Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows Vista Trojaner

Windows Vista Trojaner


Log-Analyse und Auswertung: Windows Vista Trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Seite 1 von 2 1 2
Alt 28.08.2013, 13:37   #1
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Hallo,
ein Bekannter, der nicht so fit in Sachen Computer ist, hat mir seinen Laptop (Betriebssystem: Windows Vista) gegeben, damit ich was installiere. Davor hab ich ein paar Updates (z.B. Java) gemacht und wollte ihn auch mal durchchecken auf Viren etc. Nach einem Scan mit einer Antimalware wurde mir ein infiziertes Objekt angezeigt (logfile siehe unten). Ich habs entfernt und jetzt ist es in Quarantäne. Ein zweiter Scan hat keine Infizierung mehr angezeigt. Jetzt bin ich mir nicht sicher, was ich als Nächstes tun sollen. Deshalb hoffe ich, dass mir jemand helfen kann. Sonst hat der Laptop eigentlich keine Auffälligkeiten gezeigt, also dass sich irgendwas öffnet oder Ähnliches. Vielen Dank.

MfG. ela11

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.28.03

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 8.0.6001.19453
Notebook :: NOTEBOOK-PC [Administrator]

28.08.2013 13:57:38
mbam-log-2013-08-28 (13-57-38).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 215429
Laufzeit: 5 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Users\Notebook\AppData\Local\Temp\{C7BFBCB5-92E9-49D3-A257-FB6FCA09238D}-GoogleEarth-Win-Bundle-7.0.3.8542.exe (Trojan.P2P.Worm) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Alt 28.08.2013, 13:43   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 28.08.2013, 14:06   #3
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by Notebook (administrator) on 28-08-2013 15:01:51
Running from C:\Users\Notebook\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(FileHippo.com) C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(PC-Doctor, Inc.) C:\Program Files\Dell Support Center\uaclauncher.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [305664 2009-03-31] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\system32\WLTRAY.exe [4119552 2008-12-21] (Dell Inc.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [2115664 2009-03-27] (Dell Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712 2008-06-15] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [462848 2009-03-31] (IDT, Inc.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [248832 2010-08-09] (FileHippo.com)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [250192 2009-04-24] (Microsoft Corporation)
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128232 2009-02-05] (CyberLink Corp.)
HKLM-x32\...\Run: [DellSupportCenter] - "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-08-28] (RealNetworks, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hotmail.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://spiegel-online.de/
hxxp://www.sparkasse-regensburg.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&Form=DLCDF7&pc=MDDC&src=IE-SearchBox
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&Form=DLCDF7&pc=MDDC&src=IE-SearchBox
SearchScopes: HKCU - {08F026B8-D9D9-4A55-AC58-C3E4A7DCD01D} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=36fd4acb-15be-4acd-b63b-f0b985f828a5&apn_sauid=C6A6B1B8-AADF-49DA-8F87-283698BFD999
SearchScopes: HKCU - {F5BA914F-3D00-4EC7-A916-4BE2094181D2} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Notebook\AppData\Roaming\Mozilla\Firefox\Profiles\ex7cij0m.default
FF SelectedSearchEngine: Yahoo
FF Homepage: hxxp://www.hotmail.de/|hxxp://spiegel-online.de/|hxxp://www.sparkasse-regensburg.de/
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\2.0.31005.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-03] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 wltrysvc; C:\Windows\System32\WLTRYSVC.EXE [32768 2008-12-21] ()
R2 yksvc; RUNDLL32.EXE ykx64coinst,serviceStartProc [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-01] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 PCDSRVC{1E208CE0-FB7451FF-06020200}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-28 14:59 - 2013-08-28 14:59 - 01579080 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-08-28 13:56 - 2013-08-28 13:56 - 00000950 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 13:56 - 2013-08-28 13:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 13:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-28 13:52 - 2013-08-28 14:26 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-08-28 14:26 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:50 - 2013-08-28 13:52 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:37 - 2013-08-28 13:37 - 00001840 _____ C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2013-08-28 13:37 - 2013-08-28 13:37 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2013-08-02 16:06 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-28 13:24 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-18 10:40 - 2013-07-24 20:33 - 12509696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 09340928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 00742912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 11111936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 06016512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01585256 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01168088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-18 10:40 - 2013-07-08 06:51 - 04691904 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-18 10:40 - 2013-07-08 06:20 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-18 10:40 - 2013-07-08 06:18 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 06:15 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-18 10:40 - 2013-07-08 06:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 03:39 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-18 10:39 - 2013-07-24 20:33 - 02356736 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01538560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 20:33 - 01489408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 01212928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00916480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00611840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 02004992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 01469440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 02:32 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00387584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00043520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:22 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-18 10:39 - 2013-07-24 02:09 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 02:09 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-18 10:39 - 2013-07-24 01:56 - 00385024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-18 10:39 - 2013-07-24 01:49 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 01:49 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-18 10:27 - 2013-07-17 22:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-18 10:27 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-18 10:27 - 2013-07-10 11:47 - 00677888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-18 10:27 - 2013-07-10 11:42 - 01303552 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-18 10:27 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-18 10:27 - 2013-07-08 06:15 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 01276416 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-18 10:27 - 2013-07-05 06:45 - 01423808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-18 10:27 - 2013-06-15 15:27 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-18 10:27 - 2013-06-15 13:38 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 20:50 - 2013-08-16 20:53 - 00000000 ____D C:\Windows\system32\MRT

==================== One Month Modified Files and Folders =======

2013-08-28 15:01 - 2013-08-28 15:01 - 00000000 ____D C:\FRST
2013-08-28 14:59 - 2013-08-28 14:59 - 01579080 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-08-28 14:59 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-28 14:59 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-28 14:43 - 2012-08-29 13:30 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-28 14:32 - 2008-01-21 13:10 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-28 14:32 - 2008-01-21 13:09 - 00628992 _____ C:\Windows\system32\perfh007.dat
2013-08-28 14:32 - 2008-01-21 13:09 - 00126704 _____ C:\Windows\system32\perfc007.dat
2013-08-28 14:30 - 2009-09-17 09:13 - 01428427 _____ C:\Windows\WindowsUpdate.log
2013-08-28 14:26 - 2013-08-28 13:52 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 14:26 - 2013-08-28 13:52 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 14:25 - 2012-08-29 13:30 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-28 14:25 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-28 14:24 - 2006-11-02 17:42 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-28 14:18 - 2013-03-01 15:30 - 00000000 ____D C:\Windows\pss
2013-08-28 14:18 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-28 14:07 - 2012-05-27 13:34 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-28 14:05 - 2008-01-21 05:26 - 00485276 _____ C:\Windows\PFRO.log
2013-08-28 13:56 - 2013-08-28 13:56 - 00000950 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 13:56 - 2013-08-28 13:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:52 - 2013-08-28 13:50 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:52 - 2009-09-24 14:27 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Real
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:51 - 2009-09-24 14:27 - 00000000 ____D C:\Program Files (x86)\Real
2013-08-28 13:50 - 2009-09-24 14:27 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-08-28 13:50 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-08-28 13:50 - 2009-09-17 14:55 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-08-28 13:50 - 2009-09-17 14:55 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:43 - 2009-09-24 13:12 - 00000000 ____D C:\Users\Notebook\AppData\Local\Paint.NET
2013-08-28 13:42 - 2009-09-23 19:34 - 00000992 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-28 13:41 - 2009-09-23 19:34 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-28 13:37 - 2013-08-28 13:37 - 00001840 _____ C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2013-08-28 13:37 - 2013-08-28 13:37 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2012-06-24 13:53 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-08-28 13:24 - 2010-10-24 18:53 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-28 13:23 - 2009-09-23 19:51 - 00003982 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}
2013-08-28 13:23 - 2009-09-23 19:51 - 00000424 ____H C:\Windows\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}.job
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-27 10:56 - 2012-08-29 13:30 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-22 10:23 - 2006-11-02 17:27 - 00240494 _____ C:\Windows\setupact.log
2013-08-22 10:22 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\rescache
2013-08-22 10:15 - 2012-05-27 13:34 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-22 10:15 - 2012-05-27 13:33 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-22 10:15 - 2012-05-27 13:33 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-16 20:53 - 2013-08-16 20:50 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 20:50 - 2006-11-02 14:35 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-09 20:09 - 2012-08-29 13:22 - 00000000 ____D C:\Users\Notebook\Desktop\Sonstiges
2013-08-02 16:06 - 2013-08-28 13:24 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-02 06:09 - 2013-08-28 13:24 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

Files to move or delete:
====================
C:\Users\Notebook\AppData\Local\Temp\AskSLib.dll
C:\Users\Notebook\AppData\Local\Temp\Connection.dll
C:\Users\Notebook\AppData\Local\Temp\Dbwork.dll
C:\Users\Notebook\AppData\Local\Temp\Dialogs.dll
C:\Users\Notebook\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Notebook\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Notebook\AppData\Local\Temp\IPC.dll
C:\Users\Notebook\AppData\Local\Temp\Jobs.dll
C:\Users\Notebook\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\libeay32.dll
C:\Users\Notebook\AppData\Local\Temp\mfc80.dll
C:\Users\Notebook\AppData\Local\Temp\msvcp80.dll
C:\Users\Notebook\AppData\Local\Temp\msvcr80.dll
C:\Users\Notebook\AppData\Local\Temp\Permissions.dll
C:\Users\Notebook\AppData\Local\Temp\QFA.EXE
C:\Users\Notebook\AppData\Local\Temp\QfaInvoke.dll
C:\Users\Notebook\AppData\Local\Temp\Report.dll
C:\Users\Notebook\AppData\Local\Temp\SkinMagic.dll
C:\Users\Notebook\AppData\Local\Temp\Smarti.dll
C:\Users\Notebook\AppData\Local\Temp\SmartiComm.dll
C:\Users\Notebook\AppData\Local\Temp\SmartIcon.exe
C:\Users\Notebook\AppData\Local\Temp\SmartSurfer.exe
C:\Users\Notebook\AppData\Local\Temp\smurf.dll
C:\Users\Notebook\AppData\Local\Temp\SmurfService.dll
C:\Users\Notebook\AppData\Local\Temp\SmurfService.exe
C:\Users\Notebook\AppData\Local\Temp\SmurfUpd.exe
C:\Users\Notebook\AppData\Local\Temp\SmurfUpdEng.exe
C:\Users\Notebook\AppData\Local\Temp\Sqlite.dll
C:\Users\Notebook\AppData\Local\Temp\ssleay32.dll
C:\Users\Notebook\AppData\Local\Temp\Threads.dll
C:\Users\Notebook\AppData\Local\Temp\Uninstall.exe
C:\Users\Notebook\AppData\Local\Temp\Utils.dll
C:\Users\Notebook\AppData\Local\Temp\Vars.dll
C:\Users\Notebook\AppData\Local\Temp\WEBDE_ServiceInstall.exe
C:\Users\Notebook\AppData\Local\Temp\Wizzard.dll
C:\Users\Notebook\AppData\Local\Temp\xmlparse.dll
C:\Users\Notebook\AppData\Local\Temp\xmltok.dll
C:\Users\Notebook\AppData\Local\Temp\{0B366C17-4154-4D3E-BE1A-0C2F023553D4}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{3F8FA7EE-CC38-4F2E-AF96-AB58A9119761}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{4CA146DB-6C38-4969-A8D0-D1419932BBC1}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{64B71A84-25A4-4C58-ADA8-800EF31AB4FE}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{672E0877-CF4F-43F7-90C8-CE2994E0FD50}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{A51F5C72-0E73-413E-9907-AA3727A6F527}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{BC21B5B5-7508-4B06-B3CE-DFEF7895E1F7}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{F11648AC-70F7-47AA-B0E7-73EF0F9B3874}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg7\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg7\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg45\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg45\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg44\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg44\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg42\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg42\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg41\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg41\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg40\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg40\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg39\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg39\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg38\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg38\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg37\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg37\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg36\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg36\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg35\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg35\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg34\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg34\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg33\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg33\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg32\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg32\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg30\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg30\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg29\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg29\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg28\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg28\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg27\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg27\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg26\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg26\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg25\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg25\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg24\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg24\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg23\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg23\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg22\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg22\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg21\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg21\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg20\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg20\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg19\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg19\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg18\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg18\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg17\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg17\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg16\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg16\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg15\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg15\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg14\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg14\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg13\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg13\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~rnsetup\pncrt.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetup\pnrs3260.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetu0\GEMSETUP\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetu0\GEMSETUP\pnrs3260.dll
C:\Users\Notebook\AppData\Local\Temp\{4DDA9E92-2FF5-4A60-B5EA-2D6F23D9395D}\InstallFlashPlayer.exe
C:\Users\Notebook\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_.exe
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avmres.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloader.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloader.exe
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloadergui.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcimage.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_de.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_en.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_es.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_fr.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_it.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_jp.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_ko.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_nl.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_pt.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_ru.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_tr.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_zhcn.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_zhtw.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\scewxmlw.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\update.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\64bitProxy.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aebb.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aecore.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeemu.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeexp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aegen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aehelp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeheur.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeoffice.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aepack.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aerdl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aesbx.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aescn.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aescript.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aevdf.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\apcfile.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnIC.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnStub.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnToolbarInstaller.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_64.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_API.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_CLI.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avacl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avadmin.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avarkt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avbb.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avcenter.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avconfig.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avconfig.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avesvc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avevtlog.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avgio.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avgnt.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avguard.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avinet.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avipc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avlode.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avmres.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avnotify.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avpref.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avreg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avrep.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avrestart.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avscan.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avscplr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsda.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsda64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsmtp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avupgsvc.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebgrd.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloader.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloader.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloadergui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwinll.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwmi.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwsc.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccavscanex.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccev.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccevw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgenw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgrdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccguard.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cchips.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cclic.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cclicw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccmsg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccprofil.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccquamgr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccquaw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccreport.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccrepow.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccscanw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccsched.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccschedw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccupdate.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccupdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwebtabs.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwgrd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwgrdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwkrlib.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cfglib.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\extdlgfw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\fact.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpavgio.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpevtlog.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgavid.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgenrep.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgrd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpipc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gplegacy.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpschd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\grdcore.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\guardgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\imp64b.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\inssda64.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\insthlp.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ipmgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libapr-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libapriconv-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libaprutil-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libcurl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libdb44.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libeay32.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\licmgr.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\luke.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\mgrs.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msgclient.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msvcp80.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msvcr80.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\netnt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\onlcfg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\presetup.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ar.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_de.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_en.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_es.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_fr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_it.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_jp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ko.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_nl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_pt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ru.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_tr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_zhcn.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_zhtw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\scewxmlw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\sched.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\setup.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\setuppending.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\shlext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\shlext64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\sqlite3.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ssleay32.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\thorwac.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\toastNotifier.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\unacev2.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\update.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\update.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updgui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updrgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vcredist_x86.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\wksstats.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\wsctool.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\xp\avshadow.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vista64\avipc64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vista64\avshadow.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avconfigrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avesvcr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avevtrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avnotify.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avscanrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avwebgrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccavscanexrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccevrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccgenrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccgrdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\cchipsrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\cclicrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccmainrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccmsgrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccquarc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccreporc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccscanrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccscherc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccupdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccwebtabsrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccwgrdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\factrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\guardmsg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\licmgr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\lukeres.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rchelp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rcimage.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rctext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\restartrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\schedr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\setup.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\updaterc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\updguirc.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\GoogleEarth.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthflashsol.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthps.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\ge_expat.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth_free.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\gpsbabel.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\Plugins\npgeinprocessplugin.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-28 14:31

==================== End Of Log ============================
--- --- ---


FRST Additions Logfile:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-08-2013
Ran by Notebook at 2013-08-28 15:03:12
Running from C:\Users\Notebook\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Reader 9 - Deutsch (x32 Version: 9.0.0)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
Choice Guard (x32 Version: 1.2.87.0)
Cisco EAP-FAST Module (x32 Version: 2.1.6)
Cisco LEAP Module (x32 Version: 1.0.12)
Cisco PEAP Module (x32 Version: 1.0.13)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.4518.1014)
Dell Dock (Version: 1.0.0)
Dell Edoc Viewer (Version: 1.0.0)
Dell Getting Started Guide (x32 Version: 1.00.0000)
Dell Support Center (Version: 3.2.6032.125)
Dell Touchpad (Version: 7.104.115.101)
Dell Video Chat (x32 Version: 6.0 (6567))
FileHippo.com Update Checker (x32)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 14.0.8050.1202)
l Wireless WLAN Card Utility (Version: 5.10.38.30)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Default Manager (x32 Version: 2.0.69.0)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Search Enhancement Pack (x32 Version: 1.2.121.0)
Microsoft Silverlight (x32 Version: 2.0.31005.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.58299)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 9.7.0621)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 14.0.1468.721)
OpenOffice.org 2.0 (x32 Version: 2.0.9011)
Paint.NET v3.5.11 (Version: 3.61.0)
PowerDVD DX (x32 Version: 8.2.5024)
Quickset (Version: 9.2.18)
RealDownloader (x32 Version: 1.3.3)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.3)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Roxio Creator Audio (x32 Version: 3.7.0)
Roxio Creator Copy (x32 Version: 3.7.0)
Roxio Creator Data (x32 Version: 3.7.0)
Roxio Creator DE (x32 Version: 10.1)
Roxio Creator DE (x32 Version: 3.7.0)
Roxio Creator Tools (x32 Version: 3.7.0)
Roxio Express Labeler 3 (x32 Version: 3.2.1)
Roxio Update Manager (x32 Version: 6.0.0)
TeamViewer 6 (x32 Version: 6.0.11656)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (x32 Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Windows Live Call (x32 Version: 14.0.8050.1202)
Windows Live Communications Platform (x32 Version: 14.0.8050.1202)
Windows Live Essentials (x32 Version: 14.0.8050.1202)
Windows Live Fotogalerie (x32 Version: 14.0.8051.1204)
Windows Live Mail (x32 Version: 14.0.8050.1202)
Windows Live Messenger (x32 Version: 14.0.8050.1202)
Windows Live Sync (x32 Version: 14.0.8050.1202)
Windows Live Toolbar (x32 Version: 14.0.8052.1208)
Windows Live Writer (x32 Version: 14.0.8050.1202)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)

==================== Restore Points  =========================

17-03-2013 16:49:16 Windows Update
24-03-2013 08:52:06 Windows Update
15-04-2013 16:44:22 Windows Update
17-04-2013 08:06:22 Windows Update
29-04-2013 04:45:11 Windows Update
21-05-2013 13:21:38 Windows Update
22-05-2013 07:10:49 Windows Update
16-06-2013 13:44:16 Windows Update
17-06-2013 17:12:43 Windows Update
11-07-2013 14:36:54 Windows Update
13-07-2013 15:09:50 Windows Update
15-07-2013 14:56:00 Windows Update
17-07-2013 13:58:47 Windows Update
16-08-2013 18:47:55 Windows Update
19-08-2013 08:33:45 Windows Update
28-08-2013 11:21:10 Installed Java 7 Update 25
28-08-2013 11:30:44 Removed Java(TM) 6 Update 13 (64-bit)
28-08-2013 11:33:34 Windows Update
28-08-2013 11:40:11 Paint.NET v3.5.11

==================== Hosts content: ==========================

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {03D5BBBE-72E8-4ABD-B1F8-815770BED48C} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe No File
Task: {0467F723-58E3-48F4-82E8-39F2D2830B67} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\System32\srrstr.dll [2008-01-21] (Microsoft Corporation)
Task: {0870E3CF-96BC-4604-B0A6-691A4A940330} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-22] (Adobe Systems Incorporated)
Task: {09BF8FB0-8567-4423-80FB-622FF67157D9} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell Support Center\uaclauncher.exe [2013-02-06] (PC-Doctor, Inc.)
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {13329B3C-D738-4049-ABF6-8B413C2A2125} - System32\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201} => C:\Windows\system32\msfeedssync.exe [2013-07-24] (Microsoft Corporation)
Task: {13C59BA1-57A6-41EC-ADA2-E8818184C566} - System32\Tasks\WPD\SqmUpload_S-1-5-21-3662071480-2160519904-3827952930-1000 => C:\Windows\System32\portabledeviceapi.dll [2009-10-01] (Microsoft Corporation)
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {22DB1FA1-E3EB-4AFF-A54B-F748A2AC251A} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {2C2AC965-7EF3-412E-8BED-F59EEE65C512} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {3ABF0DC8-743B-474C-9723-B890C024A542} - System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector => C:\Windows\System32\dfdts.dll [2008-01-21] (Microsoft Corporation)
Task: {3D1AE433-9782-4CD2-825B-1FB6593E6580} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 => C:\Windows\System32\ndfapi.dll [2008-01-21] (Microsoft Corporation)
Task: {4BC03053-8FF7-4A37-A70F-43531458BC87} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {4E946E6C-49EC-4FD9-8F58-EB5AF1752C5D} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\pla.dll [2008-01-21] (Microsoft Corporation)
Task: {6C9E5708-3444-4393-8D92-D21E8FC348EC} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 => C:\Windows\System32\ndfapi.dll [2008-01-21] (Microsoft Corporation)
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {A72105E7-24FA-4DBC-AE95-63B7BD12E851} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-29] (Google Inc.)
Task: {A9683382-0125-42BE-A29E-E39819CD3AF7} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {A97C0956-44FC-432C-A0C4-A9249C9B9FA6} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-24] (Microsoft Corporation)
Task: {AD35A65C-7057-41B2-905D-D3A0F0851887} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Notebook => C:\Program Files\Windows Calendar\WinCal.exe [2008-01-21] (Microsoft Corporation)
Task: {B1BECB2D-6E9A-4F34-83B6-DD01E941D884} - System32\Tasks\Launch BCM WLAN Tray => C:\Windows\system32\WLTRAY.EXE [2008-12-21] (Dell Inc.)
Task: {D9E29EA0-AEE4-4244-8B9C-D65A97E8B274} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-29] (Google Inc.)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {EF28DF27-7F25-4E55-8EB2-CA7F8F1DF2CA} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)
Task: {F7F2D88F-A057-483F-A4E9-E84711B3C2BA} - System32\Tasks\PCDEventLauncher => C:\Program Files\Dell Support Center\sessionchecker.exe [2013-02-06] (PC-Doctor, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}.job => C:\Windows\system32\msfeedssync.exe

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/28/2013 02:25:53 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/28/2013 02:20:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/28/2013 02:18:40 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (08/28/2013 02:07:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/28/2013 02:07:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/28/2013 02:07:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/28/2013 01:50:48 PM) (Source: Microsoft-Windows-RestartManager) (User: Notebook-PC)
Description: 0avguard.exeAvira Echtzeit-Scanner0302621611244243003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630070003100300030002E0064006C006C00000043003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630072003100300030002E0064006C006C000000

Error: (08/28/2013 01:50:48 PM) (Source: Microsoft-Windows-RestartManager) (User: Notebook-PC)
Description: 0sched.exeAvira Planer0302621611624243003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630070003100300030002E0064006C006C00000043003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630072003100300030002E0064006C006C000000

Error: (08/28/2013 01:40:11 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {ede4e208-bc39-48ab-b1d5-83ecbcf5fbcf}

Error: (08/28/2013 01:29:56 PM) (Source: Application Hang) (User: )
Description: Programm Explorer.EXE, Version 6.0.6002.18005 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 7f0
Anfangszeit: 01cea3deb34ea9f3
Zeitpunkt der Beendigung: 31


System errors:
=============
Error: (08/28/2013 02:25:53 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 NDIS 6 Adapter Driver%%1058

Error: (08/28/2013 02:25:53 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber%%1058

Error: (08/28/2013 02:20:13 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 NDIS 6 Adapter Driver%%1058

Error: (08/28/2013 02:20:13 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber%%1058

Error: (08/28/2013 02:07:13 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 NDIS 6 Adapter Driver%%1058

Error: (08/28/2013 02:07:13 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber%%1058

Error: (08/28/2013 01:28:58 PM) (Source: DCOM) (User: Notebook-PC)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}Notebook-PCNotebookS-1-5-21-3662071480-2160519904-3827952930-1000LocalHost (unter Verwendung von LRPC)

Error: (08/28/2013 01:07:09 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 NDIS 6 Adapter Driver%%1058

Error: (08/28/2013 01:07:09 PM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber%%1058

Error: (08/27/2013 10:05:22 AM) (Source: Service Control Manager) (User: )
Description: Intel(R) PRO/1000 NDIS 6 Adapter Driver%%1058


Microsoft Office Sessions:
=========================
Error: (08/28/2013 02:25:53 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/28/2013 02:20:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/28/2013 02:18:40 PM) (Source: EventSystem)(User: )
Description: 80070005EventSystem.EventSubscription{AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (08/28/2013 02:07:24 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe

Error: (08/28/2013 02:07:24 PM) (Source: SideBySide)(User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe

Error: (08/28/2013 02:07:11 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/28/2013 01:50:48 PM) (Source: Microsoft-Windows-RestartManager)(User: Notebook-PC)
Description: 0avguard.exeAvira Echtzeit-Scanner0302621611244243003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630070003100300030002E0064006C006C00000043003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630072003100300030002E0064006C006C000000

Error: (08/28/2013 01:50:48 PM) (Source: Microsoft-Windows-RestartManager)(User: Notebook-PC)
Description: 0sched.exeAvira Planer0302621611624243003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630070003100300030002E0064006C006C00000043003A005C00570069006E0064006F00770073005C0053007900730057004F005700360034005C006D0073007600630072003100300030002E0064006C006C000000

Error: (08/28/2013 01:40:11 PM) (Source: VSS)(User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {ede4e208-bc39-48ab-b1d5-83ecbcf5fbcf}

Error: (08/28/2013 01:29:56 PM) (Source: Application Hang)(User: )
Description: Explorer.EXE6.0.6002.180057f001cea3deb34ea9f331


CodeIntegrity Errors:
===================================
  Date: 2011-12-30 16:52:15.001
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-30 16:52:14.751
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-30 16:52:14.486
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-30 16:52:14.221
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-30 16:52:13.924
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-26 15:11:37.119
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-26 15:11:36.838
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-26 15:11:36.542
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-26 15:11:36.245
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-12-26 15:11:35.902
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 48%
Total physical RAM: 3031.57 MB
Available physical RAM: 1557.73 MB
Total Pagefile: 6293.44 MB
Available Pagefile: 4368.53 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:134.36 GB) (Free:74.9 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:5.31 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: F9393ED1)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=134 GB) - (Type=07 NTFS)

==================== End Of Log ============================
--- --- ---
__________________
Alt 28.08.2013, 17:01   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 28.08.2013, 19:18   #5
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.001 - Report created 28/08/2013 at 18:38:32
# Updated 24/08/2013 by Xplode
# Operating System : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Username : Notebook - NOTEBOOK-PC
# Running from : C:\Users\Notebook\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

[!] Folder Deleted : C:\Users\Notebook\AppData\Local\Temp\AskSearch
File Deleted : C:\Users\Notebook\AppData\Local\Temp\Uninstall.exe
File Deleted : C:\Users\Notebook\AppData\Local\Temp\Utils.dll

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Key Deleted : HKCU\Software\YahooPartnerToolbar

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.19453


-\\ Mozilla Firefox v23.0.1 (de)

[ File : C:\Users\Notebook\AppData\Roaming\Mozilla\Firefox\Profiles\ex7cij0m.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1417 octets] - [28/08/2013 18:37:53]
AdwCleaner[S0].txt - [1305 octets] - [28/08/2013 18:38:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1365 octets] ##########
--- --- ---


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.4 (08.22.2013:1)
OS: Windows (TM) Vista Home Premium x64
Ran by Notebook on 28.08.2013 at 18:47:08,60
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{08F026B8-D9D9-4A55-AC58-C3E4A7DCD01D}



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.08.2013 at 18:54:01,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by Notebook (administrator) on 28-08-2013 20:14:41
Running from C:\Users\Notebook\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(FileHippo.com) C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [305664 2009-03-31] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\system32\WLTRAY.exe [4119552 2008-12-21] (Dell Inc.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [2115664 2009-03-27] (Dell Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712 2008-06-15] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [462848 2009-03-31] (IDT, Inc.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [248832 2010-08-09] (FileHippo.com)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [250192 2009-04-24] (Microsoft Corporation)
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128232 2009-02-05] (CyberLink Corp.)
HKLM-x32\...\Run: [DellSupportCenter] - "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-08-28] (RealNetworks, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hotmail.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://spiegel-online.de/
hxxp://www.sparkasse-regensburg.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {F5BA914F-3D00-4EC7-A916-4BE2094181D2} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Notebook\AppData\Roaming\Mozilla\Firefox\Profiles\ex7cij0m.default
FF SelectedSearchEngine: Yahoo
FF Homepage: hxxp://www.hotmail.de/|hxxp://spiegel-online.de/|hxxp://www.sparkasse-regensburg.de/
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\2.0.31005.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-03] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 wltrysvc; C:\Windows\System32\WLTRYSVC.EXE [32768 2008-12-21] ()
R2 yksvc; RUNDLL32.EXE ykx64coinst,serviceStartProc [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-01] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-28 18:47 - 2013-08-28 18:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 18:40 - 2013-08-28 18:40 - 00001445 _____ C:\Users\Notebook\Desktop\AdwCleaner[S0].txt
2013-08-28 18:37 - 2013-08-28 18:38 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:36 - 2013-08-28 18:36 - 01021434 _____ (Thisisu) C:\Users\Notebook\Desktop\JRT.exe
2013-08-28 18:35 - 2013-08-28 18:35 - 00994642 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-08-28 15:19 - 2013-08-28 15:19 - 00003998 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003208 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-08-28 15:19 - 2013-08-28 15:19 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-08-28 15:18 - 2013-08-28 15:19 - 00000000 ____D C:\Program Files\My Dell
2013-08-28 15:03 - 2013-08-28 15:04 - 00022594 _____ C:\Users\Notebook\Desktop\Addition.txt
2013-08-28 15:01 - 2013-08-28 15:01 - 00000000 ____D C:\FRST
2013-08-28 14:59 - 2013-08-28 14:59 - 01579080 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-08-28 13:56 - 2013-08-28 13:56 - 00000950 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 13:56 - 2013-08-28 13:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 13:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-28 13:52 - 2013-08-28 20:13 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-08-28 20:13 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:50 - 2013-08-28 13:52 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:37 - 2013-08-28 13:37 - 00001840 _____ C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2013-08-28 13:37 - 2013-08-28 13:37 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2013-08-02 16:06 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-28 13:24 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-18 10:40 - 2013-07-24 20:33 - 12509696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 09340928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 00742912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 11111936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 06016512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01585256 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01168088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-18 10:40 - 2013-07-08 06:51 - 04691904 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-18 10:40 - 2013-07-08 06:20 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-18 10:40 - 2013-07-08 06:18 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 06:15 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-18 10:40 - 2013-07-08 06:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 03:39 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-18 10:39 - 2013-07-24 20:33 - 02356736 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01538560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 20:33 - 01489408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 01212928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00916480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00611840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 02004992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 01469440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 02:32 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00387584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00043520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:22 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-18 10:39 - 2013-07-24 02:09 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 02:09 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-18 10:39 - 2013-07-24 01:56 - 00385024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-18 10:39 - 2013-07-24 01:49 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 01:49 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-18 10:27 - 2013-07-17 22:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-18 10:27 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-18 10:27 - 2013-07-10 11:47 - 00677888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-18 10:27 - 2013-07-10 11:42 - 01303552 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-18 10:27 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-18 10:27 - 2013-07-08 06:15 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 01276416 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-18 10:27 - 2013-07-05 06:45 - 01423808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-18 10:27 - 2013-06-15 15:27 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-18 10:27 - 2013-06-15 13:38 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 20:50 - 2013-08-16 20:53 - 00000000 ____D C:\Windows\system32\MRT

==================== One Month Modified Files and Folders =======

2013-08-28 20:13 - 2013-08-28 13:52 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 20:13 - 2013-08-28 13:52 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 20:12 - 2012-08-29 13:30 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-28 20:12 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-28 20:12 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-28 20:12 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-28 20:11 - 2009-09-17 09:13 - 01443214 _____ C:\Windows\WindowsUpdate.log
2013-08-28 20:11 - 2006-11-02 17:42 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-28 20:07 - 2012-05-27 13:34 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-28 19:43 - 2012-08-29 13:30 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-28 18:54 - 2013-08-28 18:54 - 00001226 _____ C:\Users\Notebook\Desktop\JRT.txt
2013-08-28 18:47 - 2013-08-28 18:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 18:46 - 2008-01-21 13:10 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-28 18:46 - 2008-01-21 13:09 - 00628992 _____ C:\Windows\system32\perfh007.dat
2013-08-28 18:46 - 2008-01-21 13:09 - 00126704 _____ C:\Windows\system32\perfc007.dat
2013-08-28 18:40 - 2013-08-28 18:40 - 00001445 _____ C:\Users\Notebook\Desktop\AdwCleaner[S0].txt
2013-08-28 18:38 - 2013-08-28 18:37 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:36 - 2013-08-28 18:36 - 01021434 _____ (Thisisu) C:\Users\Notebook\Desktop\JRT.exe
2013-08-28 18:35 - 2013-08-28 18:35 - 00994642 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-08-28 15:19 - 2013-08-28 15:19 - 00003998 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003208 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-08-28 15:19 - 2013-08-28 15:19 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-08-28 15:19 - 2013-08-28 15:18 - 00000000 ____D C:\Program Files\My Dell
2013-08-28 15:19 - 2011-07-15 16:23 - 00000000 ____D C:\Program Files\Dell Support Center
2013-08-28 15:18 - 2009-09-17 14:47 - 00000000 ____D C:\ProgramData\PCDr
2013-08-28 15:04 - 2013-08-28 15:03 - 00022594 _____ C:\Users\Notebook\Desktop\Addition.txt
2013-08-28 15:01 - 2013-08-28 15:01 - 00000000 ____D C:\FRST
2013-08-28 14:59 - 2013-08-28 14:59 - 01579080 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-08-28 14:18 - 2013-03-01 15:30 - 00000000 ____D C:\Windows\pss
2013-08-28 14:18 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-28 14:05 - 2008-01-21 05:26 - 00485276 _____ C:\Windows\PFRO.log
2013-08-28 13:56 - 2013-08-28 13:56 - 00000950 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 13:56 - 2013-08-28 13:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:52 - 2013-08-28 13:50 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:52 - 2009-09-24 14:27 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Real
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:51 - 2009-09-24 14:27 - 00000000 ____D C:\Program Files (x86)\Real
2013-08-28 13:50 - 2009-09-24 14:27 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-08-28 13:50 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-08-28 13:50 - 2009-09-17 14:55 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-08-28 13:50 - 2009-09-17 14:55 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:43 - 2009-09-24 13:12 - 00000000 ____D C:\Users\Notebook\AppData\Local\Paint.NET
2013-08-28 13:42 - 2009-09-23 19:34 - 00000992 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-28 13:41 - 2009-09-23 19:34 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-28 13:37 - 2013-08-28 13:37 - 00001840 _____ C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2013-08-28 13:37 - 2013-08-28 13:37 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2012-06-24 13:53 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-08-28 13:24 - 2010-10-24 18:53 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-28 13:23 - 2009-09-23 19:51 - 00003982 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}
2013-08-28 13:23 - 2009-09-23 19:51 - 00000424 ____H C:\Windows\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}.job
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-27 10:56 - 2012-08-29 13:30 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-22 10:23 - 2006-11-02 17:27 - 00240494 _____ C:\Windows\setupact.log
2013-08-22 10:22 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\rescache
2013-08-22 10:15 - 2012-05-27 13:34 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-22 10:15 - 2012-05-27 13:33 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-22 10:15 - 2012-05-27 13:33 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-16 20:53 - 2013-08-16 20:50 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 20:50 - 2006-11-02 14:35 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-09 20:09 - 2012-08-29 13:22 - 00000000 ____D C:\Users\Notebook\Desktop\Sonstiges
2013-08-02 16:06 - 2013-08-28 13:24 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-02 06:09 - 2013-08-28 13:24 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

Files to move or delete:
====================
C:\Users\Notebook\AppData\Local\Temp\AskSLib.dll
C:\Users\Notebook\AppData\Local\Temp\Connection.dll
C:\Users\Notebook\AppData\Local\Temp\Dbwork.dll
C:\Users\Notebook\AppData\Local\Temp\Dialogs.dll
C:\Users\Notebook\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Notebook\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Notebook\AppData\Local\Temp\IPC.dll
C:\Users\Notebook\AppData\Local\Temp\Jobs.dll
C:\Users\Notebook\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\libeay32.dll
C:\Users\Notebook\AppData\Local\Temp\mfc80.dll
C:\Users\Notebook\AppData\Local\Temp\msvcp80.dll
C:\Users\Notebook\AppData\Local\Temp\msvcr80.dll
C:\Users\Notebook\AppData\Local\Temp\Permissions.dll
C:\Users\Notebook\AppData\Local\Temp\QFA.EXE
C:\Users\Notebook\AppData\Local\Temp\QfaInvoke.dll
C:\Users\Notebook\AppData\Local\Temp\Quarantine.exe
C:\Users\Notebook\AppData\Local\Temp\Report.dll
C:\Users\Notebook\AppData\Local\Temp\SkinMagic.dll
C:\Users\Notebook\AppData\Local\Temp\Smarti.dll
C:\Users\Notebook\AppData\Local\Temp\SmartiComm.dll
C:\Users\Notebook\AppData\Local\Temp\SmartIcon.exe
C:\Users\Notebook\AppData\Local\Temp\SmartSurfer.exe
C:\Users\Notebook\AppData\Local\Temp\smurf.dll
C:\Users\Notebook\AppData\Local\Temp\SmurfService.dll
C:\Users\Notebook\AppData\Local\Temp\SmurfService.exe
C:\Users\Notebook\AppData\Local\Temp\SmurfUpd.exe
C:\Users\Notebook\AppData\Local\Temp\SmurfUpdEng.exe
C:\Users\Notebook\AppData\Local\Temp\Sqlite.dll
C:\Users\Notebook\AppData\Local\Temp\ssleay32.dll
C:\Users\Notebook\AppData\Local\Temp\Threads.dll
C:\Users\Notebook\AppData\Local\Temp\Vars.dll
C:\Users\Notebook\AppData\Local\Temp\WEBDE_ServiceInstall.exe
C:\Users\Notebook\AppData\Local\Temp\Wizzard.dll
C:\Users\Notebook\AppData\Local\Temp\xmlparse.dll
C:\Users\Notebook\AppData\Local\Temp\xmltok.dll
C:\Users\Notebook\AppData\Local\Temp\{0B366C17-4154-4D3E-BE1A-0C2F023553D4}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{3F8FA7EE-CC38-4F2E-AF96-AB58A9119761}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{4CA146DB-6C38-4969-A8D0-D1419932BBC1}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{64B71A84-25A4-4C58-ADA8-800EF31AB4FE}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{672E0877-CF4F-43F7-90C8-CE2994E0FD50}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{A51F5C72-0E73-413E-9907-AA3727A6F527}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{BC21B5B5-7508-4B06-B3CE-DFEF7895E1F7}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{F11648AC-70F7-47AA-B0E7-73EF0F9B3874}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg7\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg7\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg45\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg45\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg44\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg44\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg42\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg42\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg41\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg41\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg40\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg40\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg39\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg39\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg38\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg38\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg37\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg37\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg36\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg36\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg35\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg35\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg34\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg34\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg33\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg33\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg32\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg32\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg30\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg30\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg29\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg29\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg28\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg28\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg27\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg27\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg26\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg26\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg25\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg25\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg24\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg24\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg23\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg23\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg22\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg22\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg21\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg21\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg20\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg20\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg19\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg19\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg18\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg18\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg17\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg17\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg16\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg16\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg15\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg15\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg14\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg14\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg13\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg13\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~rnsetup\pncrt.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetup\pnrs3260.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetu0\GEMSETUP\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetu0\GEMSETUP\pnrs3260.dll
C:\Users\Notebook\AppData\Local\Temp\{4DDA9E92-2FF5-4A60-B5EA-2D6F23D9395D}\InstallFlashPlayer.exe
C:\Users\Notebook\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_.exe
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avmres.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloader.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloader.exe
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloadergui.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcimage.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_de.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_en.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_es.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_fr.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_it.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_jp.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_ko.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_nl.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_pt.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_ru.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_tr.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_zhcn.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_zhtw.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\scewxmlw.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\update.dll
C:\Users\Notebook\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\64bitProxy.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aebb.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aecore.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeemu.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeexp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aegen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aehelp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeheur.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeoffice.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aepack.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aerdl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aesbx.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aescn.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aescript.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aevdf.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\apcfile.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnIC.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnStub.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnToolbarInstaller.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_64.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_API.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_CLI.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avacl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avadmin.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avarkt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avbb.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avcenter.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avconfig.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avconfig.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avesvc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avevtlog.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avgio.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avgnt.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avguard.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avinet.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avipc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avlode.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avmres.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avnotify.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avpref.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avreg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avrep.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avrestart.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avscan.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avscplr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsda.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsda64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsmtp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avupgsvc.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebgrd.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloader.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloader.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloadergui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwinll.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwmi.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwsc.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccavscanex.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccev.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccevw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgenw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgrdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccguard.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cchips.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cclic.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cclicw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccmsg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccprofil.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccquamgr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccquaw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccreport.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccrepow.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccscanw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccsched.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccschedw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccupdate.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccupdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwebtabs.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwgrd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwgrdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwkrlib.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cfglib.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\extdlgfw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\fact.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpavgio.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpevtlog.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgavid.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgenrep.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgrd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpipc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gplegacy.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpschd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\grdcore.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\guardgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\imp64b.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\inssda64.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\insthlp.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ipmgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libapr-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libapriconv-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libaprutil-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libcurl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libdb44.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libeay32.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\licmgr.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\luke.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\mgrs.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msgclient.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msvcp80.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msvcr80.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\netnt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\onlcfg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\presetup.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ar.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_de.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_en.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_es.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_fr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_it.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_jp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ko.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_nl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_pt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ru.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_tr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_zhcn.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_zhtw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\scewxmlw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\sched.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\setup.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\setuppending.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\shlext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\shlext64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\sqlite3.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ssleay32.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\thorwac.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\toastNotifier.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\unacev2.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\update.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\update.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updgui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updrgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vcredist_x86.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\wksstats.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\wsctool.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\xp\avshadow.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vista64\avipc64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vista64\avshadow.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avconfigrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avesvcr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avevtrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avnotify.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avscanrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avwebgrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccavscanexrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccevrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccgenrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccgrdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\cchipsrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\cclicrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccmainrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccmsgrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccquarc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccreporc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccscanrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccscherc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccupdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccwebtabsrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccwgrdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\factrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\guardmsg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\licmgr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\lukeres.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rchelp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rcimage.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rctext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\restartrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\schedr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\setup.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\updaterc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\updguirc.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\GoogleEarth.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthflashsol.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthps.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\ge_expat.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth_free.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\gpsbabel.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\Plugins\npgeinprocessplugin.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-28 18:46

==================== End Of Log ============================
--- --- ---
Alt 29.08.2013, 04:28   #6
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Windows Vista Trojaner

Alt 29.08.2013, 20:27   #7
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


1. Also, beim dem eset scanner hat er mir 2 Funde angezeigt (vermutlich einen mehr, weil ich auch ne externe Festplatte angeschlossen habe?!). Sind die Funde jetzt entfernt worden?

2. Außerdem: als ich das Programm geschlossen habe, wurde angezeigt, dass der eset scanner nicht richtig installiert wurde. Wie würde ich das merken? Soll ich alles nochmal machen?

3. Und noch ne Frage zu der Anitmalware, die den ersten Fund gemeldet hat: der erste Fund ist ja da in Quarantäne. Und ich würde das ganz gerne deinstalllieren, da es nur eine Testversion war. Muss ich dabei was beachten oder kann ich es einfach deinstallieren? Nun die gewünschten log-files:

ESETSmartInstaller@High as downloader log:
Can not read file from internet.ESETSmartInstaller@High as downloader log:
Can not read file from internet.# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4d9de5cc3ca4c1469d6e8112e8202b79
# engine=14944
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-29 06:45:53
# local_time=2013-08-29 08:45:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 96 8867 148473258 1638 0
# compatibility_mode=5892 16776574 100 100 15914996 215325859 0 0
# scanned=230720
# found=2
# cleaned=0
# scan_time=6692
sh=FA3D088F2B6B17BC71B8619E1D7D2D554D45C0FE ft=0 fh=0000000000000000 vn="INF/Autorun worm" ac=I fn="D:\autorun.inf"
sh=C775756621FD83B0D5DE135CCB7F7497237AE9D5 ft=1 fh=34aaa2cc4a9eb97d vn="Win32/AutoRun.VB.ET worm" ac=I fn="D:\Renate.exe"

Results of screen317's Security Check version 0.99.72
Windows Vista Service Pack 2 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
Java 7 Update 25
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (23.0.1)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by Notebook (administrator) on 29-08-2013 21:10:59
Running from C:\Users\Notebook\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(FileHippo.com) C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [305664 2009-03-31] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\system32\WLTRAY.exe [4119552 2008-12-21] (Dell Inc.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [2115664 2009-03-27] (Dell Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712 2008-06-15] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [462848 2009-03-31] (IDT, Inc.)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [248832 2010-08-09] (FileHippo.com)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [250192 2009-04-24] (Microsoft Corporation)
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128232 2009-02-05] (CyberLink Corp.)
HKLM-x32\...\Run: [DellSupportCenter] - "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-08-28] (RealNetworks, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hotmail.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://spiegel-online.de/
hxxp://www.sparkasse-regensburg.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {F5BA914F-3D00-4EC7-A916-4BE2094181D2} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Notebook\AppData\Roaming\Mozilla\Firefox\Profiles\ex7cij0m.default
FF SelectedSearchEngine: Yahoo
FF Homepage: hxxp://www.hotmail.de/|hxxp://spiegel-online.de/|hxxp://www.sparkasse-regensburg.de/
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\2.0.31005.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-07-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-03] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 wltrysvc; C:\Windows\System32\WLTRYSVC.EXE [32768 2008-12-21] ()
R2 yksvc; RUNDLL32.EXE ykx64coinst,serviceStartProc [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-01] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-29 18:38 - 2013-08-29 18:38 - 00891115 _____ C:\Users\Notebook\Desktop\SecurityCheck.exe
2013-08-28 18:54 - 2013-08-28 18:54 - 00001226 _____ C:\Users\Notebook\Desktop\JRT.txt
2013-08-28 18:47 - 2013-08-28 18:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 18:40 - 2013-08-28 18:40 - 00001445 _____ C:\Users\Notebook\Desktop\AdwCleaner[S0].txt
2013-08-28 18:37 - 2013-08-28 18:38 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:36 - 2013-08-28 18:36 - 01021434 _____ (Thisisu) C:\Users\Notebook\Desktop\JRT.exe
2013-08-28 18:35 - 2013-08-28 18:35 - 00994642 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-08-28 15:19 - 2013-08-28 15:19 - 00003998 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003208 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-08-28 15:19 - 2013-08-28 15:19 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-08-28 15:18 - 2013-08-28 15:19 - 00000000 ____D C:\Program Files\My Dell
2013-08-28 15:03 - 2013-08-28 15:04 - 00022594 _____ C:\Users\Notebook\Desktop\Addition.txt
2013-08-28 15:01 - 2013-08-28 15:01 - 00000000 ____D C:\FRST
2013-08-28 14:59 - 2013-08-28 14:59 - 01579080 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-08-28 13:56 - 2013-08-28 13:56 - 00000950 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 13:56 - 2013-08-28 13:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 13:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-28 13:52 - 2013-08-29 18:09 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-08-29 18:09 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:50 - 2013-08-28 13:52 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:37 - 2013-08-28 13:37 - 00001840 _____ C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2013-08-28 13:37 - 2013-08-28 13:37 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2013-08-02 16:06 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-28 13:24 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-18 10:40 - 2013-07-24 20:33 - 12509696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 09340928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 00742912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 11111936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 06016512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01585256 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01168088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-18 10:40 - 2013-07-08 06:51 - 04691904 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-18 10:40 - 2013-07-08 06:20 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-18 10:40 - 2013-07-08 06:18 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 06:15 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-18 10:40 - 2013-07-08 06:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 03:39 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-18 10:39 - 2013-07-24 20:33 - 02356736 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01538560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 20:33 - 01489408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 01212928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00916480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00611840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 02004992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 01469440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 02:32 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00387584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00043520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:22 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-18 10:39 - 2013-07-24 02:09 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 02:09 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-18 10:39 - 2013-07-24 01:56 - 00385024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-18 10:39 - 2013-07-24 01:49 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 01:49 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-18 10:27 - 2013-07-17 22:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-18 10:27 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-18 10:27 - 2013-07-10 11:47 - 00677888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-18 10:27 - 2013-07-10 11:42 - 01303552 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-18 10:27 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-18 10:27 - 2013-07-08 06:15 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 01276416 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-18 10:27 - 2013-07-05 06:45 - 01423808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-18 10:27 - 2013-06-15 15:27 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-18 10:27 - 2013-06-15 13:38 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 20:50 - 2013-08-16 20:53 - 00000000 ____D C:\Windows\system32\MRT

==================== One Month Modified Files and Folders =======

2013-08-29 21:10 - 2013-08-29 21:10 - 00001031 _____ C:\Users\Notebook\Desktop\checkup.txt
2013-08-29 21:07 - 2012-05-27 13:34 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-29 20:43 - 2012-08-29 13:30 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-29 20:08 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-29 20:08 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-29 18:41 - 2008-01-21 13:10 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-29 18:41 - 2008-01-21 13:09 - 00628992 _____ C:\Windows\system32\perfh007.dat
2013-08-29 18:41 - 2008-01-21 13:09 - 00126704 _____ C:\Windows\system32\perfc007.dat
2013-08-29 18:38 - 2013-08-29 18:38 - 00891115 _____ C:\Users\Notebook\Desktop\SecurityCheck.exe
2013-08-29 18:24 - 2009-09-23 19:51 - 00003982 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}
2013-08-29 18:24 - 2009-09-23 19:51 - 00000424 ____H C:\Windows\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}.job
2013-08-29 18:15 - 2009-09-17 09:13 - 01462114 _____ C:\Windows\WindowsUpdate.log
2013-08-29 18:09 - 2013-08-28 13:52 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-29 18:09 - 2013-08-28 13:52 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-29 18:08 - 2012-08-29 13:30 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-29 18:08 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-28 20:19 - 2006-11-02 17:42 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-28 18:54 - 2013-08-28 18:54 - 00001226 _____ C:\Users\Notebook\Desktop\JRT.txt
2013-08-28 18:47 - 2013-08-28 18:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 18:40 - 2013-08-28 18:40 - 00001445 _____ C:\Users\Notebook\Desktop\AdwCleaner[S0].txt
2013-08-28 18:38 - 2013-08-28 18:37 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:36 - 2013-08-28 18:36 - 01021434 _____ (Thisisu) C:\Users\Notebook\Desktop\JRT.exe
2013-08-28 18:35 - 2013-08-28 18:35 - 00994642 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-08-28 15:19 - 2013-08-28 15:19 - 00003998 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003208 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-08-28 15:19 - 2013-08-28 15:19 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-08-28 15:19 - 2013-08-28 15:18 - 00000000 ____D C:\Program Files\My Dell
2013-08-28 15:19 - 2011-07-15 16:23 - 00000000 ____D C:\Program Files\Dell Support Center
2013-08-28 15:18 - 2009-09-17 14:47 - 00000000 ____D C:\ProgramData\PCDr
2013-08-28 15:04 - 2013-08-28 15:03 - 00022594 _____ C:\Users\Notebook\Desktop\Addition.txt
2013-08-28 15:01 - 2013-08-28 15:01 - 00000000 ____D C:\FRST
2013-08-28 14:59 - 2013-08-28 14:59 - 01579080 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-08-28 14:18 - 2013-03-01 15:30 - 00000000 ____D C:\Windows\pss
2013-08-28 14:18 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-28 14:05 - 2008-01-21 05:26 - 00485276 _____ C:\Windows\PFRO.log
2013-08-28 13:56 - 2013-08-28 13:56 - 00000950 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 13:56 - 2013-08-28 13:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:52 - 2013-08-28 13:50 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:52 - 2009-09-24 14:27 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Real
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:51 - 2009-09-24 14:27 - 00000000 ____D C:\Program Files (x86)\Real
2013-08-28 13:50 - 2009-09-24 14:27 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-08-28 13:50 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-08-28 13:50 - 2009-09-17 14:55 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-08-28 13:50 - 2009-09-17 14:55 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:43 - 2009-09-24 13:12 - 00000000 ____D C:\Users\Notebook\AppData\Local\Paint.NET
2013-08-28 13:42 - 2009-09-23 19:34 - 00000992 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-28 13:41 - 2009-09-23 19:34 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-28 13:37 - 2013-08-28 13:37 - 00001840 _____ C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
2013-08-28 13:37 - 2013-08-28 13:37 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2012-06-24 13:53 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-08-28 13:24 - 2010-10-24 18:53 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-27 10:56 - 2012-08-29 13:30 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-22 10:23 - 2006-11-02 17:27 - 00240494 _____ C:\Windows\setupact.log
2013-08-22 10:22 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\rescache
2013-08-22 10:15 - 2012-05-27 13:34 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-22 10:15 - 2012-05-27 13:33 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-22 10:15 - 2012-05-27 13:33 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-16 20:53 - 2013-08-16 20:50 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 20:50 - 2006-11-02 14:35 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-09 20:09 - 2012-08-29 13:22 - 00000000 ____D C:\Users\Notebook\Desktop\Sonstiges
2013-08-02 16:06 - 2013-08-28 13:24 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-02 06:09 - 2013-08-28 13:24 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

Files to move or delete:
====================
C:\Users\Notebook\AppData\Local\Temp\AskSLib.dll
C:\Users\Notebook\AppData\Local\Temp\Connection.dll
C:\Users\Notebook\AppData\Local\Temp\Dbwork.dll
C:\Users\Notebook\AppData\Local\Temp\Dialogs.dll
C:\Users\Notebook\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Notebook\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Notebook\AppData\Local\Temp\IPC.dll
C:\Users\Notebook\AppData\Local\Temp\Jobs.dll
C:\Users\Notebook\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Notebook\AppData\Local\Temp\libeay32.dll
C:\Users\Notebook\AppData\Local\Temp\mfc80.dll
C:\Users\Notebook\AppData\Local\Temp\msvcp80.dll
C:\Users\Notebook\AppData\Local\Temp\msvcr80.dll
C:\Users\Notebook\AppData\Local\Temp\Permissions.dll
C:\Users\Notebook\AppData\Local\Temp\QFA.EXE
C:\Users\Notebook\AppData\Local\Temp\QfaInvoke.dll
C:\Users\Notebook\AppData\Local\Temp\Quarantine.exe
C:\Users\Notebook\AppData\Local\Temp\Report.dll
C:\Users\Notebook\AppData\Local\Temp\SkinMagic.dll
C:\Users\Notebook\AppData\Local\Temp\Smarti.dll
C:\Users\Notebook\AppData\Local\Temp\SmartiComm.dll
C:\Users\Notebook\AppData\Local\Temp\SmartIcon.exe
C:\Users\Notebook\AppData\Local\Temp\SmartSurfer.exe
C:\Users\Notebook\AppData\Local\Temp\smurf.dll
C:\Users\Notebook\AppData\Local\Temp\SmurfService.dll
C:\Users\Notebook\AppData\Local\Temp\SmurfService.exe
C:\Users\Notebook\AppData\Local\Temp\SmurfUpd.exe
C:\Users\Notebook\AppData\Local\Temp\SmurfUpdEng.exe
C:\Users\Notebook\AppData\Local\Temp\Sqlite.dll
C:\Users\Notebook\AppData\Local\Temp\ssleay32.dll
C:\Users\Notebook\AppData\Local\Temp\Threads.dll
C:\Users\Notebook\AppData\Local\Temp\Vars.dll
C:\Users\Notebook\AppData\Local\Temp\WEBDE_ServiceInstall.exe
C:\Users\Notebook\AppData\Local\Temp\Wizzard.dll
C:\Users\Notebook\AppData\Local\Temp\xmlparse.dll
C:\Users\Notebook\AppData\Local\Temp\xmltok.dll
C:\Users\Notebook\AppData\Local\Temp\{0B366C17-4154-4D3E-BE1A-0C2F023553D4}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{3F8FA7EE-CC38-4F2E-AF96-AB58A9119761}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{4CA146DB-6C38-4969-A8D0-D1419932BBC1}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{64B71A84-25A4-4C58-ADA8-800EF31AB4FE}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{672E0877-CF4F-43F7-90C8-CE2994E0FD50}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{A51F5C72-0E73-413E-9907-AA3727A6F527}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\{BC21B5B5-7508-4B06-B3CE-DFEF7895E1F7}-GoogleEarth-Win-Bundle-7.1.1.1888.exe
C:\Users\Notebook\AppData\Local\Temp\{F11648AC-70F7-47AA-B0E7-73EF0F9B3874}-GoogleEarth-Win-Bundle-7.0.3.8542.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg7\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg7\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg45\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg45\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg44\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg44\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg42\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg42\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg41\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg41\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg40\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg40\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg39\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg39\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg38\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg38\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg37\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg37\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg36\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg36\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg35\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg35\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg34\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg34\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg33\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg33\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg32\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg32\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg30\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg30\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg29\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg29\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg28\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg28\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg27\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg27\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg26\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg26\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg25\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg25\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg24\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg24\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg23\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg23\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg22\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg22\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg21\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg21\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg20\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg20\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg19\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg19\rnupgagent.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg18\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg18\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg17\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg17\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg16\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg16\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg15\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg15\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg14\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg14\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~Upg13\install.dll
C:\Users\Notebook\AppData\Local\Temp\~Upg13\setup.exe
C:\Users\Notebook\AppData\Local\Temp\~rnsetup\pncrt.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetup\pnrs3260.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetu0\GEMSETUP\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\~rnsetu0\GEMSETUP\pnrs3260.dll
C:\Users\Notebook\AppData\Local\Temp\{4DDA9E92-2FF5-4A60-B5EA-2D6F23D9395D}\InstallFlashPlayer.exe
C:\Users\Notebook\AppData\Local\Temp\TeamViewer\Version6\TeamViewer_.exe
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avmres.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloader.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloader.exe
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\avwebloadergui.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcimage.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_de.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_en.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_es.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_fr.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_it.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_jp.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_ko.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_nl.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_pt.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_ru.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_tr.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_zhcn.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\rcnwload_zhtw.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\scewxmlw.dll
C:\Users\Notebook\AppData\Local\Temp\RarSFX0\update.dll
C:\Users\Notebook\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\64bitProxy.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aebb.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aecore.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeemu.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeexp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aegen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aehelp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeheur.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aeoffice.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aepack.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aerdl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aesbx.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aescn.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aescript.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\aevdf.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\apcfile.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnIC.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnStub.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ApnToolbarInstaller.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_64.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_API.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\AppRemover_CLI.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avacl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avadmin.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avarkt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avbb.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avcenter.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avconfig.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avconfig.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avesvc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avevtlog.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avgio.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avgnt.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avguard.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avinet.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avipc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avlode.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avmres.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avnotify.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avpref.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avreg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avrep.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avrestart.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avscan.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avscplr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsda.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsda64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avsmtp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avupgsvc.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebgrd.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloader.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloader.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwebloadergui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwinll.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwmi.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\avwsc.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccavscanex.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccev.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccevw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgenw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccgrdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccguard.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cchips.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cclic.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cclicw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccmsg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccprofil.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccquamgr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccquaw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccreport.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccrepow.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccscanw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccsched.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccschedw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccupdate.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccupdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwebtabs.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwgrd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwgrdw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ccwkrlib.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\cfglib.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\extdlgfw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\fact.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpavgio.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpevtlog.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgavid.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgen.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgenrep.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgrd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpgui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpipc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gplegacy.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\gpschd.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\grdcore.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\guardgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\imp64b.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\inssda64.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\insthlp.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ipmgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libapr-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libapriconv-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libaprutil-1.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libcurl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libdb44.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\libeay32.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\licmgr.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\luke.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\mgrs.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msgclient.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msvcp80.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\msvcr80.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\netnt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\onlcfg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\presetup.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ar.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_de.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_en.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_es.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_fr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_it.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_jp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ko.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_nl.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_pt.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_ru.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_tr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_zhcn.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\rcnwload_zhtw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\scewxmlw.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\sched.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\setup.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\setuppending.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\shlext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\shlext64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\sqlite3.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\ssleay32.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\thorwac.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\toastNotifier.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\unacev2.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\update.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\update.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updgui.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\updrgui.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vcredist_x86.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\wksstats.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\wsctool.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\xp\avshadow.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vista64\avipc64.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\vista64\avshadow.exe
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avconfigrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avesvcr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avevtrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avnotify.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avscanrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\avwebgrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccavscanexrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccevrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccgenrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccgrdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\cchipsrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\cclicrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccmainrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccmsgrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccquarc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccreporc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccscanrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccscherc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccupdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccwebtabsrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\ccwgrdrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\factrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\guardmsg.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\licmgr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\lukeres.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rchelp.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rcimage.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\rctext.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\restartrc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\schedr.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\setup.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\updaterc.dll
C:\Users\Notebook\AppData\Local\Temp\avnwldrtemp\setup\de-de\updguirc.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\GoogleEarth.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\earthps.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\geplugin.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\ge_expat.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\googleearth_free.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\npgeplugin.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\plugin\plugin_ax.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthflashsol.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\earthps.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\ge_expat.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\googleearth_free.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\gpsbabel.exe
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcp100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\msvcr100.dll
C:\Users\Notebook\AppData\Local\Temp\._msige61\program files\Google\Google Earth\client\Plugins\npgeinprocessplugin.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-29 18:15

==================== End Of Log ============================
--- --- ---
Alt 30.08.2013, 13:32   #8
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Adobe updaten. MBAM einfach deinstallieren.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.


Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
D:\autorun.inf
D:\Renate.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 30.08.2013, 15:50   #9
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


War mir nicht sicher, ob ich TFC mit der externen Festplatte dran laufen lassen soll. Hab beides gemacht. Das FRST hab ich erst mit der Festplatte dran gestartet, da konnte das Programm nicht ausgeführt werden. Dann hab ich es ohne die externe Festplatte ausgeführt. Darauf kam dann folgender Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-08-2013
Ran by Notebook at 2013-08-30 16:44:52 Run:2
Running from C:\Users\Notebook\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
D:\autorun.inf
D:\Renate.exe
*****************

"D:\autorun.inf" => File/Directory not found.
"D:\Renate.exe" => File/Directory not found.

==== End of Fixlog ====


Ich kann erst wieder Sonntag Abend antworten. Sorry. Schönes Wochenende.

Alt 30.08.2013, 20:36   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Schau mal ob die Dateien auf D noch da sind und poste bitte ein frisches FRST log.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.09.2013, 17:13   #11
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Ja, die Dateien sind noch da. Hab noch mal eset drüber laufen lassen. Hier das gewünschte FRST logfile
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-09-2013 04
Ran by Notebook (administrator) on NOTEBOOK-PC on 02-09-2013 17:44:42
Running from C:\Users\Notebook\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Windows\System32\WLTRYSVC.EXE
(Dell Inc.) C:\Windows\System32\bcmwltry.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_15f4e438\AESTSr64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Dell Inc.) C:\Windows\System32\WLTRAY.EXE
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [305664 2009-03-31] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\system32\WLTRAY.exe [4119552 2008-12-21] (Dell Inc.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [2115664 2009-03-27] (Dell Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712 2008-06-15] (Intel Corporation)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [462848 2009-03-31] (IDT, Inc.)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe [x]
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [250192 2009-04-24] (Microsoft Corporation)
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128232 2009-02-05] (CyberLink Corp.)
HKLM-x32\...\Run: [DellSupportCenter] - "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-08-28] (RealNetworks, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hotmail.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://spiegel-online.de/
hxxp://www.sparkasse-regensburg.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {F5BA914F-3D00-4EC7-A916-4BE2094181D2} URL = hxxp://www.google.de/search?q={searchTerms}
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Notebook\AppData\Roaming\Mozilla\Firefox\Profiles\ex7cij0m.default
FF DefaultSearchEngine: Yahoo
FF SelectedSearchEngine: Yahoo
FF Homepage: hxxp://www.hotmail.de/|hxxp://spiegel-online.de/|hxxp://www.sparkasse-regensburg.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\2.0.31005.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 wltrysvc; C:\Windows\System32\WLTRYSVC.EXE [32768 2008-12-21] ()
R2 yksvc; RUNDLL32.EXE ykx64coinst,serviceStartProc [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-01] (Avira Operations GmbH & Co. KG)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-02 15:50 - 2013-09-02 15:50 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-02 15:34 - 2013-09-02 15:34 - 02347384 _____ (ESET) C:\Users\Notebook\Desktop\esetsmartinstaller_enu.exe
2013-09-02 09:31 - 2013-09-02 09:31 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Notebook\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-30 16:04 - 2013-08-30 16:04 - 00000813 _____ C:\Users\Notebook\Desktop\h.txt
2013-08-30 16:03 - 2013-08-30 16:03 - 00448512 _____ (OldTimer Tools) C:\Users\Notebook\Desktop\TFC.exe
2013-08-30 14:26 - 2013-08-30 14:27 - 00001919 _____ C:\Users\Public\Desktop\Adobe Reader 9.lnk
2013-08-30 09:17 - 2013-08-30 09:17 - 00000000 ____D C:\Users\Notebook\AppData\Local\Macromedia
2013-08-30 09:02 - 2013-08-30 09:02 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-29 21:12 - 2013-08-29 21:12 - 00059321 _____ C:\Users\Notebook\Desktop\FRST1.txt
2013-08-29 21:10 - 2013-08-29 21:10 - 00001031 _____ C:\Users\Notebook\Desktop\checkup.txt
2013-08-29 18:38 - 2013-08-29 18:38 - 00891115 _____ C:\Users\Notebook\Desktop\SecurityCheck.exe
2013-08-28 18:54 - 2013-08-28 18:54 - 00001226 _____ C:\Users\Notebook\Desktop\JRT.txt
2013-08-28 18:47 - 2013-08-28 18:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 18:40 - 2013-08-28 18:40 - 00001445 _____ C:\Users\Notebook\Desktop\AdwCleaner[S0].txt
2013-08-28 18:37 - 2013-08-28 18:38 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:36 - 2013-08-28 18:36 - 01021434 _____ (Thisisu) C:\Users\Notebook\Desktop\JRT.exe
2013-08-28 18:35 - 2013-08-28 18:35 - 00994642 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-08-28 15:19 - 2013-09-02 15:43 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003998 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003208 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-08-28 15:19 - 2013-08-28 15:19 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-08-28 15:18 - 2013-08-28 15:19 - 00000000 ____D C:\Program Files\My Dell
2013-08-28 15:03 - 2013-08-28 15:04 - 00022594 _____ C:\Users\Notebook\Desktop\Addition.txt
2013-08-28 15:01 - 2013-08-28 15:01 - 00000000 ____D C:\FRST
2013-08-28 13:52 - 2013-09-02 15:31 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-09-02 15:31 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:50 - 2013-08-28 13:52 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:37 - 2013-08-30 09:18 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2013-08-02 16:06 - 01706496 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-28 13:24 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-18 10:40 - 2013-07-24 20:33 - 12509696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 09340928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-18 10:40 - 2013-07-24 20:33 - 00742912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 11111936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-18 10:40 - 2013-07-24 02:32 - 06016512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01585256 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-18 10:40 - 2013-07-09 14:04 - 01168088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-18 10:40 - 2013-07-08 06:51 - 04691904 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-18 10:40 - 2013-07-08 06:20 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-18 10:40 - 2013-07-08 06:18 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 06:15 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-18 10:40 - 2013-07-08 06:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-08-18 10:40 - 2013-07-08 03:39 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-18 10:40 - 2013-07-08 03:39 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-18 10:39 - 2013-07-24 20:33 - 02356736 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01538560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 20:33 - 01489408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 20:33 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 01212928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00916480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00611840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-08-18 10:39 - 2013-07-24 02:33 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 02004992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 01469440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-18 10:39 - 2013-07-24 02:32 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00387584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00043520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-08-18 10:39 - 2013-07-24 02:32 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-18 10:39 - 2013-07-24 02:22 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-18 10:39 - 2013-07-24 02:09 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 02:09 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 02:09 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-18 10:39 - 2013-07-24 01:56 - 00385024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-08-18 10:39 - 2013-07-24 01:49 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-18 10:39 - 2013-07-24 01:49 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-18 10:39 - 2013-07-24 01:49 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-08-18 10:27 - 2013-07-17 22:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-18 10:27 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-18 10:27 - 2013-07-10 11:47 - 00677888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-18 10:27 - 2013-07-10 11:42 - 01303552 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-18 10:27 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-18 10:27 - 2013-07-08 06:15 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 01276416 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-18 10:27 - 2013-07-08 06:12 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-18 10:27 - 2013-07-05 06:45 - 01423808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-18 10:27 - 2013-06-15 15:27 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-18 10:27 - 2013-06-15 13:38 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 20:50 - 2013-08-16 20:53 - 00000000 ____D C:\Windows\system32\MRT

==================== One Month Modified Files and Folders =======

2013-09-02 17:44 - 2013-09-02 17:44 - 01951950 _____ (Farbar) C:\Users\Notebook\Desktop\FRST64.exe
2013-09-02 17:43 - 2012-08-29 13:30 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-02 17:30 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-02 17:30 - 2006-11-02 17:22 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-02 17:07 - 2012-05-27 13:34 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-02 15:50 - 2013-09-02 15:50 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-02 15:43 - 2013-08-28 15:19 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-09-02 15:39 - 2013-04-01 10:31 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-02 15:39 - 2013-04-01 10:31 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-09-02 15:35 - 2009-09-17 09:13 - 01526570 _____ C:\Windows\WindowsUpdate.log
2013-09-02 15:34 - 2013-09-02 15:34 - 02347384 _____ (ESET) C:\Users\Notebook\Desktop\esetsmartinstaller_enu.exe
2013-09-02 15:31 - 2013-08-28 13:52 - 00003352 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-09-02 15:31 - 2013-08-28 13:52 - 00003224 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3662071480-2160519904-3827952930-1000
2013-09-02 15:31 - 2012-08-29 13:30 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-02 15:30 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-02 09:48 - 2006-11-02 17:42 - 00032510 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-02 09:31 - 2013-09-02 09:31 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Notebook\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-02 09:12 - 2009-09-23 19:51 - 00003982 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}
2013-09-02 09:12 - 2009-09-23 19:51 - 00000424 ____H C:\Windows\Tasks\User_Feed_Synchronization-{48C094BC-A2A6-42F0-8064-E2A12E55E201}.job
2013-08-30 16:37 - 2008-01-21 05:26 - 00488556 _____ C:\Windows\PFRO.log
2013-08-30 16:04 - 2013-08-30 16:04 - 00000813 _____ C:\Users\Notebook\Desktop\h.txt
2013-08-30 16:03 - 2013-08-30 16:03 - 00448512 _____ (OldTimer Tools) C:\Users\Notebook\Desktop\TFC.exe
2013-08-30 14:27 - 2013-08-30 14:26 - 00001919 _____ C:\Users\Public\Desktop\Adobe Reader 9.lnk
2013-08-30 14:26 - 2009-10-05 19:41 - 00000000 ____D C:\Users\Notebook\AppData\Local\Adobe
2013-08-30 14:26 - 2009-09-17 14:41 - 00000000 ____D C:\ProgramData\Adobe
2013-08-30 09:18 - 2013-08-28 13:37 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
2013-08-30 09:17 - 2013-08-30 09:17 - 00000000 ____D C:\Users\Notebook\AppData\Local\Macromedia
2013-08-30 09:16 - 2012-05-27 13:34 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-30 09:16 - 2012-05-27 13:33 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-30 09:16 - 2012-05-27 13:33 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-30 09:02 - 2013-08-30 09:02 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-29 21:12 - 2013-08-29 21:12 - 00059321 _____ C:\Users\Notebook\Desktop\FRST1.txt
2013-08-29 21:10 - 2013-08-29 21:10 - 00001031 _____ C:\Users\Notebook\Desktop\checkup.txt
2013-08-29 18:41 - 2008-01-21 13:10 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-29 18:41 - 2008-01-21 13:09 - 00628992 _____ C:\Windows\system32\perfh007.dat
2013-08-29 18:41 - 2008-01-21 13:09 - 00126704 _____ C:\Windows\system32\perfc007.dat
2013-08-29 18:38 - 2013-08-29 18:38 - 00891115 _____ C:\Users\Notebook\Desktop\SecurityCheck.exe
2013-08-28 18:54 - 2013-08-28 18:54 - 00001226 _____ C:\Users\Notebook\Desktop\JRT.txt
2013-08-28 18:47 - 2013-08-28 18:47 - 00000000 ____D C:\Windows\ERUNT
2013-08-28 18:40 - 2013-08-28 18:40 - 00001445 _____ C:\Users\Notebook\Desktop\AdwCleaner[S0].txt
2013-08-28 18:38 - 2013-08-28 18:37 - 00000000 ____D C:\AdwCleaner
2013-08-28 18:36 - 2013-08-28 18:36 - 01021434 _____ (Thisisu) C:\Users\Notebook\Desktop\JRT.exe
2013-08-28 18:35 - 2013-08-28 18:35 - 00994642 _____ C:\Users\Notebook\Desktop\adwcleaner.exe
2013-08-28 15:19 - 2013-08-28 15:19 - 00003998 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-08-28 15:19 - 2013-08-28 15:19 - 00003208 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-08-28 15:19 - 2013-08-28 15:19 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-08-28 15:19 - 2013-08-28 15:18 - 00000000 ____D C:\Program Files\My Dell
2013-08-28 15:19 - 2011-07-15 16:23 - 00000000 ____D C:\Program Files\Dell Support Center
2013-08-28 15:18 - 2009-09-17 14:47 - 00000000 ____D C:\ProgramData\PCDr
2013-08-28 15:04 - 2013-08-28 15:03 - 00022594 _____ C:\Users\Notebook\Desktop\Addition.txt
2013-08-28 15:01 - 2013-08-28 15:01 - 00000000 ____D C:\FRST
2013-08-28 14:18 - 2013-03-01 15:30 - 00000000 ____D C:\Windows\pss
2013-08-28 14:18 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-08-28 13:52 - 2013-08-28 13:52 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\RealNetworks
2013-08-28 13:52 - 2013-08-28 13:50 - 00000000 ____D C:\ProgramData\Real
2013-08-28 13:52 - 2009-09-24 14:27 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Real
2013-08-28 13:51 - 2013-08-28 13:51 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\ProgramData\RealNetworks
2013-08-28 13:51 - 2013-08-28 13:51 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-08-28 13:51 - 2009-09-24 14:27 - 00000000 ____D C:\Program Files (x86)\Real
2013-08-28 13:50 - 2009-09-24 14:27 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-08-28 13:50 - 2009-09-23 18:39 - 00000000 ___RD C:\Users\Notebook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-08-28 13:50 - 2009-09-17 14:55 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-08-28 13:50 - 2009-09-17 14:55 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-08-28 13:46 - 2013-08-28 13:46 - 00000890 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Roaming\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Users\Notebook\AppData\Local\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-28 13:46 - 2013-08-28 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-28 13:43 - 2009-09-24 13:12 - 00000000 ____D C:\Users\Notebook\AppData\Local\Paint.NET
2013-08-28 13:42 - 2009-09-23 19:34 - 00000992 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-28 13:41 - 2009-09-23 19:34 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-28 13:24 - 2013-08-28 13:24 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-08-28 13:24 - 2013-08-28 13:24 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-08-28 13:24 - 2013-08-28 13:24 - 00000000 ____D C:\Program Files (x86)\Java
2013-08-28 13:24 - 2012-06-24 13:53 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-08-28 13:24 - 2010-10-24 18:53 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-08-27 10:57 - 2013-08-27 10:57 - 00002117 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-27 10:56 - 2012-08-29 13:30 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-22 10:23 - 2013-08-22 10:23 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2013-08-22 10:23 - 2006-11-02 17:27 - 00240494 _____ C:\Windows\setupact.log
2013-08-22 10:22 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\rescache
2013-08-16 20:53 - 2013-08-16 20:50 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 20:50 - 2006-11-02 14:35 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-09 20:09 - 2012-08-29 13:22 - 00000000 ____D C:\Users\Notebook\Desktop\Sonstiges

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-02 15:37

==================== End Of Log ============================
--- --- ---
Alt 02.09.2013, 19:18   #12
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Kannste die Dateien von Hand löschen?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.09.2013, 10:09   #13
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Eine Datei konnte ich löschen. Die andere: "Win32/AutoRun.VB.ET worm" aber nicht. Die finde ich nicht. Ich habs mit der Suchfunktion probiert, aber kein Erfolg. Wie könnte ich die sonst finden?

MfG.

Alt 03.09.2013, 11:37   #14
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Versteckte Dateien anzeigen lassen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.09.2013, 12:40   #15
ela11
 
Windows Vista Trojaner - Standard

Windows Vista Trojaner


Ah, super, danke. Antivir hat drauf reagiert und jetzt ist die Datei dort in Quarantäne. Was soll ich jetzt damit machen?

Antwort
Seite 1 von 2 1 2

Themen zu Windows Vista Trojaner
administrator, anti-malware, antimalware, appdata, autostart, betriebssystem, computer, dateien, explorer, gelöscht, gen, java, laptop, logfile, scan, service pack 2, speicher, temp, trojaner, updates, version, viren, vista, windows, windows vista


« Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt | Frage zu HEUR:Trojan.Win32.Generic »


Ähnliche Themen: Windows Vista Trojaner


  1. GVU Trojaner auf Windows Vista
    Log-Analyse und Auswertung - 19.04.2014 (12)
  2. GVU - Trojaner in Windows Vista
    Plagegeister aller Art und deren Bekämpfung - 09.12.2013 (2)
  3. Windows Vista Trojaner
    Log-Analyse und Auswertung - 09.10.2013 (17)
  4. GVU Trojaner auf windows vista
    Plagegeister aller Art und deren Bekämpfung - 02.09.2013 (1)
  5. gvu trojaner windows vista
    Plagegeister aller Art und deren Bekämpfung - 21.08.2013 (23)
  6. GVU Trojaner Windows Vista
    Log-Analyse und Auswertung - 22.07.2013 (1)
  7. GVU/Trojaner Windows Vista
    Plagegeister aller Art und deren Bekämpfung - 09.05.2013 (5)
  8. GVU-Trojaner auf Windows Vista
    Plagegeister aller Art und deren Bekämpfung - 27.03.2013 (1)
  9. GVU- Trojaner Windows Vista
    Log-Analyse und Auswertung - 20.01.2013 (7)
  10. GVU Trojaner , Windows Vista
    Plagegeister aller Art und deren Bekämpfung - 13.01.2013 (23)
  11. GVU Trojaner 2.07 auf Windows Vista
    Log-Analyse und Auswertung - 28.10.2012 (24)
  12. BKA Trojaner 1.15 (Windows Vista)
    Log-Analyse und Auswertung - 05.10.2012 (37)
  13. GUV Trojaner Windows Vista
    Log-Analyse und Auswertung - 01.08.2012 (3)
  14. Windows Vista GVU Trojaner
    Plagegeister aller Art und deren Bekämpfung - 27.05.2012 (8)
  15. Infiziert mit Windows-Verschlüsselungs Trojaner -Mail mit Telefonrechnung - windows vista
    Plagegeister aller Art und deren Bekämpfung - 06.05.2012 (12)
  16. BKA-Trojaner Windows Vista
    Plagegeister aller Art und deren Bekämpfung - 25.03.2012 (1)
  17. Windows Vista Home Premium 32-Bit Trojaner Windows gesperrt 50€ zahlen.
    Log-Analyse und Auswertung - 23.01.2012 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows Vista Trojaner - Hallo, ein Bekannter, der nicht so fit in Sachen Computer ist, hat mir seinen Laptop (Betriebssystem: Windows Vista) gegeben, damit ich was installiere. Davor hab ich ein paar Updates (z.B. - Windows Vista Trojaner...
Archiv
Du betrachtest: Windows Vista Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131