Windows 7: Trojaner o.ä. aus eMail Anhang

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:43 on 25/08/2013 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2013 02
Ran by ***** (administrator) on 25-08-2013 23:51:00
Running from C:\Users\*****\Desktop\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Smartbar) C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(IObit) C:\Program Files (x86)\IObit\Game Booster 3\gbtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12445288 2012-01-16] (Realtek Semiconductor)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [ISW] -  [x]
HKLM\...\RunOnce: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [Browser Infrastructure Helper] - C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe [13824 2013-02-10] (Smartbar)
HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3549528 2013-07-31] (Electronic Arts)
HKCU\...\Run: [eqtvrvvq] - C:\Users\*****\AppData\Local\Temp\Mfwssv\liilozzrvvq.exe [116224 2013-08-25] () <===== ATTENTION
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-02] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [126 2009-11-12] ()
HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [x]
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2YourFace_Updater.lnk
ShortcutTarget: 2YourFace_Updater.lnk -> C:\Users\*****\AppData\Roaming\2YourFace\Updater.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=121150&babsrc=HP_ss_din2g&mntrId=204C0008CAE006FC
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/?orig=HP&affid=62&cztbid=184930497
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=184930497&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=184930497&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=121150&babsrc=SP_ss_din2g&mntrId=204C0008CAE006FC
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=121150&babsrc=SP_ss_din2g&mntrId=204C0008CAE006FC
SearchScopes: HKCU - {3103D6ED-5587-4A0B-937C-BDCC76576A59} URL = hxxp://search.softonic.com/MOY00009/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=40
SearchScopes: HKCU - {C8A8AEB9-C4EE-4820-B3BC-5F057B105362} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=184930497&q={searchTerms}
BHO: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Deal Boat - {11111111-1111-1111-1111-110111271147} - C:\Program Files (x86)\Deal Boat\Deal Boat-bho.dll (Innovative Apps)
BHO-x32: 2YourFace Addon - {1185823F-F22F-4027-80E5-4F68ACD5DE5E} - C:\Users\*****\AppData\Roaming\2YourFace\bho.dll ()
BHO-x32: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
Toolbar: HKLM - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
Toolbar: HKLM-x32 - QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
Handler: msdaipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default
FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\user.js
FF NetworkProxy: "http", "www-proxy.t-online.de"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: electronicarts.com/GameFacePlugin - C:\Users\*****\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll (Electronic Arts)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\BrowserProtect.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF Extension: DoNotTrackMe - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\Extensions\donottrackplus@abine.com
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\n7uh2i73.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [support@2yourface.com] C:\Users\*****\AppData\Roaming\2YourFace\ffextension
FF Extension: 2YourFace - C:\Users\*****\AppData\Roaming\2YourFace\ffextension
FF HKCU\...\Firefox\Extensions: [support@2yourface.com] C:\Users\*****\AppData\Roaming\2YourFace\ffextension
FF Extension: 2YourFace - C:\Users\*****\AppData\Roaming\2YourFace\ffextension

Chrome: 
=======
CHR HomePage: hxxp://search.babylon.com/?affID=121150&babsrc=HP_ss_din2g&mntrId=204C0008CAE006FC
CHR RestoreOnStartup: "hxxp://search.babylon.com/?affID=121150&babsrc=HP_ss_din2g&mntrId=204C0008CAE006FC", "hxxp://www.delta-search.com/?affID=121150&babsrc=HP_ss&mntrId=204C0008CAE006FC"
CHR DefaultSearchURL: (Babylon) - hxxp://search.babylon.com/?q={searchTerms}&affID=121150&babsrc=SP_ss_din2g&mntrId=204C0008CAE006FC
CHR DefaultSuggestURL: (Babylon) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U3) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (npFFApi) - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Adblock Plus) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.5.4_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx
CHR HKLM-x32\...\Chrome\Extension: [lmblfngognklgemafekefcdjcnkdhmdm] - C:\Users\*****\AppData\Roaming\2YourFace\2YourFace.crx
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-27] (Avira Operations GmbH & Co. KG)
R3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
R3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-25 17:43 - 2013-08-25 17:43 - 00000000 _____ C:\Users\*****\defogger_reenable
2013-08-25 16:51 - 2013-08-25 16:51 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 16:51 - 2013-08-25 16:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 16:51 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-25 14:46 - 2013-08-25 14:46 - 00000000 ____D C:\Users\*****\AppData\Local\{5C6D133D-1259-4D1D-B03C-2373D1FE1525}
2013-08-25 10:32 - 2013-08-25 22:32 - 100156396 _____ C:\Windows\SysWOW64\�熆ᵌ)
2013-08-19 12:31 - 2013-08-20 17:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-17 13:38 - 2013-08-17 13:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 23:36 - 2013-08-15 23:36 - 00000000 ____D C:\Users\*****\AppData\Local\{EEED3BF8-2587-4A15-B97B-5DDE5FFB926D}
2013-08-14 21:50 - 2013-08-14 21:51 - 00000000 ____D C:\Users\*****\AppData\Local\{3B17203F-F504-4467-A11A-ABB3E9C563A5}
2013-08-12 10:31 - 2013-08-12 10:31 - 00000000 ____D C:\Users\*****\AppData\Local\{C50F3E57-575D-4E3E-BB26-4FB268892BD0}
2013-07-29 01:09 - 2013-07-29 01:09 - 00200107 _____ C:\Users\*****\Desktop\InventoryTweaks 1.6.2.jar
2013-07-29 00:16 - 2013-07-29 00:17 - 04233715 _____ C:\Users\*****\Desktop\minecraftforge-installer-1.6.2-9.10.0.804(1).jar
2013-07-28 23:06 - 2013-08-25 16:33 - 00000000 ____D C:\Users\*****\AppData\Roaming\.minecraft
2013-07-28 23:04 - 2013-07-28 23:04 - 00675988 _____ C:\Users\*****\Desktop\Minecraft.exe
2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Notepad++
2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-07-26 23:28 - 2013-07-26 23:28 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-26 23:28 - 2013-07-26 23:28 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-26 23:28 - 2013-07-26 23:28 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-26 23:06 - 2013-07-26 23:06 - 00003164 _____ C:\Windows\System32\Tasks\Game_Booster_AutoUpdate
2013-07-26 23:06 - 2013-07-26 23:06 - 00001190 _____ C:\Users\Public\Desktop\Switch to Gaming Mode.lnk
2013-07-26 23:06 - 2013-07-26 23:06 - 00001178 _____ C:\Users\Public\Desktop\Game Booster 3.lnk
2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\ProgramData\IObit
2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\Program Files (x86)\IObit

==================== One Month Modified Files and Folders =======

2013-08-25 23:49 - 2013-08-25 23:49 - 00000000 ____D C:\FRST
2013-08-25 23:42 - 2012-06-16 12:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-25 23:32 - 2013-03-20 16:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-25 23:15 - 2012-06-16 12:54 - 01720189 _____ C:\Windows\WindowsUpdate.log
2013-08-25 22:32 - 2013-08-25 10:32 - 100156396 _____ C:\Windows\SysWOW64\�熆ᵌ)
2013-08-25 18:11 - 2009-07-14 06:51 - 00204509 _____ C:\Windows\setupact.log
2013-08-25 17:43 - 2013-08-25 17:43 - 00000000 _____ C:\Users\*****\defogger_reenable
2013-08-25 17:43 - 2012-06-16 13:01 - 00000000 ____D C:\Users\*****
2013-08-25 16:52 - 2009-07-14 06:45 - 00017152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-25 16:52 - 2009-07-14 06:45 - 00017152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-25 16:51 - 2013-08-25 16:51 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-25 16:51 - 2013-08-25 16:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-25 16:33 - 2013-07-28 23:06 - 00000000 ____D C:\Users\*****\AppData\Roaming\.minecraft
2013-08-25 14:46 - 2013-08-25 14:46 - 00000000 ____D C:\Users\*****\AppData\Local\{5C6D133D-1259-4D1D-B03C-2373D1FE1525}
2013-08-25 14:42 - 2012-06-16 12:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-25 10:31 - 2013-04-14 13:23 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-25 10:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-25 10:30 - 2010-11-21 05:47 - 00317486 _____ C:\Windows\PFRO.log
2013-08-22 10:48 - 2012-06-16 12:59 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-21 09:45 - 2012-06-16 18:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-20 17:49 - 2013-08-19 12:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-20 10:33 - 2013-05-07 13:35 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 10:33 - 2013-03-27 11:15 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 10:33 - 2013-03-27 11:15 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-17 13:38 - 2013-08-17 13:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 23:36 - 2013-08-15 23:36 - 00000000 ____D C:\Users\*****\AppData\Local\{EEED3BF8-2587-4A15-B97B-5DDE5FFB926D}
2013-08-14 21:51 - 2013-08-14 21:50 - 00000000 ____D C:\Users\*****\AppData\Local\{3B17203F-F504-4467-A11A-ABB3E9C563A5}
2013-08-12 10:31 - 2013-08-12 10:31 - 00000000 ____D C:\Users\*****\AppData\Local\{C50F3E57-575D-4E3E-BB26-4FB268892BD0}
2013-08-08 10:42 - 2011-05-16 16:04 - 00664764 _____ C:\Windows\system32\perfh007.dat
2013-08-08 10:42 - 2011-05-16 16:04 - 00134932 _____ C:\Windows\system32\perfc007.dat
2013-08-08 10:42 - 2009-07-14 07:13 - 01528340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-29 10:20 - 2012-10-25 19:43 - 00000000 ____D C:\Users\*****\Desktop\Thomas
2013-07-29 01:09 - 2013-07-29 01:09 - 00200107 _____ C:\Users\*****\Desktop\InventoryTweaks 1.6.2.jar
2013-07-29 00:47 - 2013-04-03 10:29 - 00000000 ____D C:\Users\*****\AppData\Roaming\2YourFace
2013-07-29 00:17 - 2013-07-29 00:16 - 04233715 _____ C:\Users\*****\Desktop\minecraftforge-installer-1.6.2-9.10.0.804(1).jar
2013-07-28 23:04 - 2013-07-28 23:04 - 00675988 _____ C:\Users\*****\Desktop\Minecraft.exe
2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Notepad++
2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
2013-07-28 21:03 - 2013-07-28 21:03 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-07-26 23:28 - 2013-07-26 23:28 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-26 23:28 - 2013-07-26 23:28 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-26 23:28 - 2013-07-26 23:28 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-26 23:28 - 2013-07-26 23:28 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-26 23:28 - 2012-01-25 22:13 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-07-26 23:28 - 2011-07-18 23:13 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-26 23:06 - 2013-07-26 23:06 - 00003164 _____ C:\Windows\System32\Tasks\Game_Booster_AutoUpdate
2013-07-26 23:06 - 2013-07-26 23:06 - 00001190 _____ C:\Users\Public\Desktop\Switch to Gaming Mode.lnk
2013-07-26 23:06 - 2013-07-26 23:06 - 00001178 _____ C:\Users\Public\Desktop\Game Booster 3.lnk
2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\ProgramData\IObit
2013-07-26 23:06 - 2013-07-26 23:06 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-26 18:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-26 13:30 - 2013-07-19 20:40 - 00000000 ____D C:\Users\*****\Documents\resourcepacks
2013-07-26 13:15 - 2013-07-19 18:18 - 00000000 ____D C:\Users\*****\Documents\versions
2013-07-26 13:04 - 2013-01-07 19:56 - 00000000 ____D C:\Program Files (x86)\Steam

Files to move or delete:
====================
C:\Users\*****\AppData\Local\Temp\Mfwssv\liilozzrvvq.exe
C:\Users\*****\AppData\Local\Temp\AskSLib.dll
C:\Users\*****\AppData\Local\Temp\CDur6m_q.exe.part
C:\Users\*****\AppData\Local\Temp\chatzum_softonic_yahoo_62_v5.exe
C:\Users\*****\AppData\Local\Temp\COMAP.EXE
C:\Users\*****\AppData\Local\Temp\i4jdel0.exe
C:\Users\*****\AppData\Local\Temp\i4jdel1.exe
C:\Users\*****\AppData\Local\Temp\i4jdel2.exe
C:\Users\*****\AppData\Local\Temp\i4jdel3.exe
C:\Users\*****\AppData\Local\Temp\PPOkAUQh.exe.part
C:\Users\*****\AppData\Local\Temp\SetupAuto.exe
C:\Users\*****\AppData\Local\Temp\SetupUpdater.exe
C:\Users\*****\AppData\Local\Temp\setup_fsu_cid.exe
C:\Users\*****\AppData\Local\Temp\uninst1.exe
C:\Users\*****\AppData\Local\Temp\Uninstall.exe
C:\Users\*****\AppData\Local\Temp\uql_sOEV.exe.part
C:\Users\*****\AppData\Local\Temp\xgO0ZHT3.exe.part
C:\Users\*****\AppData\Local\Temp\xmlUpdater.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\AvBasesCheck.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Clean_tool.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Clean_tool64.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\CUninstallerZA.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\handlecmsg.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Install.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Launcher.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Uninst.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vistalib32.dll
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vistalib64.dll
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vsdrinst.exe
C:\Users\*****\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vsdrinst64.exe
C:\Users\*****\AppData\Local\Temp\updE17E\BabScheduler2000201.exe
C:\Users\*****\AppData\Local\Temp\texture pack\mcpatcher-2.4.3_04.exe
C:\Users\*****\AppData\Local\Temp\MozUpdater\updater.exe
C:\Users\*****\AppData\Local\Temp\is-QO127.tmp\gbinit.exe
C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\botva2.dll
C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\dbww.exe
C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\DeltaTB.exe
C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\InnoCallback.dll
C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\itdownload.dll
C:\Users\*****\AppData\Local\Temp\is-DRALA.tmp\_isetup\_shfoldr.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\CbsProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\CompatProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismCore.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismCorePS.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismHost.exe
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DismProv.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\DmiProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\FolderProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\IntlProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\LogProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\MsiProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\OSProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\SmiProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\TransmogProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\UnattendProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\wdscore.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\WimProvider.dll
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\CbsProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\CompatProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\DismCore.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\DismProv.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\DmiProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\FolderProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\IntlProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\LogProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\MsiProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\OSProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\SmiProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\TransmogProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\UnattendProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\D3A58701-1287-4CF9-B62C-4ECD9A043F76\de-DE\WimProvider.dll.mui
C:\Users\*****\AppData\Local\Temp\bus92CF\BabScheduler3.exe
C:\Users\*****\AppData\Local\Temp\bus6B9D\ChromeExtUpdater.exe
C:\Users\*****\AppData\Local\Temp\bus3F0B\ff21v.exe
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Setup.exe
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\sqlite3.dll
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\ccp.exe
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\ChromeToolbarSetup.dll
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\CrxInstaller.dll
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\GUninstaller.exe
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\IEHelper.dll
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\MyBabylonTB.exe
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\Setup.exe
C:\Users\*****\AppData\Local\Temp\B6F5B7DD-BAB0-7891-BE19-B04326A49B21\Latest\sqlite3.dll
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Setup.exe
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\sqlite3.dll
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\ccp.exe
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\ChromeToolbarSetup.dll
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\CrxInstaller.dll
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\GUninstaller.exe
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\IEHelper.dll
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\MyBabylonTB.exe
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\Setup.exe
C:\Users\*****\AppData\Local\Temp\94E4DB11-BAB0-7891-BEA7-AC76F3215973\Latest\sqlite3.dll
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Setup.exe
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\sqlite3.dll
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\ccp.exe
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\ChromeToolbarSetup.dll
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\CrxInstaller.dll
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\GUninstaller.exe
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\IEHelper.dll
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\MyBabylonTB.exe
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\Setup.exe
C:\Users\*****\AppData\Local\Temp\34A2EE20-BAB0-7891-8D9A-98B68F560A48\Latest\sqlite3.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-22 01:09

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2013 02
Ran by ***** at 2013-08-25 23:51:24
Running from C:\Users\*****\Desktop\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
2YourFace 1.0 (x32 Version: 1.0)
Adobe AIR (x32 Version: 3.1.0.4880)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.0.112)
Ashampoo Burning Studio (x32 Version: 10.0.10)
Ashampoo Photo Commander (x32 Version: 9.2.0)
Ashampoo Photo Optimizer (x32 Version: 4.0.0)
Ashampoo Snap (x32 Version: 4.3.0)
Asmedia ASM104x USB 3.0 Host Controller Driver (x32 Version: 1.12.9.0)
Avira Free Antivirus (x32 Version: 13.0.0.4045)
Battlefield 1942™ (x32 Version: 1.6.20.0)
Chivalry: Medieval Warfare (x32)
CyberLink LabelPrint (x32 Version: 2.5.3624)
CyberLink MediaEspresso (x32 Version: 6.5.1508_36229)
CyberLink PhotoDirector 2011 (x32 Version: 2.0.2430)
CyberLink Power2Go (x32 Version: 7.0.0.1327)
CyberLink PowerDVD 10 (x32 Version: 10.0.3622.02)
CyberLink PowerDVD Copy (x32 Version: 1.5.1306)
CyberLink PowerRecover (x32 Version: 5.5.4125)
CyberLink WaveEditor (x32 Version: 1.0.1.3320)
D3DX10 (x32 Version: 15.4.2368.0902)
Deal Boat (x32 Version: 1.27.153.4)
EA SPORTS Game Face Browser Plugin 1.8.0.0 (HKCU Version: 1.8.0.0)
ELAN 2013 NW  (x32 Version: 4.0.0.0)
Falk Navi-Manager classic (x32 Version: 2.11.0)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Game Booster 3 (x32 Version: 3.4)
Google Chrome (x32 Version: 29.0.1547.57)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) OpenCL CPU Runtime (x32)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2669)
Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 7 Update 3 (64-bit) (Version: 7.0.30)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Medion Home Cinema (x32 Version: 8.0.3216)
Memeo Instant Backup (x32 Version: 4.60.0.7943)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 17.0.8)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Notepad++ (x32 Version: 6.4.2)
Origin (x32 Version: 9.1.15.109)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
QuickShare (x32 Version: 1.6.1.804)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6554)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Spelling Dictionaries Support For Adobe Reader X (x32 Version: 10.0.0)
Steam (x32 Version: 1.0.0.0)
swMSM (x32 Version: 12.0.0.1)
Unity Web Player (HKCU Version: )
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VC 9.0 Runtime (x32 Version: 1.0.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0)
ZoneAlarm LTD Toolbar
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

28-07-2013 17:00:25 Windows-Sicherung
04-08-2013 17:00:24 Windows-Sicherung
11-08-2013 17:00:24 Windows-Sicherung
18-08-2013 17:00:22 Windows-Sicherung
25-08-2013 14:52:33 Windows Update
25-08-2013 17:00:26 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {071CCF5E-FEDC-4E11-BC07-4DD3DF3D8A0F} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {3731D4EA-0FBC-444A-A81F-6AE11A723175} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe [2013-07-26] ()
Task: {4C31CB68-5C5D-49FA-83E6-D15ABD2A0C4B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-16] (Google Inc.)
Task: {66700F3D-2ABE-4082-87B8-8D546CAE53C0} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {82C8BA32-6E02-4D07-BB93-A288851F8BFC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-16] (Google Inc.)
Task: {87EE2F9B-5397-48CF-A058-B113DAAB2087} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {8E837E2E-4F10-408C-BB41-ECBBA5A325DE} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {8F4A043E-E53A-442B-A5F3-E4E44DE7B55F} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated)
Task: {9FC0F5A9-870F-42D4-966D-2CA8AA29808F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated)
Task: {A50DB85E-2408-419C-A0DF-3BC8FBA8839D} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated)
Task: {C4A39E40-50B5-4549-98FE-A9A36313D50C} - System32\Tasks\Updater12747.exe => C:\Users\*****\AppData\Local\Updater12747\Updater12747.exe No File
Task: {CA7F72EB-975B-4414-B3D4-CAB371218687} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2013 11:32:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0xe04
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3

Error: (08/25/2013 10:32:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x19c8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3

Error: (08/25/2013 10:31:53 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00011380
ID des fehlerhaften Prozesses: 0x1a64
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (08/25/2013 09:32:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x190c
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3

Error: (08/25/2013 08:32:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x1530
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3

Error: (08/25/2013 07:32:03 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x928
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3

Error: (08/25/2013 07:02:40 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Auf diesem Laufwerk ist nicht genügend Speicherplatz zum Speichern der Sicherung verfügbar. Löschen Sie ältere Sicherungen und nicht benötigte Daten, um Speicherplatz freizugeben, oder ändern Sie die Sicherungseinstellungen. (0x81000005)"

Error: (08/25/2013 06:32:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x2c4
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3

Error: (08/25/2013 05:32:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x15a8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3

Error: (08/25/2013 05:08:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.


System errors:
=============
Error: (08/25/2013 01:10:56 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet: 
%%1115

Error: (08/22/2013 10:11:41 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "MemeoBackgroundService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/22/2013 10:11:41 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MemeoBackgroundService erreicht.

Error: (08/15/2013 08:47:56 PM) (Source: Microsoft-Windows-Application-Experience) (User: NT-AUTORITÄT)
Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren.

Error: (08/14/2013 10:26:38 PM) (Source: Microsoft-Windows-Application-Experience) (User: NT-AUTORITÄT)
Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren.

Error: (08/13/2013 10:41:56 PM) (Source: Microsoft-Windows-Application-Experience) (User: NT-AUTORITÄT)
Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren.

Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Automatische WLAN-Konfiguration" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Sitzungs-Manager für Desktopfenster-Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/13/2013 00:47:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Superfetch" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-03-30 20:28:23.496
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 20:01:54.066
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 18:28:31.734
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 17:55:42.768
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 11:49:08.767
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 11:33:11.869
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 10:41:40.950
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 10:17:32.913
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 09:55:44.176
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-03-30 08:44:16.793
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 58%
Total physical RAM: 3975.64 MB
Available physical RAM: 1656.35 MB
Total Pagefile: 7949.46 MB
Available Pagefile: 5180.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:226.81 GB) (Free:159.84 GB) NTFS
Drive d: (Recovery) (Fixed) (Total:39.06 GB) (Free:0 GB) NTFS
Drive l: (Speicher) (Fixed) (Total:198.78 GB) (Free:197.88 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: DD3B8AC5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=227 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=238 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-26 13:03:15
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST350041 rev.JC47 465,76GB
Running: gmer_2.1.19163(1).exe; Driver: C:\Users\*****\AppData\Local\Temp\uxtiyfow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                                            fffff80003ba3000 45 bytes [C1, 8B, C2, 48, 3B, C7, 72, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 606                                                                            fffff80003ba302e 31 bytes [44, 8A, F0, 48, 39, 1D, 10, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe[1664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076071465 2 bytes [07, 76]
.text     C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe[1664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000760714bb 2 bytes [07, 76]
.text     ...                                                                                                                                           * 2
.text     C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe[3480] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69              0000000076071465 2 bytes [07, 76]
.text     C:\Users\*****\AppData\Local\Smartbar\Application\QuickShare.exe[3480] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155             00000000760714bb 2 bytes [07, 76]
.text     ...                                                                                                                                           * 2
.text     C:\Windows\SysWOW64\svchost.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                 0000000076071465 2 bytes [07, 76]
.text     C:\Windows\SysWOW64\svchost.exe[4068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                00000000760714bb 2 bytes [07, 76]
.text     ...                                                                                                                                           * 2
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 322                                                       000000006e7b1a22 2 bytes [7B, 6E]
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 496                                                       000000006e7b1ad0 2 bytes [7B, 6E]
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 552                                                       000000006e7b1b08 2 bytes [7B, 6E]
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 730                                                       000000006e7b1bba 2 bytes [7B, 6E]
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\SysWOW64\wsock32.DLL!setsockopt + 762                                                       000000006e7b1bda 2 bytes [7B, 6E]
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetCloseHandle                                                    0000000075ad4282 5 bytes JMP 0000000100852c10
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpQueryInfoA                                                         0000000075ad7079 5 bytes JMP 0000000100852ab8
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpQueryInfoW                                                         0000000075ad77c2 5 bytes JMP 0000000100852b64
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpSendRequestW                                                       0000000075ad7ca6 5 bytes JMP 00000001008525c8
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpOpenRequestW                                                       0000000075ad83dd 5 bytes JMP 0000000100851494
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetQueryDataAvailable                                             0000000075ae92e9 5 bytes JMP 0000000100852970
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetReadFile                                                       0000000075ae972b 5 bytes JMP 00000001008529bc
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetReadFileExW                                                    0000000075afadd7 5 bytes JMP 0000000100852a64
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!InternetReadFileExA                                                    0000000075afae2e 5 bytes JMP 0000000100852a10
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpSendRequestA                                                       0000000075ba32f2 5 bytes JMP 0000000100852614
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\wininet.DLL!HttpOpenRequestA                                                       0000000075ba3595 5 bytes JMP 0000000100851650
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000076071465 2 bytes [07, 76]
.text     C:\Windows\SysWOW64\explorer.exe[1216] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               00000000760714bb 2 bytes [07, 76]
.text     ...                                                                                                                                           * 2

---- Threads - GMER 2.1 ----

Thread    C:\Windows\SysWOW64\svchost.exe [4068:3188]                                                                                                   000000007efa0000
Thread    C:\Windows\SysWOW64\svchost.exe [4068:3236]                                                                                                   000000007efa4c6d
Thread    C:\Windows\SysWOW64\svchost.exe [4068:3232]                                                                                                   000000007efa7f06
Thread    C:\Windows\SysWOW64\svchost.exe [4068:3220]                                                                                                   000000007efa6980
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [3544:2120]                                                                                000007fefb842a7c
Thread    C:\Windows\System32\svchost.exe [2844:4056]                                                                                                   000007feedf29688
Thread    C:\Windows\SysWOW64\explorer.exe [1216:2584]                                                                                                  0000000000856310
Thread    C:\Windows\SysWOW64\explorer.exe [1216:796]                                                                                                   0000000000856160
Thread    C:\Windows\SysWOW64\explorer.exe [1216:4756]                                                                                                  00000000008483ac

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                                                         unknown MBR code

---- EOF - GMER 2.1 ----
         

Exportierte Ereignisse:

25.08.2013 16:03 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\*****\Desktop\Downloads\Ausgleich der stornierten 
      Lastschrift Ihrer Bestellung 22.08.2013.zip'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Spy.Injector.AH' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5408ae45.qua' 
      verschoben!

25.08.2013 16:03 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\*****\AppData\Local\Temp\{00015571-7FF1-ADF5}'
      enthielt einen Virus oder unerwünschtes Programm 'TR/BankZone.A.3' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c58802d.qua' 
      verschoben!

25.08.2013 16:03 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\*****\AppData\Local\Temp\gupzlcjxkv.pre'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Spy.Injector.AH' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ec7db0a.qua' 
      verschoben!

23.08.2013 18:28 [System-Scanner] Malware gefunden
      Die Datei 'D:\*****-PC\Backup Set 2013-05-08 163924\Backup Files 2013-06-09 
      190000\Backup files 3.zip'
      enthielt einen Virus oder unerwünschtes Programm 'Adware/IWantThis.L' [adware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e7c0cd7.qua' 
      verschoben!

23.08.2013 18:28 [System-Scanner] Malware gefunden
      Die Datei 'C:\Windows\System32\SensprsApi.exe'
      enthielt einen Virus oder unerwünschtes Programm 'ADWARE/GFilter.Gen2' [adware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5614208c.qua' 
      verschoben!