c:\users\Pierre\AppData\Local\Programs
2013-06-23 20:35 . 2013-06-08 12:28	2706432	----a-w-	c:\windows\system32\mshtml.tlb
2013-06-23 20:35 . 2013-06-08 11:13	2706432	----a-w-	c:\windows\SysWow64\mshtml.tlb
2013-06-23 20:35 . 2013-06-08 14:08	279040	----a-w-	c:\program files\Internet Explorer\sqmapi.dll
2013-06-23 20:35 . 2013-06-08 11:41	218112	----a-w-	c:\program files (x86)\Internet Explorer\sqmapi.dll
2013-06-23 20:35 . 2013-06-08 14:08	1365504	----a-w-	c:\windows\system32\urlmon.dll
2013-06-23 20:35 . 2013-06-08 14:06	2648064	----a-w-	c:\windows\system32\iertutil.dll
2013-06-23 20:35 . 2013-06-08 14:06	526336	----a-w-	c:\windows\system32\ieui.dll
2013-06-23 20:35 . 2013-06-08 14:06	15404544	----a-w-	c:\windows\system32\ieframe.dll
2013-06-23 20:34 . 2013-06-08 14:07	19233792	----a-w-	c:\windows\system32\mshtml.dll
2013-06-13 13:46 . 2013-06-13 13:46	893552	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-06-13 13:46 . 2013-06-13 13:46	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-06-13 13:43 . 2013-05-08 06:39	1910632	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-06-13 13:43 . 2013-04-26 05:51	751104	----a-w-	c:\windows\system32\win32spl.dll
2013-06-13 13:43 . 2013-04-26 04:55	492544	----a-w-	c:\windows\SysWow64\win32spl.dll
2013-06-13 13:43 . 2013-05-10 05:49	30720	----a-w-	c:\windows\system32\cryptdlg.dll
2013-06-13 13:43 . 2013-05-10 03:20	24576	----a-w-	c:\windows\SysWow64\cryptdlg.dll
2013-06-13 13:43 . 2013-04-17 07:02	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2013-06-13 13:43 . 2013-04-17 06:24	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2013-06-13 13:42 . 2013-05-13 05:51	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-06-13 13:42 . 2013-05-13 05:51	1464320	----a-w-	c:\windows\system32\crypt32.dll
2013-06-13 13:42 . 2013-05-13 05:51	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-06-13 13:42 . 2013-05-13 05:50	52224	----a-w-	c:\windows\system32\certenc.dll
2013-06-13 13:42 . 2013-05-13 04:45	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-06-13 13:42 . 2013-05-13 04:45	1160192	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-06-13 13:42 . 2013-05-13 04:45	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-06-13 13:42 . 2013-05-13 03:43	1192448	----a-w-	c:\windows\system32\certutil.exe
2013-06-13 13:42 . 2013-05-13 03:08	903168	----a-w-	c:\windows\SysWow64\certutil.exe
2013-06-13 13:42 . 2013-05-13 03:08	43008	----a-w-	c:\windows\SysWow64\certenc.dll
2013-06-13 13:42 . 2013-04-25 23:30	1505280	----a-w-	c:\windows\SysWow64\d3d11.dll
2013-06-13 13:42 . 2013-03-31 22:52	1887232	----a-w-	c:\windows\system32\d3d11.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-30 14:05 . 2011-12-27 19:10	45056	----a-w-	c:\windows\system32\acovcnt.exe
2013-06-24 14:49 . 2011-01-10 17:10	893552	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-06-24 14:49 . 2011-01-10 17:10	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-06-24 14:49 . 2011-01-10 17:10	1236816	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-06-13 20:47 . 2010-04-24 09:49	75825640	----a-w-	c:\windows\system32\MRT.exe
2013-06-11 20:28 . 2013-04-27 19:09	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-11 20:28 . 2011-10-13 18:31	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-10 15:25 . 2009-08-18 10:49	564632	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2013-05-10 15:25 . 2009-08-18 09:24	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-04-13 05:49 . 2013-05-15 12:45	135168	----a-w-	c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 12:45	350208	----a-w-	c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 12:45	308736	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 12:45	111104	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 12:45	474624	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 12:45	2176512	----a-w-	c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 15:24	1656680	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-15 12:45	265064	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-15 12:45	983400	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-15 12:44	3153920	----a-w-	c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2013-01-11 138096]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18642024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-27 6998656]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-20 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FancyStart daemon.lnk - c:\windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe -d [2010-3-13 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe;c:\program files\Trend Micro\Internet Security\TmProxy.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe;c:\program files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\SysWOW64\nvSCPAPISvr.exe;c:\windows\SysWOW64\nvSCPAPISvr.exe [x]
S2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys;c:\windows\SYSNATIVE\DRIVERS\tmpreflt.sys [x]
S2 WajamUpdater;WajamUpdater;c:\program files (x86)\Wajam\Updater\WajamUpdater.exe;c:\program files (x86)\Wajam\Updater\WajamUpdater.exe [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-23 20:25	1165776	----a-w-	c:\program files (x86)\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-27 20:28]
.
2013-06-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001Core.job
- c:\users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-11 15:02]
.
2013-06-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001UA.job
- c:\users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-01-11 15:02]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-13 14:00]
.
2013-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-13 14:00]
.
2013-07-01 c:\windows\Tasks\Lyrics Finder Update.job
- c:\program files (x86)\LyricsFinder\LyricsFinderUpdater.exe [2013-02-27 19:59]
.
2013-03-09 c:\windows\Tasks\Norton Security Scan for Pierre.job
- c:\progra~2\NORTON~2\Engine\351~1.8\Nss.exe [2011-12-03 00:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49	70656	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49	70656	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EeeStorageBackup"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2009-11-26 1732608]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-11 16414824]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-09-29 1022368]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\
FF - prefs.js: browser.search.selectedEngine - Hola Search
FF - prefs.js: browser.startup.homepage - hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929
FF - prefs.js: keyword.URL - hxxp://www.holasearch.com/?babsrc=SP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929&q=
FF - ExtSQL: 2013-05-02 21:21; {5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}; c:\program files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF - ExtSQL: 2013-06-30 21:24; ffxtlbr@holasearch.com; c:\users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\extensions\ffxtlbr@holasearch.com
FF - ExtSQL: 2013-06-30 21:25; lfind@nijadsoft.net; c:\program files (x86)\LyricsFinder\FF
FF - user.js: extensions.autoDisableScopes - 0 
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{398C01F1-E584-46AD-A649-4F78B435DCFE} - c:\program files (x86)\LyricsFinder\lfind.dll
BHO-{EF7BD87A-8024-11E2-F316-F3E56188709B} - c:\program files (x86)\DealPly\DealPlyIE.dll
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Setwallpaper - c:\programdata\SetWallpaper.cmd
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe /f=srs_premium_sound_nopreset.zip /h
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr
AddRemove-DealPly - c:\program files (x86)\DealPly\uninst.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-01  17:03:09
ComboFix-quarantined-files.txt  2013-07-01 15:03
.
Vor Suchlauf: 9 Verzeichnis(se), 49.444.200.448 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 52.525.047.808 Bytes frei
.
- - End Of File - - B162CDEC87BED7291DAF5839F6A636C0
5C616939100B85E558DA92B899A0FC36


erledigt


Alt 01.07.2013, 16:25   #6
schrauber
/// the machine
/// TB-Ausbilder
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST Logfile bitte.
__________________
--> BKA Trojaner endgültig entfernen

Alt 01.07.2013, 17:00   #7
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Code:
ATTFilter
# AdwCleaner v2.303 - Datei am 01/07/2013 um 17:54:05 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Pierre - LAPTOP
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Pierre\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : WajamUpdater

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\searchplugins\holasearch.xml
Ordner Gelöscht : C:\Program Files (x86)\holasearch
Ordner Gelöscht : C:\Program Files (x86)\Wajam
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Users\Pierre\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmfnfnpmhcllokmkepffndflpnadjmma
Ordner Gelöscht : C:\Users\Pierre\AppData\Local\Wajam
Ordner Gelöscht : C:\Users\Pierre\AppData\Roaming\BabSolution
Ordner Gelöscht : C:\Users\Pierre\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Pierre\AppData\Roaming\DealPly
Ordner Gelöscht : C:\Users\Pierre\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Pierre\AppData\Roaming\holasearch
Ordner Gelöscht : C:\Users\Pierre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
Ordner Gelöscht : C:\Users\Pierre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\DealPly
Schlüssel Gelöscht : HKCU\Software\holasearch
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Wajam
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\Software\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\priam_bho.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Schlüssel Gelöscht : HKLM\Software\DealPly
Schlüssel Gelöscht : HKLM\Software\holasearch
Schlüssel Gelöscht : HKLM\Software\Wajam
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{398C01F1-E584-46AD-A649-4F78B435DCFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C510DFFB-0AFE-484C-BA40-CED5B74C4EEF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DFF9B2DA-EF99-4B26-83CB-7058299999D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF7BD87A-8024-11E2-F316-F3E56188709B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gnbcopcndefcccgdofjadnafjljgofam
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{398C01F1-E584-46AD-A649-4F78B435DCFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DFF9B2DA-EF99-4B26-83CB-7058299999D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF7BD87A-8024-11E2-F316-F3E56188709B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Hola Chrome Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\holasearch
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\extensions [lfind@nijadsoft.net]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{C510DFFB-0AFE-484C-BA40-CED5B74C4EEF}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929 --> hxxp://www.google.com

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\prefs.js

C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.newtab.url", "hxxp://www.holasearch.com/?babsrc=NT_ss&mntrId=24EC1A4BD6A0C864&aff[...]
Gelöscht : user_pref("browser.startup.homepage", "hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C8[...]
Gelöscht : user_pref("extensions.enabledAddons", "%7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:2.6.0.201304180728[...]
Gelöscht : user_pref("extensions.holasearch.bbDpng", "1");
Gelöscht : user_pref("extensions.holasearch.cntry", "DE");
Gelöscht : user_pref("extensions.holasearch.hdrMd5", "");
Gelöscht : user_pref("extensions.holasearch.kwURLOld", "");
Gelöscht : user_pref("extensions.holasearch.lastVrsnTs", "");
Gelöscht : user_pref("extensions.holasearch.sg", "er");
Gelöscht : user_pref("extensions.holasearch.smplGrp", "er");
Gelöscht : user_pref("keyword.URL", "hxxp://www.holasearch.com/?babsrc=SP_ss&mntrId=24EC1A4BD6A0C864&affID=1193[...]

-\\ Google Chrome v27.0.1453.116

Datei : C:\Users\Pierre\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.104] : urls_to_restore_on_startup ="session" : {"restore_on_startup": 4,  [ "hxxp://www.holasearch.com/[...]

*************************

AdwCleaner[S1].txt - [8092 octets] - [01/07/2013 17:54:05]

########## EOF - C:\AdwCleaner[S1].txt - [8152 octets] ##########
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Pierre on 01.07.2013 at 18:02:16,66
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Pierre\AppData\Roaming\mozilla\firefox\profiles\5o3qd4x0.default\prefs.js

user_pref("browser.startup.homepage", "hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929");
user_pref("keyword.URL", "hxxp://www.holasearch.com/?babsrc=SP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929&q=");
Emptied folder: C:\Users\Pierre\AppData\Roaming\mozilla\firefox\profiles\5o3qd4x0.default\minidumps [31 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.07.2013 at 18:07:30,24
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Pierre on 01.07.2013 at 18:02:16,66
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Pierre\AppData\Roaming\mozilla\firefox\profiles\5o3qd4x0.default\prefs.js

user_pref("browser.startup.homepage", "hxxp://www.holasearch.com/?babsrc=HP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929");
user_pref("keyword.URL", "hxxp://www.holasearch.com/?babsrc=SP_ss&mntrId=24EC1A4BD6A0C864&affID=119357&tt=300613_hol&tsp=4929&q=");
Emptied folder: C:\Users\Pierre\AppData\Roaming\mozilla\firefox\profiles\5o3qd4x0.default\minidumps [31 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.07.2013 at 18:07:30,24
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-06-2013 01
Ran by Pierre (administrator) on 01-07-2013 18:11:48
Running from C:\Users\Pierre\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
() C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(NVIDIA Corporation) C:\Windows\SysWOW64\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
() C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EeeStorageBackup] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe MySyncFolder [1732608 2009-11-26] ()
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [16414824 2009-12-11] (NVIDIA Corporation)
HKLM\...\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe [621440 2009-09-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-02] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [1022368 2009-09-29] (Trend Micro Inc.)
HKCU\...\Run: [Facebook Update] "C:\Users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2013-01-11] (Facebook Inc.)
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [6998656 2009-10-27] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2009-08-20] (ASUS)
HKLM-x32\...\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
Startup: C:\ProgramData\Start Menu\Programs\Startup\FancyStart daemon.lnk
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default
FF SearchEngine: Hola Search
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Pierre\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Extension: No Name - C:\Users\Pierre\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: HolaSearch - C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\Extensions\ffxtlbr@holasearch.com
FF Extension: Yahoo! Toolbar - C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

Chrome: 
=======

==================== Services (Whitelisted) =================

R2 OberonGameConsoleService; C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
S2 SfCtlCom; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [838528 2009-09-29] (Trend Micro Inc.)
R2 Stereo Service; C:\Windows\SysWOW64\nvSCPAPISvr.exe [239208 2009-12-11] (NVIDIA Corporation)
S3 TMBMServer; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [570632 2009-09-29] (Trend Micro Inc.)
S3 TmProxy; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [917768 2009-09-29] (Trend Micro Inc.)

==================== Drivers (Whitelisted) ====================

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-08-12] ()
R2 tmpreflt; C:\Windows\System32\DRIVERS\tmpreflt.sys [42000 2009-12-04] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [107536 2009-09-29] (Trend Micro Inc.)
R2 tmxpflt; C:\Windows\System32\DRIVERS\tmxpflt.sys [265744 2009-12-04] (Trend Micro Inc.)
R2 vsapint; C:\Windows\System32\DRIVERS\vsapint.sys [2007056 2009-12-04] (Trend Micro Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U3 tmlwf; 
U3 tmwfp; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-01 18:07 - 2013-07-01 18:07 - 00001161 ____A C:\Users\Pierre\Desktop\JRT.txt
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\JRT
2013-07-01 18:01 - 2013-07-01 18:01 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pierre\Desktop\JRT.exe
2013-07-01 17:54 - 2013-07-01 17:54 - 00008217 ____A C:\AdwCleaner[S1].txt
2013-07-01 17:52 - 2013-07-01 17:52 - 00648201 ____A C:\Users\Pierre\Desktop\adwcleaner.exe
2013-07-01 17:51 - 2013-07-01 17:51 - 00016674 ____A C:\Users\Pierre\Desktop\EPjU+lLQ.htm
2013-07-01 17:03 - 2013-07-01 17:03 - 00022380 ____A C:\ComboFix.txt
2013-07-01 16:31 - 2013-07-01 17:04 - 00000000 ____D C:\Qoobox
2013-07-01 16:31 - 2013-07-01 17:04 - 00000000 ____D C:\ComboFix
2013-07-01 16:31 - 2013-07-01 16:58 - 00000000 ____D C:\Windows\erdnt
2013-07-01 16:31 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-01 16:31 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-01 16:31 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-01 16:29 - 2013-07-01 16:29 - 05084517 ____R (Swearware) C:\Users\Pierre\Desktop\ComboFix.exe
2013-07-01 16:24 - 2013-07-01 16:24 - 00000005 ____A C:\Users\Pierre\AppData\Roaming\WBPU-TTL.DAT
2013-06-30 21:32 - 2013-06-30 21:42 - 00034975 ____A C:\Users\Pierre\Downloads\Addition.txt
2013-06-30 21:29 - 2013-06-30 21:29 - 00000000 ____D C:\FRST
2013-06-30 21:28 - 2013-06-30 21:28 - 01933594 ____A (Farbar) C:\Users\Pierre\Downloads\FRST64.exe
2013-06-30 21:25 - 2013-07-01 17:55 - 00000414 ____A C:\Windows\Tasks\Lyrics Finder Update.job
2013-06-30 21:25 - 2013-07-01 16:42 - 00000000 ____D C:\Program Files (x86)\LyricsFinder
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Zip Opener Packages
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-06-30 21:23 - 2013-06-30 21:23 - 00793536 ____A C:\Users\Pierre\Downloads\ZipOpenerSetup.exe
2013-06-30 19:15 - 2013-06-30 19:15 - 00112922 ____A C:\Users\Pierre\Desktop\Extras.Txt
2013-06-30 19:13 - 2013-06-30 19:17 - 00093102 ____A C:\Users\Pierre\Desktop\OTL.Txt
2013-06-30 16:16 - 2013-06-30 16:16 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-30 16:14 - 2013-06-30 16:14 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Pierre\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-23 22:35 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-23 22:35 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-23 22:35 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-23 22:35 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-23 22:34 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-23 22:34 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 22:47 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 22:47 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 22:47 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 22:47 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 22:47 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-13 15:43 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 15:43 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 15:43 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 15:43 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 15:43 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 15:43 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-13 15:43 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 15:42 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 15:42 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 15:42 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 15:42 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 15:42 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-13 15:42 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

==================== One Month Modified Files and Folders =======

2013-07-01 18:07 - 2013-07-01 18:07 - 00001161 ____A C:\Users\Pierre\Desktop\JRT.txt
2013-07-01 18:04 - 2010-03-13 15:26 - 01351388 ____A C:\Windows\WindowsUpdate.log
2013-07-01 18:03 - 2009-07-14 06:45 - 00010240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-01 18:03 - 2009-07-14 06:45 - 00010240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\JRT
2013-07-01 18:01 - 2013-07-01 18:01 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pierre\Desktop\JRT.exe
2013-07-01 18:01 - 2012-11-18 11:43 - 00000027 ____A C:\Windows\System32\Drivers\etc\tmvsthfud.bin
2013-07-01 18:01 - 2010-03-13 16:32 - 00000027 ____A C:\Windows\System32\Drivers\etc\tmvsthfss.bin
2013-07-01 17:55 - 2013-06-30 21:25 - 00000414 ____A C:\Windows\Tasks\Lyrics Finder Update.job
2013-07-01 17:55 - 2010-03-13 16:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-01 17:55 - 2010-03-13 16:00 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-01 17:55 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-01 17:55 - 2009-07-14 06:51 - 00114842 ____A C:\Windows\setupact.log
2013-07-01 17:54 - 2013-07-01 17:54 - 00008217 ____A C:\AdwCleaner[S1].txt
2013-07-01 17:52 - 2013-07-01 17:52 - 00648201 ____A C:\Users\Pierre\Desktop\adwcleaner.exe
2013-07-01 17:51 - 2013-07-01 17:51 - 00016674 ____A C:\Users\Pierre\Desktop\EPjU+lLQ.htm
2013-07-01 17:28 - 2013-04-27 21:09 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-01 17:25 - 2010-03-13 16:00 - 00001124 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-01 17:10 - 2011-12-27 21:10 - 00045056 ____A C:\Windows\System32\acovcnt.exe
2013-07-01 17:09 - 2010-03-13 16:26 - 00020972 ____A C:\Windows\PFRO.log
2013-07-01 17:04 - 2013-07-01 16:31 - 00000000 ____D C:\Qoobox
2013-07-01 17:04 - 2013-07-01 16:31 - 00000000 ____D C:\ComboFix
2013-07-01 17:03 - 2013-07-01 17:03 - 00022380 ____A C:\ComboFix.txt
2013-07-01 17:00 - 2013-01-23 21:41 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Skype
2013-07-01 16:58 - 2013-07-01 16:31 - 00000000 ____D C:\Windows\erdnt
2013-07-01 16:48 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-01 16:42 - 2013-06-30 21:25 - 00000000 ____D C:\Program Files (x86)\LyricsFinder
2013-07-01 16:29 - 2013-07-01 16:29 - 05084517 ____R (Swearware) C:\Users\Pierre\Desktop\ComboFix.exe
2013-07-01 16:24 - 2013-07-01 16:24 - 00000005 ____A C:\Users\Pierre\AppData\Roaming\WBPU-TTL.DAT
2013-07-01 16:19 - 2010-04-29 19:50 - 00000000 ____D C:\Users\Pierre\Tracing
2013-07-01 16:19 - 2010-03-13 16:30 - 00001343 ____A C:\Windows\System32\ServiceFilter.ini
2013-06-30 21:58 - 2011-02-25 15:07 - 00000000 ___HD C:\Program Files (x86)\InstallJammer Registry
2013-06-30 21:56 - 2013-03-04 18:34 - 00000000 ____D C:\ProgramData\Nero
2013-06-30 21:48 - 2013-05-21 13:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-30 21:46 - 2010-05-21 21:01 - 00000000 ____D C:\Program Files (x86)\Full Tilt Poker
2013-06-30 21:42 - 2013-06-30 21:32 - 00034975 ____A C:\Users\Pierre\Downloads\Addition.txt
2013-06-30 21:40 - 2011-08-18 13:23 - 00000000 ____D C:\Users\Pierre\Desktop\musikkkeee
2013-06-30 21:40 - 2011-04-26 17:24 - 00000000 ____D C:\Users\Pierre\Desktop\huih
2013-06-30 21:29 - 2013-06-30 21:29 - 00000000 ____D C:\FRST
2013-06-30 21:28 - 2013-06-30 21:28 - 01933594 ____A (Farbar) C:\Users\Pierre\Downloads\FRST64.exe
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Zip Opener Packages
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-06-30 21:23 - 2013-06-30 21:23 - 00793536 ____A C:\Users\Pierre\Downloads\ZipOpenerSetup.exe
2013-06-30 19:17 - 2013-06-30 19:13 - 00093102 ____A C:\Users\Pierre\Desktop\OTL.Txt
2013-06-30 19:15 - 2013-06-30 19:15 - 00112922 ____A C:\Users\Pierre\Desktop\Extras.Txt
2013-06-30 19:07 - 2013-01-11 17:02 - 00000932 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001UA.job
2013-06-30 16:16 - 2013-06-30 16:16 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-30 16:14 - 2013-06-30 16:14 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Pierre\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-30 16:07 - 2013-01-11 17:02 - 00000910 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001Core.job
2013-06-30 16:05 - 2010-04-24 10:49 - 00000000 ____D C:\users\Pierre
2013-06-30 16:03 - 2011-05-01 21:15 - 00000000 ____D C:\ProgramData\Norton
2013-06-30 16:03 - 2010-03-13 16:30 - 00000000 ____D C:\ProgramData\P4G
2013-06-30 16:03 - 2009-07-14 09:44 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-06-30 16:03 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-06-28 17:10 - 2010-11-26 15:53 - 01522246 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-28 17:10 - 2009-08-04 11:51 - 00654844 ____A C:\Windows\System32\perfh007.dat
2013-06-28 17:10 - 2009-08-04 11:51 - 00130426 ____A C:\Windows\System32\perfc007.dat
2013-06-23 21:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-13 22:50 - 2010-03-13 15:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-13 22:47 - 2010-04-24 11:49 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 15:59 - 2010-06-24 22:06 - 00003584 ____A C:\Users\Pierre\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-11 22:28 - 2013-04-27 21:09 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 22:28 - 2011-10-13 20:31 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-08 16:08 - 2013-06-23 22:35 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-23 22:34 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-23 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-23 22:35 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:40 - 2013-06-23 22:34 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:13 - 2013-06-23 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-08 12:22 - 2012-09-02 15:20 - 00000000 ____D C:\Users\Pierre\Desktop\Grafiken !
2013-06-02 21:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-02 20:33 - 2013-05-29 16:57 - 00015366 ____A C:\Windows\IE10_main.log
2013-06-02 20:26 - 2013-06-02 20:26 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

Files to move or delete:
====================
C:\Users\Pierre\Firefox Setup 3.6.3.exe
C:\Users\Pierre\wlsetup-custom.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-04-24 21:26

==================== End Of Log ============================
--- --- ---

--- --- ---

Alt 01.07.2013, 19:07   #8
schrauber
/// the machine
/// TB-Ausbilder
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Viel besser


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST Log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.07.2013, 08:02   #9
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b955a81264f497428b86449ebb3b8e58
# engine=14224
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-02 06:54:20
# local_time=2013-07-02 08:54:20 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=513 16777085 100 97 44981 208533950 0 0
# compatibility_mode=5893 16776574 66 85 30762773 124377910 0 0
# scanned=187780
# found=7
# cleaned=0
# scan_time=44393
sh=5B2498D6F7DF1CB34FE61344403B1C51C7FAC205 ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.F application" ac=I fn="C:\Program Files (x86)\LyricsFinder\chrome.crx"
sh=702D7C53508A8FAB03A3B51E8C305660ED1A4517 ft=1 fh=e8fad039ffdbfdf3 vn="a variant of Win32/Adware.AddLyrics.B application" ac=I fn="C:\Program Files (x86)\LyricsFinder\LyricsFinderUpdater.exe"
sh=A2A3EAEF2995CE77A7368DC747688B191E0EFC2E ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.F application" ac=I fn="C:\Program Files (x86)\LyricsFinder\FF\chrome\content\main.js"
sh=CD0C14B2DA1B0F8553DD54545687FE2F28774962 ft=0 fh=0000000000000000 vn="JS/Exploit.Pdfka.PDM.Gen trojan" ac=I fn="C:\Users\Pierre\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\82KKVY3H\810e3[1].pdf"
sh=6A354F859F5319D7780C79E5B40AE982892A277D ft=0 fh=0000000000000000 vn="HTML/Iframe.B.Gen virus" ac=I fn="C:\Users\Pierre\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U8P3AMFA\click[1].htm"
sh=82A4033674CAA6046AE79EC3A4E824E4E8260FFF ft=0 fh=0000000000000000 vn="JS/Kryptik.CH trojan" ac=I fn="C:\Users\Pierre\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZIP8MS3P\forum[1].htm"
sh=BB61A3022F892EF3FA7DE50808B955D02F05445B ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Pierre\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\62139965-2f443ec0"

Alt 02.07.2013, 08:06   #10
schrauber
/// the machine
/// TB-Ausbilder
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


und weiter
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.07.2013, 08:12   #11
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Beim Security Check steht leider das da !

unsupported operating system aborting now

was kann ich tun ?

Alt 02.07.2013, 09:21   #12
schrauber
/// the machine
/// TB-Ausbilder
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Ignorier das . Poste ein frisches FRST log. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.07.2013, 19:49   #13
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Habs nochmal probiert und es hat geklappt

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.68  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Trend Micro Internet Security   
 Antivirus out of date!  
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 11.7.700.224  
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox 21.0 Firefox out of Date!  
 Google Chrome 27.0.1453.110  
 Google Chrome 27.0.1453.116  
````````Process Check: objlist.exe by Laurent````````  
 Trend Micro Internet Security SfCtlCom.exe  
 Trend Micro Internet Security UfSeAgnt.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST :


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-06-2013 01
Ran by Pierre (administrator) on 02-07-2013 20:47:34
Running from C:\Users\Pierre\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
() C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
() C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(NVIDIA Corporation) C:\Windows\SysWOW64\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\BM\TMBMSRV.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EeeStorageBackup] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe MySyncFolder [1732608 2009-11-26] ()
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [16414824 2009-12-11] (NVIDIA Corporation)
HKLM\...\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe [621440 2009-09-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-02] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [1022368 2009-09-29] (Trend Micro Inc.)
HKCU\...\Run: [Facebook Update] "C:\Users\Pierre\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2013-01-11] (Facebook Inc.)
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [6998656 2009-10-27] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2009-08-20] (ASUS)
HKLM-x32\...\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
Startup: C:\ProgramData\Start Menu\Programs\Startup\FancyStart daemon.lnk
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default
FF SearchEngine: Hola Search
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Pierre\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Extension: No Name - C:\Users\Pierre\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: HolaSearch - C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\Extensions\ffxtlbr@holasearch.com
FF Extension: Yahoo! Toolbar - C:\Users\Pierre\AppData\Roaming\Mozilla\Firefox\Profiles\5o3qd4x0.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

Chrome: 
=======

==================== Services (Whitelisted) =================

R2 OberonGameConsoleService; C:\Program Files (x86)\Asus\Game Park\GameConsole\OberonGameConsoleService.exe [44312 2009-09-15] ()
R2 SfCtlCom; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [838528 2009-09-29] (Trend Micro Inc.)
R2 Stereo Service; C:\Windows\SysWOW64\nvSCPAPISvr.exe [239208 2009-12-11] (NVIDIA Corporation)
R3 TMBMServer; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [570632 2009-09-29] (Trend Micro Inc.)
R3 TmProxy; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [917768 2009-09-29] (Trend Micro Inc.)

==================== Drivers (Whitelisted) ====================

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-08-12] ()
R2 tmpreflt; C:\Windows\System32\DRIVERS\tmpreflt.sys [42000 2009-12-04] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [107536 2009-09-29] (Trend Micro Inc.)
R2 tmxpflt; C:\Windows\System32\DRIVERS\tmxpflt.sys [265744 2009-12-04] (Trend Micro Inc.)
R2 vsapint; C:\Windows\System32\DRIVERS\vsapint.sys [2007056 2009-12-04] (Trend Micro Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U3 tmlwf; 
U3 tmwfp; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-02 09:06 - 2013-07-02 09:07 - 00890988 ____A C:\Users\Pierre\Desktop\SecurityCheck.exe
2013-07-01 20:32 - 2013-07-01 20:32 - 02347384 ____A (ESET) C:\Users\Pierre\Desktop\esetsmartinstaller_enu.exe
2013-07-01 18:07 - 2013-07-01 18:07 - 00001161 ____A C:\Users\Pierre\Desktop\JRT.txt
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\JRT
2013-07-01 18:01 - 2013-07-01 18:01 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pierre\Desktop\JRT.exe
2013-07-01 17:54 - 2013-07-01 17:54 - 00008217 ____A C:\AdwCleaner[S1].txt
2013-07-01 17:52 - 2013-07-01 17:52 - 00648201 ____A C:\Users\Pierre\Desktop\adwcleaner.exe
2013-07-01 17:03 - 2013-07-01 17:03 - 00022380 ____A C:\ComboFix.txt
2013-07-01 16:31 - 2013-07-01 17:04 - 00000000 ____D C:\Qoobox
2013-07-01 16:31 - 2013-07-01 17:04 - 00000000 ____D C:\ComboFix
2013-07-01 16:31 - 2013-07-01 16:58 - 00000000 ____D C:\Windows\erdnt
2013-07-01 16:31 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-01 16:31 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-01 16:31 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-01 16:31 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-01 16:29 - 2013-07-01 16:29 - 05084517 ____R (Swearware) C:\Users\Pierre\Desktop\ComboFix.exe
2013-07-01 16:24 - 2013-07-01 16:24 - 00000005 ____A C:\Users\Pierre\AppData\Roaming\WBPU-TTL.DAT
2013-06-30 21:32 - 2013-06-30 21:42 - 00034975 ____A C:\Users\Pierre\Downloads\Addition.txt
2013-06-30 21:29 - 2013-06-30 21:29 - 00000000 ____D C:\FRST
2013-06-30 21:28 - 2013-06-30 21:28 - 01933594 ____A (Farbar) C:\Users\Pierre\Downloads\FRST64.exe
2013-06-30 21:25 - 2013-07-02 20:36 - 00000414 ____A C:\Windows\Tasks\Lyrics Finder Update.job
2013-06-30 21:25 - 2013-07-01 16:42 - 00000000 ____D C:\Program Files (x86)\LyricsFinder
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Zip Opener Packages
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-06-30 21:23 - 2013-06-30 21:23 - 00793536 ____A C:\Users\Pierre\Downloads\ZipOpenerSetup.exe
2013-06-30 19:15 - 2013-06-30 19:15 - 00112922 ____A C:\Users\Pierre\Desktop\Extras.Txt
2013-06-30 19:13 - 2013-06-30 19:17 - 00093102 ____A C:\Users\Pierre\Desktop\OTL.Txt
2013-06-30 16:16 - 2013-06-30 16:16 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-30 16:14 - 2013-06-30 16:14 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Pierre\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-23 22:35 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-23 22:35 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-23 22:35 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-23 22:35 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-23 22:35 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-23 22:35 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-23 22:34 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-23 22:34 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 22:47 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 22:47 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 22:47 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 22:47 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 22:47 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 22:47 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 22:47 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-13 15:43 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 15:43 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 15:43 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 15:43 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 15:43 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 15:43 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-13 15:43 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 15:42 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 15:42 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 15:42 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 15:42 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 15:42 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 15:42 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 15:42 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-13 15:42 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

==================== One Month Modified Files and Folders =======

2013-07-02 20:48 - 2012-11-18 11:43 - 00000027 ____A C:\Windows\System32\Drivers\etc\tmvsthfud.bin
2013-07-02 20:47 - 2010-03-13 16:32 - 00000027 ____A C:\Windows\System32\Drivers\etc\tmvsthfss.bin
2013-07-02 20:44 - 2009-07-14 06:45 - 00010240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-02 20:44 - 2009-07-14 06:45 - 00010240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-02 20:42 - 2010-03-13 15:26 - 01383473 ____A C:\Windows\WindowsUpdate.log
2013-07-02 20:36 - 2013-06-30 21:25 - 00000414 ____A C:\Windows\Tasks\Lyrics Finder Update.job
2013-07-02 20:36 - 2010-03-13 16:26 - 00021790 ____A C:\Windows\PFRO.log
2013-07-02 20:36 - 2010-03-13 16:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-02 20:36 - 2010-03-13 16:00 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-02 20:36 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-02 20:36 - 2009-07-14 06:51 - 00114898 ____A C:\Windows\setupact.log
2013-07-02 09:40 - 2013-01-23 21:41 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Skype
2013-07-02 09:28 - 2013-04-27 21:09 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-02 09:25 - 2010-03-13 16:00 - 00001124 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-02 09:07 - 2013-07-02 09:06 - 00890988 ____A C:\Users\Pierre\Desktop\SecurityCheck.exe
2013-07-02 08:38 - 2013-01-11 17:02 - 00000932 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001UA.job
2013-07-01 20:32 - 2013-07-01 20:32 - 02347384 ____A (ESET) C:\Users\Pierre\Desktop\esetsmartinstaller_enu.exe
2013-07-01 20:28 - 2010-11-26 15:53 - 01500254 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-01 20:28 - 2009-08-04 11:51 - 00654844 ____A C:\Windows\System32\perfh007.dat
2013-07-01 20:28 - 2009-08-04 11:51 - 00130426 ____A C:\Windows\System32\perfc007.dat
2013-07-01 18:07 - 2013-07-01 18:07 - 00001161 ____A C:\Users\Pierre\Desktop\JRT.txt
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-07-01 18:02 - 2013-07-01 18:02 - 00000000 ____D C:\JRT
2013-07-01 18:01 - 2013-07-01 18:01 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pierre\Desktop\JRT.exe
2013-07-01 17:54 - 2013-07-01 17:54 - 00008217 ____A C:\AdwCleaner[S1].txt
2013-07-01 17:52 - 2013-07-01 17:52 - 00648201 ____A C:\Users\Pierre\Desktop\adwcleaner.exe
2013-07-01 17:10 - 2011-12-27 21:10 - 00045056 ____A C:\Windows\System32\acovcnt.exe
2013-07-01 17:04 - 2013-07-01 16:31 - 00000000 ____D C:\Qoobox
2013-07-01 17:04 - 2013-07-01 16:31 - 00000000 ____D C:\ComboFix
2013-07-01 17:03 - 2013-07-01 17:03 - 00022380 ____A C:\ComboFix.txt
2013-07-01 16:58 - 2013-07-01 16:31 - 00000000 ____D C:\Windows\erdnt
2013-07-01 16:48 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-01 16:42 - 2013-06-30 21:25 - 00000000 ____D C:\Program Files (x86)\LyricsFinder
2013-07-01 16:29 - 2013-07-01 16:29 - 05084517 ____R (Swearware) C:\Users\Pierre\Desktop\ComboFix.exe
2013-07-01 16:24 - 2013-07-01 16:24 - 00000005 ____A C:\Users\Pierre\AppData\Roaming\WBPU-TTL.DAT
2013-07-01 16:19 - 2010-04-29 19:50 - 00000000 ____D C:\Users\Pierre\Tracing
2013-07-01 16:19 - 2010-03-13 16:30 - 00001343 ____A C:\Windows\System32\ServiceFilter.ini
2013-06-30 21:58 - 2011-02-25 15:07 - 00000000 ___HD C:\Program Files (x86)\InstallJammer Registry
2013-06-30 21:56 - 2013-03-04 18:34 - 00000000 ____D C:\ProgramData\Nero
2013-06-30 21:48 - 2013-05-21 13:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-30 21:46 - 2010-05-21 21:01 - 00000000 ____D C:\Program Files (x86)\Full Tilt Poker
2013-06-30 21:42 - 2013-06-30 21:32 - 00034975 ____A C:\Users\Pierre\Downloads\Addition.txt
2013-06-30 21:40 - 2011-08-18 13:23 - 00000000 ____D C:\Users\Pierre\Desktop\musikkkeee
2013-06-30 21:40 - 2011-04-26 17:24 - 00000000 ____D C:\Users\Pierre\Desktop\huih
2013-06-30 21:29 - 2013-06-30 21:29 - 00000000 ____D C:\FRST
2013-06-30 21:28 - 2013-06-30 21:28 - 01933594 ____A (Farbar) C:\Users\Pierre\Downloads\FRST64.exe
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Zip Opener Packages
2013-06-30 21:24 - 2013-06-30 21:24 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-06-30 21:23 - 2013-06-30 21:23 - 00793536 ____A C:\Users\Pierre\Downloads\ZipOpenerSetup.exe
2013-06-30 19:17 - 2013-06-30 19:13 - 00093102 ____A C:\Users\Pierre\Desktop\OTL.Txt
2013-06-30 19:15 - 2013-06-30 19:15 - 00112922 ____A C:\Users\Pierre\Desktop\Extras.Txt
2013-06-30 16:16 - 2013-06-30 16:16 - 00000000 ____D C:\Users\Pierre\AppData\Roaming\Malwarebytes
2013-06-30 16:15 - 2013-06-30 16:15 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-30 16:14 - 2013-06-30 16:14 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\Pierre\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-30 16:07 - 2013-01-11 17:02 - 00000910 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2056929008-2633675077-707004732-1001Core.job
2013-06-30 16:05 - 2010-04-24 10:49 - 00000000 ____D C:\users\Pierre
2013-06-30 16:03 - 2011-05-01 21:15 - 00000000 ____D C:\ProgramData\Norton
2013-06-30 16:03 - 2010-03-13 16:30 - 00000000 ____D C:\ProgramData\P4G
2013-06-30 16:03 - 2009-07-14 09:44 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-06-30 16:03 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-06-23 21:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-13 22:50 - 2010-03-13 15:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-13 22:47 - 2010-04-24 11:49 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 15:59 - 2010-06-24 22:06 - 00003584 ____A C:\Users\Pierre\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-11 22:28 - 2013-04-27 21:09 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 22:28 - 2011-10-13 20:31 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-08 16:08 - 2013-06-23 22:35 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-23 22:34 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-23 22:35 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-23 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-23 22:35 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-23 22:35 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:40 - 2013-06-23 22:34 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:13 - 2013-06-23 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-08 12:22 - 2012-09-02 15:20 - 00000000 ____D C:\Users\Pierre\Desktop\Grafiken !
2013-06-02 21:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-02 20:33 - 2013-05-29 16:57 - 00015366 ____A C:\Windows\IE10_main.log
2013-06-02 20:26 - 2013-06-02 20:26 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-02 20:26 - 2013-06-02 20:26 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-02 20:26 - 2013-06-02 20:26 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-02 20:26 - 2013-06-02 20:26 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-02 20:26 - 2013-06-02 20:26 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-02 20:26 - 2013-06-02 20:26 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

Files to move or delete:
====================
C:\Users\Pierre\Firefox Setup 3.6.3.exe
C:\Users\Pierre\wlsetup-custom.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-04-24 21:26

==================== End Of Log ============================
--- --- ---
Alt 03.07.2013, 07:30   #14
schrauber
/// the machine
/// TB-Ausbilder
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Adobe und Firefox updaten.

Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
ATTFilter
U3 tmlwf; 
U3 tmwfp; 
2013-06-30 21:25 - 2013-07-02 20:36 - 00000414 ____A C:\Windows\Tasks\Lyrics Finder Update.job
2013-06-30 21:25 - 2013-07-01 16:42 - 00000000 ____D C:\Program Files (x86)\LyricsFinder
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.


Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.07.2013, 18:07   #15
unnützz
 
BKA Trojaner endgültig entfernen - Standard

BKA Trojaner endgültig entfernen


Hmm leider steht das bei mir =

the fixlist should be made and saved in the same diretory the tool is located

was habe ich flasch gemacht ?

Antwort
Seite 1 von 2 1 2

Themen zu BKA Trojaner endgültig entfernen
administrator, anti, anti-malware, autostart, bka trojaner endgültig entfernen, bösartige, entfernen, ergebnisse, explorer, html/iframe.b.gen, js/exploit.pdfka.pdm.gen, js/kryptik.ch, laptop, malware, modus, registrierung, schonmal, service, trojaner, update, version, verzeichnisse, win32/adware.addlyrics.b, win32/adware.addlyrics.f, zugreifen


« Weißer Bildschirm | 7 Infizierte dateien von Malwarebytes gefunden »


Ähnliche Themen: BKA Trojaner endgültig entfernen


  1. Windows 7 SP 1 Malware endgültig entfernen
    Log-Analyse und Auswertung - 18.11.2014 (7)
  2. PUP.Optional.InstallCore.A endgültig entfernen
    Log-Analyse und Auswertung - 10.10.2014 (7)
  3. Pup.Optional.Conduit.A endgültig entfernen.
    Log-Analyse und Auswertung - 17.11.2013 (6)
  4. GVU Trojaner endgültig entfernen
    Log-Analyse und Auswertung - 24.07.2013 (12)
  5. FBdownloader lässt sich nicht endgültig entfernen (Reste in Chrome sichtbar)
    Plagegeister aller Art und deren Bekämpfung - 24.06.2013 (11)
  6. System Care Antivirus auf Laptop -Windows 7- endgültig entfernen!
    Log-Analyse und Auswertung - 26.05.2013 (17)
  7. Trojaner endgültig entfernen
    Plagegeister aller Art und deren Bekämpfung - 23.01.2013 (9)
  8. Bundestrojaner endgültig entfernen?
    Log-Analyse und Auswertung - 19.01.2013 (6)
  9. System Progressive Protection endgültig entfernen
    Plagegeister aller Art und deren Bekämpfung - 08.12.2012 (43)
  10. Ransom Trojaner endgültig entfernen
    Plagegeister aller Art und deren Bekämpfung - 11.11.2012 (8)
  11. Bundestrojaner sicher und endgültig entfernen
    Plagegeister aller Art und deren Bekämpfung - 02.09.2012 (19)
  12. GVU-Trojaner WEbcam /Trojan.Ransom.Gen sicher und endgültig entfernen?
    Plagegeister aller Art und deren Bekämpfung - 15.08.2012 (18)
  13. GVU Trojaner 2.04 endgültig entfernen?
    Plagegeister aller Art und deren Bekämpfung - 26.06.2012 (1)
  14. BKA - Virus endgültig entfernen - Wie?
    Log-Analyse und Auswertung - 12.04.2012 (11)
  15. Anti Malware Doctor endgültig entfernen
    Plagegeister aller Art und deren Bekämpfung - 10.05.2011 (68)
  16. Antimalware Doctor endgültig entfernen
    Plagegeister aller Art und deren Bekämpfung - 22.08.2010 (1)
  17. Schädliche Prozesse lassen sich nicht endgültig Entfernen
    Plagegeister aller Art und deren Bekämpfung - 25.02.2006 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema BKA Trojaner endgültig entfernen - Hallo, Leider wurde ich Opfer des BKA Trojaners. Um auf meinen Laptop wieder zugreifen zu können habe ich im abgsichertem Modus eine Systemwiederhestellung gemacht, dies hat soweit auch geklappt. Als - BKA Trojaner endgültig entfernen...
Archiv
Du betrachtest: BKA Trojaner endgültig entfernen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131