GVU Trojaner Windows 7, kein Abgesicherter Modus

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-08-2013
Ran by SYSTEM on 27-08-2013 17:58:07
Running from I:\_ANTIVIR
Windows 7 Home Premium (X86) OS Language: 
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


ATTENTION!:=====> THE OPERATING SYSTEM IS A X64 SYSTEM BUT THE BOOT DISK THAT IS USED TO BOOT TO RECOVERY ENVIRONMENT IS A X86 SYSTEM DISK.
==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2107176 2010-03-12] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM\...\Run: [RtkOSD] - C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe [995840 2010-01-13] (Realtek Semiconductor Corp.)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-01-27] (Hewlett-Packard)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)
HKU\user123\...\Run: [AutoStartNPSAgent] - C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2011-12-26] (Samsung Electronics Co., Ltd.)
HKU\user123\...\Run: [MyTomTomSA.exe] - C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [ 2012-05-18] (TomTom)
HKU\user123\...\Run: [Yontoo Desktop] - C:\Users\user123\AppData\Roaming\Yontoo\YontooDesktop.exe [ 2013-05-21] (Yontoo LLC)
HKU\user123\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [ 2013-05-10] (PC Utilities Pro)
HKU\user123\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [ 2012-07-13] (Skype Technologies S.A.)
HKU\user123\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\user123\AppData\Local\Temp\fmjypmdjfiwloubtt.exe [ 2013-08-24] (Valve Corporation) <===== ATTENTION
HKU\user123\...\Policies\system: [DisableLockWorkstation] 0
HKU\user123\...\Policies\system: [DisableChangePassword] 0
HKU\user123\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION 
HKU\user123\...\Command Processor: "C:\Users\user123\AppData\Local\Temp\fmjypmdjfiwloubtt.exe" <===== ATTENTION!
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [x]
HKU\Default User\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [x]
Startup: C:\Users\user123\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)

========================== Services (Whitelisted) =================

S2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640 2013-05-11] (Adobe Systems Incorporated)
S2 AdobeFlashPlayerUpdateSvc; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [163328 2013-05-28] (Adobe Systems Incorporated)
S4 AERTFilters; C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [98208 2009-11-18] (Andrea Electronics Corporation)
S2 Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [37664 2011-01-05] (Apple Inc.)
S2 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2847696 2013-07-26] ()
S4 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation)
S2 clr_optimization_v4.0.30319_64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [138576 2010-03-18] (Microsoft Corporation)
S2 cvhsvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [822624 2012-01-04] (Microsoft Corporation)
S3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-05] (Microsoft Corporation)
S2 gupdate; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [116648 2013-03-12] (Google Inc.)
S3 gupdatem; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [116648 2013-03-12] (Google Inc.)
S2 HP Wireless Assistant Service; C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [102968 2010-01-27] (Hewlett-Packard)
S3 hpqwmiex; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [988216 2011-07-05] (Hewlett-Packard Company)
S2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1447728 2013-05-21] ()
S3 idsvc; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe [856400 2010-11-05] (Microsoft Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 MozillaMaintenance; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [117656 2013-08-19] (Mozilla Foundation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S4 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe [116560 2009-06-10] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
S3 odserv; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [149352 2010-01-09] (Microsoft Corporation)
S3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-14] (Microsoft Corporation)
S4 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.)
S2 sftlist; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [508776 2011-10-01] (Microsoft Corporation)
S3 sftvsa; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [219496 2011-10-01] (Microsoft Corporation)
S2 SkypeUpdate; C:\Program Files (x86)\Skype\Updater\Updater.exe [160944 2012-07-13] (Skype Technologies)
S2 Yontoo Desktop Updater; C:\Users\user123\AppData\Roaming\Yontoo\YontooDesktop.exe [47392 2013-05-21] (Yontoo LLC)
S2 ezSharedSvc; C:\Windows\System32\ezSharedSvcHost.exe [x]

==================== Drivers (Whitelisted) ====================

S3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [6405632 2010-03-29] (ATI Technologies Inc.)
S3 b06bdrv; C:\Windows\system32\DRIVERS\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation)
S3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation)
S3 BCM43XX; C:\Windows\System32\DRIVERS\bcmwl664.sys [3058168 2010-07-15] (Broadcom Corporation)
S0 CLFS; C:\Windows\System32\CLFS.sys [367696 2009-07-14] (Microsoft Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [6108416 2009-06-10] (Intel Corporation)
S3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHD64.sys [2291616 2010-03-13] (Realtek Semiconductor Corp.)
S3 ksthunk; C:\Windows\system32\drivers\ksthunk.sys [20992 2009-07-14] (Microsoft Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S3 netr28x; C:\Windows\System32\DRIVERS\netr28x.sys [620544 2009-06-10] (Ralink Technology, Corp.)
S3 netw5v64; C:\Windows\System32\DRIVERS\netw5v64.sys [5434368 2009-06-10] (Intel Corporation)
S3 pccsmcfd; C:\Windows\System32\DRIVERS\pccsmcfdx64.sys [29184 2007-09-17] (Nokia)
S3 RTL8167; C:\Windows\System32\DRIVERS\Rt64win7.sys [295424 2010-03-09] (Realtek                                            )
S3 SrvHsfHDA; C:\Windows\System32\DRIVERS\VSTAZL6.SYS [292864 2009-06-10] (Conexant Systems, Inc.)
S3 SrvHsfV92; C:\Windows\System32\DRIVERS\VSTDPV6.SYS [1485312 2009-06-10] (Conexant Systems, Inc.)
S3 SrvHsfWinac; C:\Windows\System32\DRIVERS\VSTCNXT6.SYS [740864 2009-06-10] (Conexant Systems, Inc.)
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [389120 2009-06-10] (Marvell)
S3 TFsExDisk; \??\C:\Windows\System32\Drivers\TFsExDisk.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-27 17:57 - 2013-08-27 17:57 - 00000000 ____D C:\FRST
2013-08-24 20:31 - 2013-08-24 20:31 - 01084789 _____ C:\Users\user123\AppData\Roaming\2433f433
2013-08-24 20:31 - 2013-08-24 20:31 - 01084739 _____ C:\Users\user123\AppData\Local\2433f433
2013-08-20 18:03 - 2013-08-20 18:03 - 00002266 _____ C:\Users\user123\Desktop\Norton Product Installer.lnk
2013-08-19 21:21 - 2013-07-09 06:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-08-19 21:21 - 2013-07-09 05:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-08-19 21:21 - 2013-07-09 05:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2013-08-19 21:21 - 2013-07-09 05:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-19 21:21 - 2013-07-09 05:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-19 21:21 - 2013-07-09 04:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-19 21:21 - 2013-07-09 04:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-19 21:21 - 2013-07-09 02:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-19 21:21 - 2013-07-09 02:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-19 21:21 - 2013-07-09 02:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-19 21:21 - 2013-07-09 02:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-19 19:17 - 2013-08-19 20:03 - 00002006 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-08-18 22:17 - 2013-07-26 05:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-18 22:17 - 2013-07-26 05:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-18 22:17 - 2013-07-26 05:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-18 22:17 - 2013-07-26 05:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-18 22:17 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-18 22:17 - 2013-07-26 03:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-18 22:17 - 2013-07-26 03:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-18 22:17 - 2013-07-26 03:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-18 22:17 - 2013-07-26 03:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-18 22:17 - 2013-07-26 03:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-18 22:17 - 2013-07-26 03:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-18 22:17 - 2013-07-26 02:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-18 22:17 - 2013-07-26 02:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-18 22:17 - 2013-07-26 01:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-18 15:19 - 2013-08-23 16:13 - 00000000 ____D C:\Users\user123\Documents\hamburg
2013-08-18 14:58 - 2013-07-09 05:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-18 14:58 - 2013-07-09 05:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-18 14:58 - 2013-07-09 05:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-18 14:58 - 2013-07-09 05:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-18 14:58 - 2013-07-09 04:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-18 14:58 - 2013-07-09 04:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-18 14:58 - 2013-07-09 04:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-18 14:58 - 2013-07-09 04:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-18 14:57 - 2013-07-19 01:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-18 14:57 - 2013-07-19 01:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-18 14:56 - 2013-07-25 09:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-18 14:56 - 2013-07-25 08:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-18 14:56 - 2013-07-09 05:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-18 14:56 - 2013-07-09 04:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-18 14:56 - 2013-07-06 06:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-18 14:56 - 2013-06-15 04:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-11 10:26 - 2013-08-11 10:26 - 07876512 _____ (Adobe Systems Inc.) C:\Users\user123\Downloads\Shockwave_Installer_Slim.exe
2013-08-09 15:06 - 2013-08-09 15:06 - 00000639 _____ C:\Users\user123\Desktop\wgunterlagen kristin - Verknüpfung.lnk
2013-08-09 15:06 - 2013-08-09 15:06 - 00000000 ____D C:\Users\user123\Desktop\wgunterlagen kristin2
2013-08-09 14:02 - 2013-08-09 14:02 - 01701969 _____ C:\Users\user123\Downloads\Song (1).zip
2013-08-03 18:08 - 2013-08-04 10:48 - 00002517 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-01 22:36 - 2013-08-18 22:05 - 00000000 ____D C:\Windows\System32\MRT

==================== One Month Modified Files and Folders =======

2013-08-27 17:57 - 2013-08-27 17:57 - 00000000 ____D C:\FRST
2013-08-27 13:35 - 2013-04-12 12:26 - 00018711 _____ C:\Windows\setupact.log
2013-08-27 13:33 - 2010-07-15 09:43 - 01339123 _____ C:\Windows\WindowsUpdate.log
2013-08-27 13:20 - 2009-07-14 04:45 - 00023024 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-27 13:20 - 2009-07-14 04:45 - 00023024 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-24 21:46 - 2009-07-14 05:13 - 00005442 _____ C:\Windows\System32\PerfStringBackup.INI
2013-08-24 20:31 - 2013-08-24 20:31 - 01084789 _____ C:\Users\user123\AppData\Roaming\2433f433
2013-08-24 20:31 - 2013-08-24 20:31 - 01084739 _____ C:\Users\user123\AppData\Local\2433f433
2013-08-24 16:38 - 2013-05-22 18:18 - 00000000 ____D C:\Users\user123\AppData\Roaming\Yontoo
2013-08-24 16:38 - 2011-01-26 17:00 - 00000000 ____D C:\Users\user123\AppData\Roaming\Skype
2013-08-23 16:20 - 2012-03-12 19:31 - 00000000 ____D C:\Users\user123\AppData\Roaming\Dropbox
2013-08-23 16:13 - 2013-08-18 15:19 - 00000000 ____D C:\Users\user123\Documents\hamburg
2013-08-23 09:47 - 2013-07-04 19:02 - 00000000 ___RD C:\Users\user123\Dropbox
2013-08-22 08:59 - 2013-03-12 11:40 - 00002143 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-22 08:53 - 2010-05-17 18:47 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-08-22 08:53 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\SysWOW64
2013-08-20 18:03 - 2013-08-20 18:03 - 00002266 _____ C:\Users\user123\Desktop\Norton Product Installer.lnk
2013-08-20 11:48 - 2010-12-15 20:14 - 00000000 ____D C:\Users\user123\AppData\Local\Adobe
2013-08-20 11:46 - 2013-03-12 11:39 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-20 11:46 - 2011-07-04 13:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-20 08:17 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-19 20:03 - 2013-08-19 19:17 - 00002006 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-08-19 19:17 - 2009-07-14 03:20 - 00000000 ____D C:\Program Files (x86)
2013-08-19 18:21 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\SysWOW64\de-DE
2013-08-19 18:21 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\System32\de-DE
2013-08-18 22:07 - 2013-08-01 22:36 - 00000000 ____D C:\Windows\System32\MRT
2013-08-18 22:05 - 2010-10-20 19:53 - 78161360 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-11 10:26 - 2013-08-11 10:26 - 07876512 _____ (Adobe Systems Inc.) C:\Users\user123\Downloads\Shockwave_Installer_Slim.exe
2013-08-09 15:06 - 2013-08-09 15:06 - 00000639 _____ C:\Users\user123\Desktop\wgunterlagen kristin - Verknüpfung.lnk
2013-08-09 15:06 - 2013-08-09 15:06 - 00000000 ____D C:\Users\user123\Desktop\wgunterlagen kristin2
2013-08-09 14:02 - 2013-08-09 14:02 - 01701969 _____ C:\Users\user123\Downloads\Song (1).zip
2013-08-04 10:48 - 2013-08-03 18:08 - 00002517 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-02 08:41 - 2013-06-05 11:57 - 00004990 _____ C:\Windows\PFRO.log

Files to move or delete:
====================
C:\Users\user123\AppData\Local\Temp\fmjypmdjfiwloubtt.exe
C:\Users\user123\AppData\Local\Temp\setup_fsu_cid.exe
C:\Users\user123\AppData\Local\Temp\updA8FB\BabScheduler2000201.exe
C:\Users\user123\AppData\Local\Temp\nsbFF9F.tmp\DropboxNSISTools.dll
C:\Users\user123\AppData\Local\Temp\nsbFF9F.tmp\UAC.dll
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\bin.dll
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\config.dll
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\microsoft-powerpoint-viewer.exe
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\routes.dll
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\software\Delta Babylon.exe
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\software\microsoft-powerpoint-viewer.exe
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\software\OptimizerPro.exe
C:\Users\user123\AppData\Local\Temp\DIQM\microsoft-powerpoint-viewer_027\software\Yontoo.exe
C:\Users\user123\AppData\Local\Temp\908209415\wssetup.exe
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\BabMaint.exe
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\BUSolForMontiera.dll
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\BUSolution.dll
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\ccp.exe
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\ChromeToolbarSetup.dll
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\CrxInstaller.dll
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\GUninstaller.exe
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\IEHelper.dll
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\MyBabylonTB.exe
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\Setup.exe
C:\Users\user123\AppData\Local\Temp\8695C9C2-BAB0-7891-95E6-6DD93D5CE0F5\sqlite3.dll
C:\Windows\Tasks\{0B262631-EF27-46CC-8DD6-4C2A70159B08}.job
C:\Windows\Tasks\{2A1D2B7D-2A2F-43D0-A59A-12335F980343}.job
C:\Windows\Tasks\{6883B5BC-8A7C-4E7A-9FED-702C9FD6EE06}.job

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-04-28 07:18] - [2011-02-25 06:19] - 2871808 ____A (Microsoft Corporation) 

C:\Windows\System32\winlogon.exe
[2011-06-21 15:04] - [2010-11-20 13:25] - 0390656 ____A (Microsoft Corporation) 

C:\Windows\System32\wininit.exe
[2009-07-13 23:52] - [2009-07-14 01:39] - 0129024 ____A (Microsoft Corporation) 

C:\Windows\System32\svchost.exe
[2009-07-13 23:31] - [2009-07-14 01:39] - 0027136 ____A (Microsoft Corporation) 

C:\Windows\System32\services.exe
[2009-07-13 23:19] - [2009-07-14 01:39] - 0328704 ____A (Microsoft Corporation) 

C:\Windows\System32\User32.dll
[2011-06-21 15:04] - [2010-11-20 13:27] - 1008128 ____A (Microsoft Corporation) 

C:\Windows\System32\userinit.exe
[2011-06-21 15:02] - [2010-11-20 13:25] - 0030720 ____A (Microsoft Corporation) 

C:\Windows\System32\Drivers\volsnap.sys
[2011-06-21 15:04] - [2010-11-20 13:34] - 0295808 ____A (Microsoft Corporation) 


==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-21 18:19:00
Restore point made on: 2013-07-25 14:08:46
Restore point made on: 2013-08-01 15:12:07
Restore point made on: 2013-08-01 22:31:50
Restore point made on: 2013-08-04 10:47:28
Restore point made on: 2013-08-07 15:37:28
Restore point made on: 2013-08-11 10:19:01
Restore point made on: 2013-08-18 14:58:30
Restore point made on: 2013-08-18 22:04:30
Restore point made on: 2013-08-19 22:19:09
Restore point made on: 2013-08-23 21:49:58

==================== Memory info =========================== 

Percentage of memory in use: 10%
Total physical RAM: 3578.83 MB
Available physical RAM: 3193.88 MB
Total Pagefile: 3347.81 MB
Available Pagefile: 2264.44 MB
Total Virtual: 2047.88 MB
Available Virtual: 2000.05 MB

==================== Drives ================================

Drive b: (RamDrive) (Fixed) (Total:0.98 GB) (Free:0.97 GB) NTFS
Drive c: () (Fixed) (Total:283.8 GB) (Free:91.89 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (RECOVERY) (Fixed) (Total:14 GB) (Free:2.01 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.07 GB) FAT32
Drive g: (BOOT DISK) (CDROM) (Total:0.6 GB) (Free:0 GB) CDFS
Drive h: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive i: (OTLPE) (Fixed) (Total:7.48 GB) (Free:6.68 GB) NTFS
Drive x: (Mini Xp) (Fixed) (Total:0.23 GB) (Free:0.23 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.17 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 57EDC112)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=284 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=14 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: E1A8E1A8)
Partition 1: (Active) - (Size=7 GB) - (Type=0E)


LastRegBack: 2012-02-14 12:45

==================== End Of Log ============================