Windows 7: intermittierend auftauchendes weißes Popup in Firefox und "OfferMosquito 0.6.1" in Add-ons

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.29.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
***** :: *****-PC [Administrator]

29.08.2013 12:43:48
mbam-log-2013-08-29 (12-43-48).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 224734
Laufzeit: 4 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

# AdwCleaner v3.001 - Report created 29/08/2013 at 12:55:03
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : ***** - *****-PC
# Running from : C:\Users\*****\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\*****\AppData\Roaming\Common\LuaRT
Folder Deleted : C:\Users\*****\AppData\Roaming\Intermediate
Folder Deleted : C:\Users\*****\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\*****\AppData\Roaming\SCheck
Folder Deleted : C:\Users\*****\AppData\Roaming\SSync
File Deleted : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\2o7lhtcm.default-1363849301667\Extensions\om@offermosquito.com.xpi

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Intermediate]
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [scheck]
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [ssync]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKCU\Software\httogroup
Key Deleted : HKCU\Software\piccshare

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Mozilla Firefox v23.0.1 (de)

[ File : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\2o7lhtcm.default-1363849301667\prefs.js ]

Line Deleted : user_pref("om.config", "{\"active\":true,\"name\":\"twde\",\"id\":25,\"dispId\":\"CH-25\",\"aboutLink\":\"\",\"trackingGeneral\":true,\"gaAccount\":\"UA-39484183-1\",\"gaDomain\":\"offermosquito.com\"[...]

*************************

AdwCleaner[R0].txt - [2192 octets] - [29/08/2013 12:54:06]
AdwCleaner[S0].txt - [2071 octets] - [29/08/2013 12:55:03]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2131 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.5 (08.28.2013:1)
OS: Windows 7 Professional x64
Ran by Sikora on 29.08.2013 at 13:04:15,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Emptied folder: C:\Users\Sikora\AppData\Roaming\mozilla\firefox\profiles\2o7lhtcm.default-1363849301667\minidumps [259 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.08.2013 at 13:12:28,69
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by ***** (administrator) on 29-08-2013 13:20:20
Running from C:\Users\*****\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
(Seiko Epson Corporation) C:\Windows\system32\EscSvc64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(Fred's Software) C:\Program Files (x86)\PrintKey2000\Printkey2000.exe
(Dropbox, Inc.) C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564016 2013-07-26] (Samsung)
HKCU\...\Run: [Snoozer] - C:\Users\*****\AppData\Roaming\Snz\Snz.exe [1137764 2013-08-28] ()
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-26] (Samsung Electronics Co., Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Printkey2000.lnk
ShortcutTarget: Printkey2000.lnk -> C:\Program Files (x86)\PrintKey2000\Printkey2000.exe (Fred's Software)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\2o7lhtcm.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-07-04] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [39768 2013-02-18] (AVG Technologies)
R3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [29184 2009-08-13] (CSR, plc)
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ATK64AMD.sys [13680 2007-08-09] ()
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-12-18] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-12-18] (RapidSolution Software AG)
R3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation                           )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [203672 2013-06-04] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-03] (TuneUp Software)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-29 13:04 - 2013-08-29 13:04 - 00000000 ____D C:\Windows\ERUNT
2013-08-29 13:00 - 2013-08-29 13:00 - 01023533 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2013-08-29 12:58 - 2013-08-29 12:58 - 00002201 _____ C:\Users\*****\Desktop\AdwCleaner[S0].txt
2013-08-29 12:53 - 2013-08-29 12:55 - 00000000 ____D C:\AdwCleaner
2013-08-29 12:50 - 2013-08-29 12:50 - 00994642 _____ C:\Users\*****\Desktop\adwcleaner.exe
2013-08-29 12:40 - 2013-08-29 12:40 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-29 12:40 - 2013-08-29 12:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-29 12:40 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-29 12:39 - 2013-08-29 12:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*****\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-29 11:20 - 2013-08-29 11:26 - 00024757 _____ C:\Users\*****\Desktop\ComboFix.txt
2013-08-29 11:03 - 2013-08-29 11:20 - 00000000 ____D C:\Qoobox
2013-08-29 11:03 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-29 11:03 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-29 11:03 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-29 11:03 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-29 11:03 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-29 11:03 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-29 11:03 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-29 11:03 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-29 11:02 - 2013-08-29 11:18 - 00000000 ____D C:\Windows\erdnt
2013-08-29 10:59 - 2013-08-29 10:59 - 05115711 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2013-08-29 09:59 - 2013-08-29 10:32 - 00340122 _____ C:\Users\*****\Desktop\Gmer.txt
2013-08-29 09:37 - 2013-08-29 09:37 - 00377856 _____ C:\Users\*****\Desktop\gmer_2.1.19163.exe
2013-08-29 09:35 - 2013-08-29 10:32 - 00029094 _____ C:\Users\*****\Desktop\FRST 1.txt
2013-08-29 09:34 - 2013-08-29 10:31 - 00025296 _____ C:\Users\*****\Desktop\Addition.txt
2013-08-29 09:33 - 2013-08-29 09:33 - 00000000 ____D C:\FRST
2013-08-29 09:32 - 2013-08-29 09:32 - 01579080 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2013-08-29 09:31 - 2013-08-29 10:31 - 00000474 _____ C:\Users\*****\Desktop\defogger_disable.log
2013-08-29 09:31 - 2013-08-29 09:31 - 00000000 _____ C:\Users\*****\defogger_reenable
2013-08-29 09:30 - 2013-08-29 09:30 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe
2013-08-29 09:19 - 2013-08-29 09:19 - 00000000 ____D C:\Users\*****\Downloads\Ersties
2013-08-26 19:30 - 2013-08-29 11:14 - 00001820 _____ C:\Windows\PFRO.log
2013-08-26 19:27 - 2013-08-26 19:28 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-08-26 19:27 - 2013-04-09 15:13 - 00110264 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2013-08-26 19:27 - 2012-05-05 11:54 - 00662288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2013-08-26 19:27 - 2012-05-05 11:54 - 00137000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2013-08-26 19:27 - 2012-05-05 11:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2013-08-26 19:27 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2013-08-26 19:27 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2013-08-26 19:27 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2013-08-26 19:21 - 2013-08-26 19:22 - 17810632 _____ (pdfforge GmbH) C:\Users\*****\Downloads\PDFCreator-1_7_1_setup.exe
2013-08-20 09:27 - 2013-08-20 09:27 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-08-20 09:20 - 2013-08-20 09:20 - 00000000 ____D C:\Program Files (x86)\MarkAny
2013-08-20 09:05 - 2013-08-20 09:19 - 00000000 ____D C:\Users\*****\AppData\Roaming\Samsung
2013-08-20 09:05 - 2013-08-20 09:05 - 00000000 ____D C:\Users\*****\AppData\Local\Samsung
2013-08-20 09:05 - 2013-08-20 09:05 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-08-20 09:04 - 2013-08-20 09:04 - 00000000 ____D D:\Eigene Dokumente\samsung
2013-08-20 09:03 - 2013-08-20 09:03 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-08-20 09:03 - 2013-06-21 02:07 - 00203672 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2013-08-20 09:03 - 2013-06-21 02:07 - 00103448 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
2013-08-20 09:02 - 2013-06-14 19:57 - 04659712 _____ (Dmitry Streblechenko) C:\Windows\SysWOW64\Redemption.dll
2013-08-20 09:01 - 2013-06-14 19:56 - 00821824 _____ (Devguru Co., Ltd.) C:\Windows\SysWOW64\dgderapi.dll
2013-08-20 09:00 - 2013-08-20 09:26 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-08-20 09:00 - 2013-08-20 09:03 - 00000000 ____D C:\ProgramData\Samsung
2013-08-20 08:54 - 2013-08-20 08:58 - 69599992 _____ (Samsung Electronics Co., Ltd.                                ) C:\Users\*****\Downloads\KiesSetup.exe
2013-08-19 12:48 - 2013-08-29 13:17 - 00004787 _____ C:\Windows\setupact.log
2013-08-17 11:33 - 2013-08-17 11:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-14 09:42 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 09:42 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 09:42 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 09:42 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 09:42 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 09:42 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 09:42 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 09:42 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 09:42 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 09:42 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 09:42 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 09:42 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 09:42 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 09:42 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 09:32 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 09:32 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 09:32 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 09:32 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 09:32 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 09:32 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 09:32 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 09:32 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 09:31 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 09:31 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 09:31 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 09:31 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 09:31 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 09:31 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 09:31 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 09:31 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 09:31 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 09:31 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 09:31 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 09:31 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 09:31 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 09:31 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 09:31 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 09:31 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 09:31 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 09:31 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 09:29 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-11 21:17 - 2013-08-11 21:17 - 00000000 ____D C:\Program Files (x86)\Audials
2013-08-11 21:02 - 2013-08-11 21:14 - 61425512 _____ C:\Users\*****\Downloads\Audials_One-Setup(1).exe
2013-08-09 17:06 - 2013-08-09 17:12 - 00000000 ____D D:\Eigene Dokumente\Urlaub DK Sommer '13
2013-08-09 10:28 - 2013-08-09 10:34 - 00000000 ____D D:\Eigene Dokumente\Calibre-Bibliothek
2013-08-09 10:28 - 2013-08-09 10:32 - 00000000 ____D C:\Users\*****\AppData\Roaming\calibre
2013-08-09 09:53 - 2013-08-09 16:48 - 00000000 ____D D:\Eigene Dokumente\My Kindle Content
2013-08-09 09:53 - 2013-08-09 09:53 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2013-08-09 09:53 - 2013-08-09 09:53 - 00000000 ____D C:\Users\*****\AppData\Local\Amazon
2013-08-09 09:50 - 2013-08-09 09:52 - 38103832 _____ (Amazon.com) C:\Users\*****\Downloads\KindleForPC-installer.exe
2013-08-06 21:05 - 2013-08-06 21:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

==================== One Month Modified Files and Folders =======

2013-08-29 13:19 - 2013-01-08 13:07 - 00000000 ____D C:\Users\*****\AppData\Roaming\Dropbox
2013-08-29 13:19 - 2012-10-29 16:49 - 00000000 ___RD C:\Users\*****\Dropbox
2013-08-29 13:17 - 2013-08-19 12:48 - 00004787 _____ C:\Windows\setupact.log
2013-08-29 13:17 - 2013-07-12 15:46 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-29 13:17 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-29 13:16 - 2013-01-07 15:35 - 01730449 _____ C:\Windows\WindowsUpdate.log
2013-08-29 13:12 - 2013-08-29 13:12 - 00000951 _____ C:\Users\*****\Desktop\JRT.txt
2013-08-29 13:09 - 2013-07-12 15:47 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-29 13:04 - 2013-08-29 13:04 - 00000000 ____D C:\Windows\ERUNT
2013-08-29 13:04 - 2009-07-14 06:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-29 13:04 - 2009-07-14 06:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-29 13:00 - 2013-08-29 13:00 - 01023533 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2013-08-29 12:58 - 2013-08-29 12:58 - 00002201 _____ C:\Users\*****\Desktop\AdwCleaner[S0].txt
2013-08-29 12:57 - 2013-01-07 23:17 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-29 12:55 - 2013-08-29 12:53 - 00000000 ____D C:\AdwCleaner
2013-08-29 12:50 - 2013-08-29 12:50 - 00994642 _____ C:\Users\*****\Desktop\adwcleaner.exe
2013-08-29 12:40 - 2013-08-29 12:40 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-29 12:40 - 2013-08-29 12:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-29 12:39 - 2013-08-29 12:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\*****\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-29 11:26 - 2013-08-29 11:20 - 00024757 _____ C:\Users\*****\Desktop\ComboFix.txt
2013-08-29 11:20 - 2013-08-29 11:03 - 00000000 ____D C:\Qoobox
2013-08-29 11:20 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-29 11:18 - 2013-08-29 11:02 - 00000000 ____D C:\Windows\erdnt
2013-08-29 11:15 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-29 11:14 - 2013-08-26 19:30 - 00001820 _____ C:\Windows\PFRO.log
2013-08-29 10:59 - 2013-08-29 10:59 - 05115711 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2013-08-29 10:32 - 2013-08-29 09:59 - 00340122 _____ C:\Users\*****\Desktop\Gmer.txt
2013-08-29 10:32 - 2013-08-29 09:35 - 00029094 _____ C:\Users\*****\Desktop\FRST 1.txt
2013-08-29 10:31 - 2013-08-29 09:34 - 00025296 _____ C:\Users\*****\Desktop\Addition.txt
2013-08-29 10:31 - 2013-08-29 09:31 - 00000474 _____ C:\Users\*****\Desktop\defogger_disable.log
2013-08-29 09:37 - 2013-08-29 09:37 - 00377856 _____ C:\Users\*****\Desktop\gmer_2.1.19163.exe
2013-08-29 09:33 - 2013-08-29 09:33 - 00000000 ____D C:\FRST
2013-08-29 09:32 - 2013-08-29 09:32 - 01579080 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2013-08-29 09:31 - 2013-08-29 09:31 - 00000000 _____ C:\Users\*****\defogger_reenable
2013-08-29 09:31 - 2013-01-07 15:48 - 00000000 ____D C:\Users\*****
2013-08-29 09:30 - 2013-08-29 09:30 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe
2013-08-29 09:19 - 2013-08-29 09:19 - 00000000 ____D C:\Users\*****\Downloads\Ersties
2013-08-29 09:19 - 2011-04-12 09:43 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-08-29 09:19 - 2011-04-12 09:43 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-08-29 09:19 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-27 20:59 - 2013-01-08 00:47 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2013-08-26 19:28 - 2013-08-26 19:27 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-08-26 19:22 - 2013-08-26 19:21 - 17810632 _____ (pdfforge GmbH) C:\Users\*****\Downloads\PDFCreator-1_7_1_setup.exe
2013-08-26 19:20 - 2013-01-07 21:17 - 00000000 ____D D:\Eigene Dokumente\Rezepte
2013-08-21 09:33 - 2013-01-07 21:17 - 00000000 ____D D:\Eigene Dokumente\Unikram
2013-08-20 09:27 - 2013-08-20 09:27 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2013-08-20 09:27 - 2013-01-08 00:06 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-20 09:26 - 2013-08-20 09:00 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-08-20 09:26 - 2013-01-08 14:16 - 00000000 ____D C:\Users\*****\AppData\Local\Downloaded Installations
2013-08-20 09:20 - 2013-08-20 09:20 - 00000000 ____D C:\Program Files (x86)\MarkAny
2013-08-20 09:19 - 2013-08-20 09:05 - 00000000 ____D C:\Users\*****\AppData\Roaming\Samsung
2013-08-20 09:05 - 2013-08-20 09:05 - 00000000 ____D C:\Users\*****\AppData\Local\Samsung
2013-08-20 09:05 - 2013-08-20 09:05 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2013-08-20 09:04 - 2013-08-20 09:04 - 00000000 ____D D:\Eigene Dokumente\samsung
2013-08-20 09:03 - 2013-08-20 09:03 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2013-08-20 09:03 - 2013-08-20 09:00 - 00000000 ____D C:\ProgramData\Samsung
2013-08-20 08:58 - 2013-08-20 08:54 - 69599992 _____ (Samsung Electronics Co., Ltd.                                ) C:\Users\*****\Downloads\KiesSetup.exe
2013-08-17 23:13 - 2013-01-07 22:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 11:33 - 2013-08-17 11:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-14 11:53 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-14 09:36 - 2013-07-15 23:37 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 09:34 - 2013-01-07 16:38 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-11 21:17 - 2013-08-11 21:17 - 00000000 ____D C:\Program Files (x86)\Audials
2013-08-11 21:17 - 2013-01-08 20:13 - 00000000 ____D C:\ProgramData\RapidSolution
2013-08-11 21:14 - 2013-08-11 21:02 - 61425512 _____ C:\Users\*****\Downloads\Audials_One-Setup(1).exe
2013-08-09 17:12 - 2013-08-09 17:06 - 00000000 ____D D:\Eigene Dokumente\Urlaub DK Sommer '13
2013-08-09 16:48 - 2013-08-09 09:53 - 00000000 ____D D:\Eigene Dokumente\My Kindle Content
2013-08-09 10:34 - 2013-08-09 10:28 - 00000000 ____D D:\Eigene Dokumente\Calibre-Bibliothek
2013-08-09 10:32 - 2013-08-09 10:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\calibre
2013-08-09 09:53 - 2013-08-09 09:53 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2013-08-09 09:53 - 2013-08-09 09:53 - 00000000 ____D C:\Users\*****\AppData\Local\Amazon
2013-08-09 09:52 - 2013-08-09 09:50 - 38103832 _____ (Amazon.com) C:\Users\*****\Downloads\KindleForPC-installer.exe
2013-08-06 22:37 - 2013-01-09 22:08 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-06 22:36 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini
2013-08-06 21:05 - 2013-08-06 21:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

Files to move or delete:
====================
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\jrt\erunt\ERUNT.EXE

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-23 10:30

==================== End Of Log ============================