| |
| |||||||
Log-Analyse und Auswertung: Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.09.2013, 19:37
| #1 |
 |  Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Hallo alle miteinander, Bin gerade mehr als ratlos, deshalb hier erst mal die Problembeschreibung: Bis jetzt habe ich zwei verschieden Antisoftwares ausprobiert. Einmal die Bezahlversion von Norton und Avira free. Vor etwa einem halben Jahr war dann eine sehr gemeine Malware auf dem PC, die permanent >20 Seiten geöffnet hat bei jedem dritten Klick. Norton hat den Virus nicht gefunden, deshalb Norton rausgeschmissen und Avira drauf. Avira hat den Virus gleich erkannt und in Quarantäne gesetzt. Seitdem habe ich nur noch die kostenlose Aviraversion drauf. Diese hat im letzten Jahr ebenfalls nur zwei drei Viren erkannt. Die erkannten Viren befanden sich aber schon seit mindestens 2 Jahren auf dem Rechner!!! Waren setup Dateien u.a. von Mozillafirefox. Jetztige Probleme: Habe ständig neue Suchmaschinen ohne irgendetwas neu installiert zu haben, Mozilla Firefox geht auf und zu, der ganze PC fährt ebenso von Geisterhand herunter und ich werde andauernd ausgeloggt. Der Windowswartungscenter behauptet desöfteren, Avira sei nicht aktiv, während Avira selbst aber das Gegenteil behauptet und mit wird der Zugriff zum aktivieren und deaktivieren verweigert. Nach dem ich unten stehende Logfiles gemacht habe, musste ich den Virenschutz zweimalig, de und neuinstallieren um hier zumindest ansatzweise geschützt schreiben zu können, da alle Neustarts um Avira wieder in Gang zu bringen zwecklos waren. Deshalb sind leider keine der Funde dort mehr da. Hoffe es ist okay die Logs per Kopierfunktion einzufügen, habe zur besseren Übersicht rote Trennlinien eingefügt. Vielen, vielen, vielen unendlich lieben Dank im Vorraus Gruß Britta ----------------------------------------------------------------- defogger_disable by jpshortstuff (23.02.10.1) Log created at 14:48 on 27/09/2013 (flatterratz) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- ----------------------------------------------------------------- FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by flatterratz (administrator) on FLATTERRATZ-HP on 27-09-2013 15:04:51
Running from C:\Users\flatterratz\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\windows\system32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\windows\system32\atibtmon.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe
(Wsys Co., Ltd.) C:\ProgramData\eSafe\eGdpSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Microsoft Corporation) C:\windows\system32\LogonUI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\windows\system32\SnippingTool.exe
(Microsoft Corporation) C:\windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corporation) C:\windows\system32\taskmgr.exe
(Farbar) C:\Users\flatterratz\Downloads\FRST64(2).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2013-01-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [489472 2013-01-10] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [7177728 2013-05-30] (Broadcom Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKCU\...\Run: [FDPRO-516] - C:\Program Files (x86)\Fighters\FighterLauncher.exe FDPRO
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {09716e91-fe90-11e1-a7e6-cc52af0dd39b} - E:\AutoRun.exe
MountPoints2: {a7c6750a-d9b3-11e1-93d9-64315086516c} - D:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {acefb5c9-d0ba-11e0-94e5-cc52af0dd39b} - D:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {bc680915-d80b-11e1-85d5-64315086516c} - D:\AutoRun.exe
MountPoints2: {bc680921-d80b-11e1-85d5-64315086516c} - D:\AutoRun.exe
MountPoints2: {bc68092d-d80b-11e1-85d5-64315086516c} - E:\AutoRun.exe
MountPoints2: {d9de7587-fff9-11e1-93d7-cc52af0dd39b} - D:\AutoRun.exe
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-08-17] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-10-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-06-18] (RealNetworks, Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] - C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKU\Feuertanz\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\Feuertanz\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Feuertanz\...\Policies\system: [LogonHoursAction] 2
HKU\Feuertanz\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs-x32: c:\progra~3\browse~1\25911~1.18\{c16c1~1\mngr.dll [ ] ()
Startup: C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
ProxyEnable: Internet Explorer proxy is enabled.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKCU\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKCU - Backup.Old.DefaultScope {E38EE736-8F53-4DE1-A867-0E35AD8808F8}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=117223&tt=4712_2&babsrc=SP_ss&mntrId=88bae139000000000000cc52af0dd39b
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKCU - {59F87DB3-BE1B-451E-BC69-551AD34E41F2} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {6B916290-38B3-4EBC-A858-7E71C3D049B9} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=3c6b90ac-5880-4494-964e-5b3a2666bf24&apn_sauid=3167E310-0F01-425A-BB32-2A23188E187B
SearchScopes: HKCU - {6EE5531F-DBDD-4EDF-8917-10B675B66191} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://int.search-results.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=360&chn=retail&geo=DE&ver=6
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb185/?search={searchTerms}&loc=IB_DS&a=6R8LRgUnVD&i=26
SearchScopes: HKCU - {D2AD5932-5B7F-4E2E-9C75-FEC802354337} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {DEBC633C-67A2-4F44-9904-F868FE5B2B22} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {E38EE736-8F53-4DE1-A867-0E35AD8808F8} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\PROGRA~2\Funmoods\1.5.23.22\bh\escort.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Funmoods Toolbar - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\PROGRA~2\Funmoods\1.5.23.22\escorTlbr.dll No File
Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default
FF user.js: detected! => C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\user.js
FF NewTab: hxxp://www.delta-homes.com/newtab/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=nt&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380232706
FF DefaultSearchEngine: Search the web (Babylon)
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Search the web (Babylon)
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\mngr.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\my-web-search.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\safesearch.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\delta-homes.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\data
FF Extension: check4change-owner - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\check4change-owner@mozdev.org.xpi
FF Extension: firebug - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: helperframework - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\helperframework@zonemedia.com.xpi
FF Extension: toolbar - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\toolbar@web.de.xpi
FF Extension: toolbar_AVIRA-V7 - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [{0ce6ac61-48e9-426f-9268-6f1e8ece06da}] - C:\Program Files (x86)\LyricsSeeker\131.xpi
FF Extension: No Name - C:\Program Files (x86)\LyricsSeeker\131.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380236274
Chrome:
=======
CHR Extension: (Avira Toolbar) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.19.38091_0
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh\20.53263_0
CHR Extension: (Google Drive) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Funmoods) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh\2.1.3_0
CHR Extension: (YouTube) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Facebook) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0
CHR Extension: (Newtab) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj\7.0.18.1_0
CHR Extension: (Google Search) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Facebook Disconnect) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0
CHR Extension: (RealDownloader) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0
CHR Extension: (New tab for Chrome\u2122) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0
CHR Extension: (Lyrics Seeker) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgoiojnjnacbjngolldkokokgpcjbgjj\1.131_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\FLATTE~1\AppData\Local\funmoods.crx
CHR HKLM\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\FLATTE~1\AppData\Local\funmoods-speeddial.crx
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\flatterratz\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.11.0.crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\FLATTE~1\AppData\Local\funmoods.crx
CHR HKLM-x32\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\FLATTE~1\AppData\Local\funmoods-speeddial.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
CHR HKLM-x32\...\Chrome\Extension: [jifflliplgeajjdhmkcfnngfpgbjonjg] - C:\Program Files (x86)\Perion\NewTab\newTab.crx
CHR HKLM-x32\...\Chrome\Extension: [lgoiojnjnacbjngolldkokokgpcjbgjj] - C:\Program Files (x86)\LyricsSeeker\131.crx
CHR HKLM-x32\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files (x86)\Perion\ChromeInfoBar\ChromeInfoBar.crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380236274
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-08-17] ()
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [280120 2010-10-01] (Hewlett-Packard Company)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE [48128 2013-05-30] (Broadcom Corporation)
R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [303680 2013-09-01] (Wsys Co., Ltd.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [18456 2012-01-10] (HandSet Incorporated)
S3 massfilter_hs; C:\Windows\SysWow64\drivers\massfilter_hs.sys [9216 2010-10-20] (HandSet Incorporated)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)
S3 zghsdiag; C:\Windows\System32\DRIVERS\zghsdiag.sys [129304 2010-10-18] (ZTE Incorporated)
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-27 15:04 - 2013-09-27 15:04 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(2).exe
2013-09-27 14:50 - 2013-09-27 14:50 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(1).exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-22 14:41 - 2013-09-22 20:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-16 23:44 - 2013-09-17 01:42 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-13 14:27 - 2013-09-13 14:27 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-12 01:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-12 01:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-12 01:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 20:15 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-11 20:15 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-11 20:15 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-11 20:15 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-11 20:15 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-11 20:15 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:23 - 2013-09-05 14:23 - 01947160 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-05 14:01 - 2013-09-05 14:02 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 21:18 - 2013-09-03 14:20 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-05 19:28 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-01 19:24 - 2013-09-05 19:28 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-01 19:24 - 2013-09-05 17:26 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-01 19:24 - 2013-09-05 17:26 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-01 19:24 - 2013-09-05 12:55 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:58 - 2013-09-26 23:58 - 00001427 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-01 14:58 - 2013-09-06 11:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 13:22 - 2013-09-27 14:08 - 00000000 ____D C:\ProgramData\eSafe
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 13:21 - 2013-09-05 14:28 - 00000000 ____D C:\Program Files (x86)\LyricsSeeker
2013-09-01 13:21 - 2013-09-05 13:11 - 00000400 _____ C:\windows\Tasks\Lyrics Seeker Update.job
2013-09-01 13:21 - 2013-09-01 13:21 - 00003060 _____ C:\windows\System32\Tasks\Lyrics Seeker Update
2013-09-01 01:47 - 2013-09-01 01:49 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 01:11 - 2013-09-01 01:11 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-09-01 01:04 - 2013-09-01 01:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-01 01:01 - 2013-09-04 14:35 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-01 01:00 - 2013-09-01 01:00 - 00000000 ____D C:\ProgramData\APN
2013-09-01 00:58 - 2013-09-01 00:58 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-01 00:57 - 2013-09-04 14:35 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-01 00:57 - 2013-09-04 14:35 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-01 00:57 - 2013-09-01 00:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-01 00:57 - 2013-03-06 16:13 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-01 00:53 - 2013-09-01 00:56 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:30 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-01 00:02 - 2013-09-01 00:03 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
==================== One Month Modified Files and Folders =======
2013-09-27 15:04 - 2013-09-27 15:04 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(2).exe
2013-09-27 15:01 - 2013-03-12 23:13 - 00000000 ____D C:\Users\flatterratz\Desktop\OpenOffice.org 3.4.1 (de) Installation Files
2013-09-27 14:50 - 2013-09-27 14:50 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(1).exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:48 - 2011-07-16 21:29 - 00000000 ____D C:\Users\flatterratz
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-27 14:16 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-27 14:16 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-27 14:12 - 2011-03-01 14:44 - 01932180 _____ C:\windows\WindowsUpdate.log
2013-09-27 14:08 - 2013-09-01 13:22 - 00000000 ____D C:\ProgramData\eSafe
2013-09-27 14:05 - 2010-12-09 00:59 - 00000000 ____D C:\ProgramData\PDFC
2013-09-27 14:05 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-09-27 14:04 - 2012-05-11 00:20 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-09-27 14:03 - 2009-07-14 06:51 - 00243052 _____ C:\windows\setupact.log
2013-09-26 23:58 - 2013-09-01 14:58 - 00001427 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-26 14:54 - 2011-07-24 21:31 - 00000000 ____D C:\Users\flatterratz\AppData\Local\CrashDumps
2013-09-26 13:42 - 2012-08-14 13:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-26 13:42 - 2012-08-14 13:46 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-26 13:42 - 2012-08-14 13:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-23 21:28 - 2012-11-24 20:44 - 00000000 ____D C:\Users\flatterratz\Documents\GTA Vice City User Files
2013-09-22 20:41 - 2013-09-22 14:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-21 02:07 - 2013-01-10 22:01 - 00002437 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-17 01:42 - 2013-09-16 23:44 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-13 23:07 - 2010-12-09 00:40 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-09-13 23:07 - 2010-12-09 00:40 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-09-13 23:07 - 2009-07-14 07:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-13 14:27 - 2013-09-13 14:27 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:41 - 2009-07-14 06:45 - 04976408 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-12 01:41 - 2013-07-29 01:04 - 00000000 ____D C:\windows\system32\MRT
2013-09-12 01:35 - 2011-09-19 19:09 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-11 15:13 - 2011-07-17 05:06 - 01926452 _____ C:\windows\PFRO.log
2013-09-11 15:09 - 2012-07-28 21:35 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Adobe
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\ProgramData\Adobe
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-07 17:53 - 2013-06-22 15:26 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-06 11:09 - 2013-09-01 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-06 01:27 - 2013-01-10 21:56 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-05 23:32 - 2013-08-08 13:16 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleForflatterratz
2013-09-05 23:32 - 2013-08-08 13:16 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleForflatterratz.job
2013-09-05 19:28 - 2013-09-01 19:24 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-05 19:28 - 2013-09-01 19:24 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-05 17:26 - 2013-09-01 19:24 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-05 17:26 - 2013-09-01 19:24 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-05 14:28 - 2013-09-01 13:21 - 00000000 ____D C:\Program Files (x86)\LyricsSeeker
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:23 - 2013-09-05 14:23 - 01947160 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-05 14:03 - 2013-08-17 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-05 14:02 - 2013-09-05 14:01 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-05 13:27 - 2013-01-10 21:56 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-05 13:11 - 2013-09-01 13:21 - 00000400 _____ C:\windows\Tasks\Lyrics Seeker Update.job
2013-09-05 13:08 - 2013-01-10 16:37 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-09-05 13:07 - 2013-02-14 14:28 - 00000000 _____ C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-05 12:55 - 2013-09-01 19:24 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-05 12:55 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-04 14:35 - 2013-09-01 01:01 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-04 14:35 - 2013-09-01 00:57 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-04 14:35 - 2013-09-01 00:57 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-03 14:20 - 2013-09-01 21:18 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-04-04 15:01 - 00003264 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-03-18 17:33 - 00003386 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 14:54 - 2012-12-18 00:46 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-09-01 14:39 - 2012-08-14 13:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 13:21 - 2013-09-01 13:21 - 00003060 _____ C:\windows\System32\Tasks\Lyrics Seeker Update
2013-09-01 13:21 - 2011-07-16 21:34 - 00001727 _____ C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-01 01:49 - 2013-09-01 01:47 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 01:11 - 2013-09-01 01:11 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-09-01 01:04 - 2013-09-01 01:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-01 01:00 - 2013-09-01 01:00 - 00000000 ____D C:\ProgramData\APN
2013-09-01 00:58 - 2013-09-01 00:58 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-01 00:57 - 2013-09-01 00:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-01 00:57 - 2012-12-21 16:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-01 00:56 - 2013-09-01 00:53 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:03 - 2013-09-01 00:02 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
Some content of TEMP:
====================
C:\Users\flatterratz\AppData\Local\Temp\1acmxyo3.dll
C:\Users\flatterratz\AppData\Local\Temp\APNStub.exe
C:\Users\flatterratz\AppData\Local\Temp\AskSLib.dll
C:\Users\flatterratz\AppData\Local\Temp\drm_dialogs.dll
C:\Users\flatterratz\AppData\Local\Temp\Extract.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\flatterratz\AppData\Local\Temp\MSETUP4.EXE
C:\Users\flatterratz\AppData\Local\Temp\NEWEBDB.tmp.exe
C:\Users\flatterratz\AppData\Local\Temp\setup.exe
C:\Users\flatterratz\AppData\Local\Temp\SIntf16.dll
C:\Users\flatterratz\AppData\Local\Temp\SIntf32.dll
C:\Users\flatterratz\AppData\Local\Temp\SIntfNT.dll
C:\Users\flatterratz\AppData\Local\Temp\SP57760.exe
C:\Users\flatterratz\AppData\Local\Temp\sp58915.exe
C:\Users\flatterratz\AppData\Local\Temp\SP60504.exe
C:\Users\flatterratz\AppData\Local\Temp\stubhelper.dll
C:\Users\flatterratz\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\flatterratz\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\flatterratz\AppData\Local\Temp\WEB.DE_Toolbar_IE_Setup.exe
C:\Users\flatterratz\AppData\Local\Temp\WEB.DE_Toolbar_IE_Special.exe
C:\Users\flatterratz\AppData\Local\Temp\webde_onlinespeicher_setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-21 20:05
==================== End Of Log ============================
----------------------------------------------------------------- GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-27 18:15:42
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK2565GSX rev.GJ002C 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\FLATTE~1\AppData\Local\Temp\awddrpow.sys
---- User code sections - GMER 2.1 ----
.text C:\ProgramData\eSafe\eGdpSvc.exe[1444] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\ProgramData\eSafe\eGdpSvc.exe[1444] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[476] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[476] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3468] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3468] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3536] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3536] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3908] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3908] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\windows\SysWOW64\RunDll32.exe[3264] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\windows\SysWOW64\RunDll32.exe[3264] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af188330
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af188330@0019631311f5 0x47 0x98 0xC9 0xB5 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af188330@c864c7a9eaf7 0xFE 0xBD 0x3B 0x6C ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af188330 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af188330@0019631311f5 0x47 0x98 0xC9 0xB5 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af188330@c864c7a9eaf7 0xFE 0xBD 0x3B 0x6C ...
---- EOF - GMER 2.1 ----
|
|
27.09.2013, 20:04
| #2 | |
| /// the machine /// TB-Ausbilder    | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
28.09.2013, 12:19
| #3 |
| | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Hallo Dir,
__________________hui Danke für die flotte Antwort! Avira Blockierung hat sich nicht aufheben lassen, trotz Inaktivität und Neustart und lässt sich wieder nicht mehr aktivieren. Hoffe das Logfile ist trotzdem brauchbar. Combofix Logfile: Code:
ATTFilter ComboFix 13-09-26.03 - flatterratz 27.09.2013 21:30:19.1.1 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.1789.690 [GMT 2:00]
ausgeführt von:: c:\users\flatterratz\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\3F7457A9B0.sys
c:\users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Preferences
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_WsysSvc
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-27 bis 2013-09-27 ))))))))))))))))))))))))))))))
.
.
2013-09-27 19:44 . 2013-09-27 19:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-27 19:44 . 2013-09-27 19:44 -------- d-----w- c:\users\Feuertanz\AppData\Local\temp
2013-09-27 19:22 . 2013-09-27 19:22 -------- d-----w- c:\users\flatterratz\AppData\Roaming\eUpdate
2013-09-27 17:54 . 2013-09-27 17:54 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-27 17:52 . 2013-09-27 17:52 -------- d-----w- c:\users\flatterratz\AppData\Roaming\Avira
2013-09-27 17:46 . 2013-09-27 17:45 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-09-27 17:46 . 2013-09-27 17:45 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-27 17:46 . 2013-09-27 17:45 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-09-27 17:46 . 2013-09-27 17:46 -------- d-----w- c:\program files (x86)\Avira
2013-09-27 17:30 . 2013-09-05 05:32 9694160 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C1264D5C-E2FC-4F4D-9D02-7C8880E98F5E}\mpengine.dll
2013-09-11 18:15 . 2013-08-05 02:25 155584 ----a-w- c:\windows\system32\drivers\ataport.sys
2013-09-05 14:04 . 2013-09-05 14:04 209272 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2013-09-05 12:24 . 2013-09-05 12:24 -------- d-----w- C:\FRST
2013-09-05 12:03 . 2013-08-14 17:56 262552 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-09-01 11:22 . 2013-09-27 19:24 -------- d-----w- c:\programdata\eSafe
2013-09-01 11:21 . 2013-09-05 12:28 -------- d-----w- c:\program files (x86)\LyricsSeeker
2013-08-31 23:00 . 2013-08-31 23:00 -------- d-----w- c:\programdata\APN
2013-08-31 22:30 . 2013-08-07 02:22 278800 ------w- c:\windows\system32\MpSigStub.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-26 11:42 . 2012-08-14 11:46 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-26 11:42 . 2012-08-14 11:46 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-11 23:35 . 2011-09-19 17:09 79143768 ----a-w- c:\windows\system32\MRT.exe
2013-08-02 01:48 . 2013-09-11 18:15 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-25 09:25 . 2013-08-15 10:35 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-15 10:35 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-15 10:35 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-15 10:35 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-07-09 05:52 . 2013-08-15 10:40 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-15 10:35 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-15 10:40 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-15 10:40 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-15 10:40 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-09 04:52 . 2013-08-15 10:35 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-15 10:40 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-15 10:40 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-15 10:40 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-15 10:40 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-07-06 06:03 . 2013-08-15 10:34 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-01-07 14:04 . 2013-05-11 11:23 15672013 ----a-w- c:\program files (x86)\any-video-converter-free.exe
2004-04-25 09:56 . 2013-05-09 19:09 986173 ----a-r- c:\program files (x86)\WRAR330D.EXE
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-02-22 2363392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-05 98304]
"Guard.Mail.ru.gui"="c:\program files (x86)\Guard-ICQ\GuardICQ.exe" [2012-08-17 1564368]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2010-10-01 256056]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-08-11 658424]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2013-06-17 295512]
"CanonQuickMenu"="c:\program files (x86)\Canon\Quick Menu\CNQMMAIN.EXE" [2012-09-27 1279120]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-27 347192]
.
c:\users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-30 1132320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbwwan.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys;c:\windows\SYSNATIVE\drivers\massfilter_hs.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 zghsdiag;ZTE General Handset Diagnostic Port;c:\windows\system32\DRIVERS\zghsdiag.sys;c:\windows\SYSNATIVE\DRIVERS\zghsdiag.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 hpHotkeyMonitor;HP Hotkey Monitor;c:\program files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 rtsuvc;HP Webcam [2 MP Fixed];c:\windows\system32\DRIVERS\rtsuvc.sys;c:\windows\SYSNATIVE\DRIVERS\rtsuvc.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-02-22 19:38 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-20 23:56 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-14 11:42]
.
2013-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-10 19:55]
.
2013-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-10 19:55]
.
2013-09-05 c:\windows\Tasks\HPCeeScheduleForflatterratz.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
2013-09-05 c:\windows\Tasks\Lyrics Seeker Update.job
- c:\program files (x86)\LyricsSeeker\Lupdate.exe [2013-08-29 06:35]
.
2013-09-05 c:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
- c:\users\flatterratz\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-01 14:23]
.
2013-09-05 c:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
- c:\users\flatterratz\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-01 14:23]
.
2013-09-05 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
- c:\users\flatterratz\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-01 14:23]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-04-05 8192]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2013-01-10 489472]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11\WLTRAY.exe" [2013-05-30 7177728]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
mStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\
FF - prefs.js: browser.search.selectedEngine - delta-homes
FF - prefs.js: browser.startup.homepage - hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380309801
FF - ExtSQL: 2013-09-01 01:53; toolbar@web.de; c:\users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\extensions\toolbar@web.de.xpi
FF - ExtSQL: 2013-09-01 13:21; {0ce6ac61-48e9-426f-9268-6f1e8ece06da}; c:\program files (x86)\LyricsSeeker\131.xpi
FF - ExtSQL: 2013-09-05 14:12; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8LRgUnVD&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - 88bae139000000000000cc52af0dd39b
FF - user.js: extensions.incredibar_i.instlDay - 15664
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1422:55
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8LRgUnVD
FF - user.js: extensions.incredibar_i.upn2n - 92825436206402737
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10678
FF - user.js: extensions.incredibar_i.ppd - 111
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=88bae139000000000000cc52af0dd39b&q=
FF - user.js: extensions.BabylonToolbar.id - 88bae139000000000000cc52af0dd39b
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15664
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.3.8
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.3.8
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.3.80:27
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files (x86)\Ask.com\GenericAskToolbar.dll
BHO-{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - c:\progra~2\Funmoods\1.5.23.22\bh\escort.dll
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files (x86)\Ask.com\GenericAskToolbar.dll
Toolbar-{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - c:\progra~2\Funmoods\1.5.23.22\escorTlbr.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files (x86)\Ask.com\GenericAskToolbar.dll
Wow6432Node-HKCU-Run-FDPRO-516 - c:\program files (x86)\Fighters\FighterLauncher.exe
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-09-27 22:00:08 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-09-27 20:00
.
Vor Suchlauf: 14 Verzeichnis(se), 56.689.418.240 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 59.509.321.728 Bytes frei
.
- - End Of File - - 9E15551AC4426FF6217C477CEAF5C3BD
A36C5E4F47E84449FF07ED3517B43A31 Hallo, ähm wäre es vielleicht für die Funktion von combofix, hilfreich wenn ich das Avira vor dem Combofix durchlauf komplett deinstalliere? Nach dem deaktivieren muss ich es ohnehin neu draufspielen, da es sich ja nicht mehr aktivieren lässt. Danke und Gruß |
|
29.09.2013, 05:43
| #4 |
| /// the machine /// TB-Ausbilder | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.09.2013, 17:56
| #5 |
| | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Hi Schrauber, super was jetzt alles runtergeschmissen wurde! Ist schon so einiges drauf gewesen. Hier die Logs: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.29.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 flatterratz :: FLATTERRATZ-HP [Administrator] Schutz: Aktiviert 29.09.2013 12:15:45 mbam-log-2013-09-29 (12-15-45).txt Art des Suchlaufs: Vollständiger Suchlauf (A:\|C:\|D:\|F:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUM Deaktivierte Suchlaufeinstellungen: PUP | P2P Durchsuchte Objekte: 455501 Laufzeit: 3 Stunde(n), 56 Minute(n), 13 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 3 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (Hijack.StartPage) -> Bösartig: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bösartig: (hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Program Files (x86)\WRAR330D.EXE (Trojan.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.005 - Bericht erstellt am 29/09/2013 um 17:32:58
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : flatterratz - FLATTERRATZ-HP
# Gestartet von : C:\Users\flatterratz\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Program Files (x86)\optimizer pro
Ordner Gelöscht : C:\Program Files (x86)\Perion
Ordner Gelöscht : C:\Users\flatterratz\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\flatterratz\AppData\Local\Wajam
Ordner Gelöscht : C:\Users\flatterratz\AppData\LocalLow\Funmoods
Ordner Gelöscht : C:\Users\flatterratz\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\flatterratz\AppData\Roaming\eUpdate
Ordner Gelöscht : C:\Users\flatterratz\AppData\Roaming\registry mechanic
Ordner Gelöscht : C:\Users\flatterratz\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Ordner Gelöscht : C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Ordner Gelöscht : C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
Ordner Gelöscht : C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Datei Gelöscht : C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\HelperFramework@ZoneMedia.com.xpi
Datei Gelöscht : C:\windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\flatterratz\AppData\Local\funmoods.crx
Datei Gelöscht : C:\Users\flatterratz\AppData\Local\funmoods-speeddial.crx
Datei Gelöscht : C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\safesearch.xml
Datei Gelöscht : C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\user.js
Datei Gelöscht : C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage
Datei Gelöscht : C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage
Datei Gelöscht : C:\windows\Tasks\Lyrics Seeker Update.job
Datei Gelöscht : C:\windows\System32\Tasks\Lyrics Seeker Update
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WEB.DE.lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\WEB.DE.lnk
Verknüpfung Desinfiziert : C:\Users\flatterratz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [Backup.old.Start Page]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\f
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\funmoodsApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\funmoodsApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\tracing\askpartnercobrandingtool_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKCU\Software\53e8c88e13def48
Schlüssel Gelöscht : HKLM\SOFTWARE\53e8c88e13def48
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_cartoon-maker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_cartoon-maker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cartoon-maker(1)_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cartoon-maker(1)_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cartoon-maker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cartoon-maker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cdex_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cdex_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D0F4A166-B8D4-48B8-9D63-80849FE137CB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F34C9277-6577-4DFF-B2D7-7D58092F272F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F34C9277-6577-4DFF-B2D7-7D58092F272F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\Ciuvo
[#] Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\lyrixeeker
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\delta-homesSoftware
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\Software\IB Updater
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\iLividSRTB
Schlüssel Gelöscht : HKLM\Software\qvo6Software
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Results Toolbar
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\IB Updater
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\prefs.js ]
Zeile gelöscht : user_pref("avg.install.userHPSettings", "hxxp://search.babylon.com/?affID=117223&tt=4712_2&babsrc=HP_ss&mntrId=88bae139000000000000cc52af0dd39b");
Zeile gelöscht : user_pref("avg.install.userSPSettings", "Search the web (Babylon)");
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.delta-homes.com/newtab/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=nt&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380232706"[...]
Zeile gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.id", "88bae139000000000000cc52af0dd39b");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15664");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=88bae139000000000000cc52af0dd39b&q=");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=117223&tt=4712_2&babsrc=NT_ss&mntrId=88bae139000000000000cc52af0dd39b");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.80:27:11");
Zeile gelöscht : user_pref("extensions.ffxtlbr@incredibar.com.install-event-fired", true);
Zeile gelöscht : user_pref("extensions.incredibar.actvtyRptTime", "1355181912291");
Zeile gelöscht : user_pref("extensions.incredibar.admin", false);
Zeile gelöscht : user_pref("extensions.incredibar.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar.afterInstallRpt", "sent");
Zeile gelöscht : user_pref("extensions.incredibar.cntry", "DE");
Zeile gelöscht : user_pref("extensions.incredibar.dfltLng", "EN");
Zeile gelöscht : user_pref("extensions.incredibar.dfltlng", "EN");
Zeile gelöscht : user_pref("extensions.incredibar.dfltsrch", "false");
Zeile gelöscht : user_pref("extensions.incredibar.did", "10678");
Zeile gelöscht : user_pref("extensions.incredibar.envrmnt", "production");
Zeile gelöscht : user_pref("extensions.incredibar.excTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar.hdrMd5", "41F8BD8A098F069BC2A62E3E961E9E4C");
Zeile gelöscht : user_pref("extensions.incredibar.hmpg", false);
Zeile gelöscht : user_pref("extensions.incredibar.hrdid", "88bae139000000000000cc52af0dd39b");
Zeile gelöscht : user_pref("extensions.incredibar.id", "88bae139000000000000cc52af0dd39b");
Zeile gelöscht : user_pref("extensions.incredibar.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar.instlday", "15664");
Zeile gelöscht : user_pref("extensions.incredibar.instlref", "");
Zeile gelöscht : user_pref("extensions.incredibar.isDcmntCmplt", false);
Zeile gelöscht : user_pref("extensions.incredibar.isdcmntcmplt", "false");
Zeile gelöscht : user_pref("extensions.incredibar.keywordurl", "");
Zeile gelöscht : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1422:55:59");
Zeile gelöscht : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Zeile gelöscht : user_pref("extensions.incredibar.newtab", "false");
Zeile gelöscht : user_pref("extensions.incredibar.newtaburl", "");
Zeile gelöscht : user_pref("extensions.incredibar.noFFXTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar.ppd", "111");
Zeile gelöscht : user_pref("extensions.incredibar.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar.prtnrid", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar.sg", "{smplGrp}");
Zeile gelöscht : user_pref("extensions.incredibar.smplgrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar.srch", "");
Zeile gelöscht : user_pref("extensions.incredibar.srchprvdr", "");
Zeile gelöscht : user_pref("extensions.incredibar.tlbrid", "base");
Zeile gelöscht : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8LRgUnVD&loc=IB_TB&i=26&search=");
Zeile gelöscht : user_pref("extensions.incredibar.upn2", "6R8LRgUnVD");
Zeile gelöscht : user_pref("extensions.incredibar.upn2n", "92825436206402737");
Zeile gelöscht : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar.vrsnts", "1.5.11.1422:55:59");
Zeile gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.did", "10678");
Zeile gelöscht : user_pref("extensions.incredibar_i.excTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.id", "88bae139000000000000cc52af0dd39b");
Zeile gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlDay", "15664");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlRef", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.newTab", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.ppd", "111");
Zeile gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8LRgUnVD&loc=IB_TB&i=26&search=");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2", "6R8LRgUnVD");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2n", "92825436206402737");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1422:55:59");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.mywebsearch.prevDefaultEngine", "Search the web (Babylon)");
Zeile gelöscht : user_pref("extensions.mywebsearch.prevSelectedEngine", "Search the web (Babylon)");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=864B1A74-DA52-43DD-8541-98711293778A&n=77ee84f7&ptnrS=GRxdm531YYde&si=CJeH-cTX_LMCFURY3godck[...]
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.hp.enabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.hp.user.defined", false);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.initialized", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.contextKey", "");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.installDate", "2012120311");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.partnerId", "GRxdm531YYde");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.partnerSubId", "CJeH-cTX_LMCFURY3godckwAKQ");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.success", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.toolbarId", "864B1A74-DA52-43DD-8541-98711293778A");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.lastActivePing", "1355168127924");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.tab.date", "1354529458839");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark._5aMembers_.weather.location", "10001");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "mywebface@mindspark.com");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.lastInstalled", "mywebface@mindspark.com");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.sa.enabled", true);
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.sa.owner", "mywebface@mindspark.com");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.tab.enabled", true);
Zeile gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.sweetim.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"h[...]
[ Datei : C:\Users\Feuertanz\AppData\Roaming\Mozilla\Firefox\Profiles\3phsuamw.default\prefs.js ]
Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE");
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
-\\ Google Chrome v29.0.1547.76
[ Datei : C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht : search_url
Gelöscht : keyword
[ Datei : C:\Users\Feuertanz\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [30860 octets] - [29/09/2013 17:23:46]
AdwCleaner[S0].txt - [27315 octets] - [29/09/2013 17:32:58]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [27376 octets] ##########
JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Windows 7 Home Premium x64
Ran by flatterratz on 29.09.2013 at 17:47:03,51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\\URL
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2407356875-34449621-2769195153-1000\Software\SweetIM
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\systweakasp_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\systweakasp_rasmancs
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6B916290-38B3-4EBC-A858-7E71C3D049B9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E38EE736-8F53-4DE1-A867-0E35AD8808F8}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\fighters"
Successfully deleted: [Folder] "C:\Users\flatterratz\AppData\Roaming\fighters"
Successfully deleted: [Folder] "C:\Users\flatterratz\appdata\local\apn"
~~~ FireFox
Successfully deleted: [File] C:\user.js
Successfully deleted: [File] C:\Users\flatterratz\AppData\Roaming\mozilla\firefox\profiles\tofyfz9f.default\extensions\toolbar_avira-v7@apn.ask.com.xpi
Successfully deleted the following from C:\Users\flatterratz\AppData\Roaming\mozilla\firefox\profiles\tofyfz9f.default\prefs.js
user_pref("browser.startup.homepage", "hxxp://avira.search.ask.com/?p2=%5EB0Q%5EYYYYYY%5EZF%5EDE&gct=hp&o=APN11074&apn_ptnrs=%5EB0Q&apn_dtid=%5EYYYYYY%5EZF%5EDE&tpid=AVIRA-V7&
user_pref("extensions.AVIRA-V7.com.avira.dnt.rules", "\"{\\\"Version\\\":38,\\\"Companies\\\":[{\\\"company\\\":\\\"Google Inc\\\",\\\"rules\\\":[{\\\"name\\\":\\\"Google Anal
user_pref("extensions.AVIRA-V7.domain", "\"avira.search.ask.com\"");
user_pref("extensions.AVIRA-V7.hpr_ff", "\"hxxp://avira.search.ask.com/?p2=%5EB0Q%5EYYYYYY%5EZF%5EDE&gct=hp&o=APN11074&apn_ptnrs=%5EB0Q&apn_dtid=%5EYYYYYY%5EZF%5EDE&tpid=AVIRA
user_pref("extensions.toolbar@ask.com.install-event-fired", true);
Emptied folder: C:\Users\flatterratz\AppData\Roaming\mozilla\firefox\profiles\tofyfz9f.default\minidumps [261 files]
~~~ Chrome
Successfully deleted: [Folder] C:\Users\flatterratz\appdata\local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
Successfully deleted: [Folder] C:\Users\flatterratz\appdata\local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Successfully deleted: [Folder] C:\Users\flatterratz\appdata\local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\niogeckbkdcabhnapjbkeiklablhjoca
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.09.2013 at 18:03:38,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by flatterratz (administrator) on FLATTERRATZ-HP on 29-09-2013 18:33:14
Running from C:\Users\flatterratz\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\windows\system32\atieclxx.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2013-01-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [489472 2013-01-10] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [7177728 2013-05-30] (Broadcom Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-08-17] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-10-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-06-18] (RealNetworks, Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] - C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-28] (Avira Operations GmbH & Co. KG)
HKU\Feuertanz\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\Feuertanz\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Feuertanz\...\Policies\system: [LogonHoursAction] 2
HKU\Feuertanz\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
SearchScopes: HKCU - Backup.Old.DefaultScope {E38EE736-8F53-4DE1-A867-0E35AD8808F8}
SearchScopes: HKCU - {59F87DB3-BE1B-451E-BC69-551AD34E41F2} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6EE5531F-DBDD-4EDF-8917-10B675B66191} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D2AD5932-5B7F-4E2E-9C75-FEC802354337} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {DEBC633C-67A2-4F44-9904-F868FE5B2B22} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: Ask Search
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\data
FF Extension: check4change-owner - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\check4change-owner@mozdev.org.xpi
FF Extension: firebug - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: toolbar - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\toolbar@web.de.xpi
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [{0ce6ac61-48e9-426f-9268-6f1e8ece06da}] - C:\Program Files (x86)\LyricsSeeker\131.xpi
FF Extension: No Name - C:\Program Files (x86)\LyricsSeeker\131.xpi
Chrome:
=======
CHR DefaultSearchURL: (delta-homes) - hxxp://www.google.com
CHR DefaultSuggestURL: (delta-homes) - "suggest_url": ""
CHR Extension: (Avira Toolbar) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.11.0_0
CHR Extension: (Docs) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Facebook) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0
CHR Extension: (Google Search) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Facebook Disconnect) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0
CHR Extension: (RealDownloader) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0
CHR Extension: (Lyrics Seeker) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgoiojnjnacbjngolldkokokgpcjbgjj\1.131_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\flatterratz\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.11.0.crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lgoiojnjnacbjngolldkokokgpcjbgjj] - C:\Program Files (x86)\LyricsSeeker\131.crx
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-28] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-09-24] (APN LLC.)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-08-17] ()
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [280120 2010-10-01] (Hewlett-Packard Company)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE [48128 2013-05-30] (Broadcom Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-28] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-28] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-28] (Avira Operations GmbH & Co. KG)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [18456 2012-01-10] (HandSet Incorporated)
S3 massfilter_hs; C:\Windows\SysWow64\drivers\massfilter_hs.sys [9216 2010-10-20] (HandSet Incorporated)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)
S3 zghsdiag; C:\Windows\System32\DRIVERS\zghsdiag.sys [129304 2010-10-18] (ZTE Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-29 18:32 - 2013-09-29 18:32 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:51 - 2013-09-29 17:51 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:20 - 2013-09-29 17:33 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 12:04 - 2013-09-29 12:04 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 12:04 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-29 12:00 - 2013-09-29 12:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:45 - 2013-09-28 23:45 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-28 23:44 - 2013-09-28 23:44 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-28 23:40 - 2013-09-28 23:40 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-28 23:40 - 2013-09-28 23:40 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-28 23:38 - 2013-09-28 23:38 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-28 23:37 - 2013-09-28 23:37 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-28 23:37 - 2013-09-28 23:36 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-28 23:37 - 2013-09-28 23:36 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-28 23:37 - 2013-09-28 23:36 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 21:17 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-27 21:17 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-27 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-27 21:11 - 2013-09-27 22:00 - 00000000 ____D C:\Qoobox
2013-09-27 21:10 - 2013-09-27 21:55 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:07 - 2013-09-27 21:08 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-22 14:41 - 2013-09-22 20:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-16 23:44 - 2013-09-17 01:42 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-12 01:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-12 01:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-12 01:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 20:15 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-11 20:15 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-11 20:15 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-11 20:15 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-11 20:15 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-11 20:15 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:01 - 2013-09-05 14:02 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 21:18 - 2013-09-03 14:20 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-05 19:28 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-01 19:24 - 2013-09-05 19:28 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-01 19:24 - 2013-09-05 17:26 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-01 19:24 - 2013-09-05 17:26 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-01 19:24 - 2013-09-05 12:55 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:58 - 2013-09-29 17:33 - 00001009 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-01 14:58 - 2013-09-06 11:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 13:21 - 2013-09-05 14:28 - 00000000 ____D C:\Program Files (x86)\LyricsSeeker
2013-09-01 01:47 - 2013-09-01 01:49 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:53 - 2013-09-01 00:56 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:30 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-01 00:02 - 2013-09-01 00:03 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
==================== One Month Modified Files and Folders =======
2013-09-29 18:32 - 2013-09-29 18:32 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-29 18:18 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-29 18:18 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-29 18:08 - 2012-05-11 00:20 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-09-29 18:08 - 2010-12-09 00:59 - 00000000 ____D C:\ProgramData\PDFC
2013-09-29 18:08 - 2009-07-14 06:51 - 00244620 _____ C:\windows\setupact.log
2013-09-29 18:06 - 2011-03-01 14:44 - 02062542 _____ C:\windows\WindowsUpdate.log
2013-09-29 18:06 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:51 - 2013-09-29 17:51 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:33 - 2013-09-29 17:20 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:33 - 2013-09-01 14:58 - 00001009 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-29 17:33 - 2013-01-10 22:01 - 00001246 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-29 17:33 - 2011-07-16 21:34 - 00001007 _____ C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 16:58 - 2011-07-17 05:06 - 01932256 _____ C:\windows\PFRO.log
2013-09-29 12:04 - 2013-09-29 12:04 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 12:02 - 2013-09-29 12:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:45 - 2013-09-28 23:45 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-28 23:44 - 2013-09-28 23:44 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-28 23:40 - 2013-09-28 23:40 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-28 23:40 - 2013-09-28 23:40 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-28 23:38 - 2013-09-28 23:38 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-28 23:37 - 2013-09-28 23:37 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-28 23:37 - 2012-12-21 16:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-28 23:36 - 2013-09-28 23:37 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-28 23:36 - 2013-09-28 23:37 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-28 23:36 - 2013-09-28 23:37 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 22:00 - 2013-09-27 21:11 - 00000000 ____D C:\Qoobox
2013-09-27 22:00 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-27 21:55 - 2013-09-27 21:10 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:50 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-27 21:47 - 2009-07-14 04:34 - 74186752 _____ C:\windows\system32\config\SOFTWARE.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 17825792 _____ C:\windows\system32\config\SYSTEM.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00524288 _____ C:\windows\system32\config\DEFAULT.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-09-27 21:08 - 2013-09-27 21:07 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 15:01 - 2013-03-12 23:13 - 00000000 ____D C:\Users\flatterratz\Desktop\OpenOffice.org 3.4.1 (de) Installation Files
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:48 - 2011-07-16 21:29 - 00000000 ____D C:\Users\flatterratz
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-26 14:54 - 2011-07-24 21:31 - 00000000 ____D C:\Users\flatterratz\AppData\Local\CrashDumps
2013-09-26 13:42 - 2012-08-14 13:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-26 13:42 - 2012-08-14 13:46 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-26 13:42 - 2012-08-14 13:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-23 21:28 - 2012-11-24 20:44 - 00000000 ____D C:\Users\flatterratz\Documents\GTA Vice City User Files
2013-09-22 20:41 - 2013-09-22 14:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-17 01:42 - 2013-09-16 23:44 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-13 23:07 - 2010-12-09 00:40 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-09-13 23:07 - 2010-12-09 00:40 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-09-13 23:07 - 2009-07-14 07:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:41 - 2009-07-14 06:45 - 04976408 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-12 01:41 - 2013-07-29 01:04 - 00000000 ____D C:\windows\system32\MRT
2013-09-12 01:35 - 2011-09-19 19:09 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-11 15:09 - 2012-07-28 21:35 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Adobe
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\ProgramData\Adobe
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-07 17:53 - 2013-06-22 15:26 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-06 11:09 - 2013-09-01 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-06 01:27 - 2013-01-10 21:56 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-05 23:32 - 2013-08-08 13:16 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleForflatterratz
2013-09-05 23:32 - 2013-08-08 13:16 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleForflatterratz.job
2013-09-05 19:28 - 2013-09-01 19:24 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-05 19:28 - 2013-09-01 19:24 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-05 17:26 - 2013-09-01 19:24 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-05 17:26 - 2013-09-01 19:24 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-05 14:28 - 2013-09-01 13:21 - 00000000 ____D C:\Program Files (x86)\LyricsSeeker
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:03 - 2013-08-17 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-05 14:02 - 2013-09-05 14:01 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-05 13:27 - 2013-01-10 21:56 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-05 13:08 - 2013-01-10 16:37 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-09-05 13:07 - 2013-02-14 14:28 - 00000000 _____ C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-05 12:55 - 2013-09-01 19:24 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-05 12:55 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-03 14:20 - 2013-09-01 21:18 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-04-04 15:01 - 00003264 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-03-18 17:33 - 00003386 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 14:39 - 2012-08-14 13:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 01:49 - 2013-09-01 01:47 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:56 - 2013-09-01 00:53 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:03 - 2013-09-01 00:02 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
Some content of TEMP:
====================
C:\Users\flatterratz\AppData\Local\Temp\drm_dialogs.dll
C:\Users\flatterratz\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-21 20:05
==================== End Of Log ============================
Kann ich den defogger jetze wieder re-enablen? und macht es Sinn die Passwörter überall zu ändern? Nochma tausend Dank! |
|
30.09.2013, 08:34
| #6 |
| /// the machine /// TB-Ausbilder | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runterESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter |
|
30.09.2013, 20:14
| #7 |
| | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Hallo Dir, so einmal schnell das eset log, nur für den Fall das es beim deinstallieren mitverschwindet. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=c16c3d3e2a63b548aca2a3a0b99df37f
# engine=15305
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-30 03:25:07
# local_time=2013-09-30 05:25:07 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 18551 151753 11231 0
# compatibility_mode=5893 16776574 100 94 250725 132184557 0 0
# scanned=266534
# found=5
# cleaned=0
# scan_time=16376
sh=174980D50AF29D2B126A3A4E70975209300370F2 ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.L application" ac=I fn="C:\Program Files (x86)\LyricsSeeker\131.crx"
sh=D5DD4F586A82AFFAED4500EC41039A6FB0BA812D ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.L application" ac=I fn="C:\Program Files (x86)\LyricsSeeker\131.xpi"
sh=93A402B26ED511B22D4600428270D653D7F181D4 ft=1 fh=c71c0011d92492a0 vn="Win32/AdWare.AddLyrics.P application" ac=I fn="C:\Program Files (x86)\LyricsSeeker\Lupdate.exe"
sh=FCFF1CCDEB9E06DA4377E91C994C72134C951AC5 ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.L application" ac=I fn="C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgoiojnjnacbjngolldkokokgpcjbgjj\1.131_0\cs.js"
sh=FCFF1CCDEB9E06DA4377E91C994C72134C951AC5 ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.L application" ac=I fn="C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgoiojnjnacbjngolldkokokgpcjbgjj\1.131_1\cs.js"
Möchte jetzt aber nochmal Mozilla neuinstallieren, da ich immer noch ausgeloggt werde. Muss ich dabei noch was beachten? Nochma tausend Dank fürs Platte polieren und hier der safety check: Code:
ATTFilter Results of screen317's Security Check version 0.99.73 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 JavaFX 2.1.1 Java 7 Update 25 Adobe Flash Player 11.8.800.168 Adobe Reader XI Mozilla Firefox (23.0.1) Google Chrome 29.0.1547.66 Google Chrome 29.0.1547.76 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by flatterratz (administrator) on FLATTERRATZ-HP on 30-09-2013 20:58:23
Running from C:\Users\flatterratz\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\windows\system32\atieclxx.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Microsoft Corporation) C:\windows\system32\taskmgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\flatterratz\Downloads\FRST64(1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2013-01-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [489472 2013-01-10] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [7177728 2013-05-30] (Broadcom Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-10-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-06-18] (RealNetworks, Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] - C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-30] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-09-24] (APN)
HKU\Feuertanz\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\Feuertanz\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Feuertanz\...\Policies\system: [LogonHoursAction] 2
HKU\Feuertanz\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
SearchScopes: HKCU - Backup.Old.DefaultScope {E38EE736-8F53-4DE1-A867-0E35AD8808F8}
SearchScopes: HKCU - {59F87DB3-BE1B-451E-BC69-551AD34E41F2} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6EE5531F-DBDD-4EDF-8917-10B675B66191} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D2AD5932-5B7F-4E2E-9C75-FEC802354337} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {DEBC633C-67A2-4F44-9904-F868FE5B2B22} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: Ask Search
FF Homepage: hxxp://avira.search.ask.com/?p2=%5EB0Q%5EYYYYYY%5EZF%5EDE&gct=hp&o=APN11074&apn_ptnrs=%5EB0Q&apn_dtid=%5EYYYYYY%5EZF%5EDE&tpid=AVIRA-V7&apn_dbr=ff_23.0&trgb=ALL&apn_uid=836CC3C7-9979-424F-B0C4-F4C15354B8E9&itbv=12.5.1.1249&doi=2013-09-30&psv=
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\data
FF Extension: check4change-owner - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\check4change-owner@mozdev.org.xpi
FF Extension: firebug - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: toolbar - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\toolbar@web.de.xpi
FF Extension: toolbar_AVIRA-V7 - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [{0ce6ac61-48e9-426f-9268-6f1e8ece06da}] - C:\Program Files (x86)\LyricsSeeker\131.xpi
Chrome:
=======
CHR DefaultSearchURL: (delta-homes) - hxxp://www.google.com
CHR DefaultSuggestURL: (delta-homes) - "suggest_url": ""
CHR Extension: (Avira Toolbar) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.11.0_0
CHR Extension: (Docs) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Facebook) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0
CHR Extension: (Google Search) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Facebook Disconnect) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0
CHR Extension: (RealDownloader) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0
CHR Extension: (Lyrics Seeker) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgoiojnjnacbjngolldkokokgpcjbgjj\1.131_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\flatterratz\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.11.0.crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lgoiojnjnacbjngolldkokokgpcjbgjj] - C:\Program Files (x86)\LyricsSeeker\131.crx
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-30] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-09-24] (APN LLC.)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [280120 2010-10-01] (Hewlett-Packard Company)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE [48128 2013-05-30] (Broadcom Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-09-30] (Avira Operations GmbH & Co. KG)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [18456 2012-01-10] (HandSet Incorporated)
S3 massfilter_hs; C:\Windows\SysWow64\drivers\massfilter_hs.sys [9216 2010-10-20] (HandSet Incorporated)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)
S3 zghsdiag; C:\Windows\System32\DRIVERS\zghsdiag.sys [129304 2010-10-18] (ZTE Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-30 20:57 - 2013-09-30 20:57 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(1).exe
2013-09-30 20:56 - 2013-09-30 20:56 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup safety scan.txt
2013-09-30 19:34 - 2013-09-30 19:34 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck(1).exe
2013-09-30 19:31 - 2013-09-30 19:31 - 00000005 _____ C:\Users\flatterratz\AppData\Roaming\mbam.context.scan
2013-09-30 18:44 - 2013-09-30 18:44 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-30 18:44 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-30 18:37 - 2013-09-30 18:37 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-30 18:32 - 2013-09-30 18:32 - 00000000 ____D C:\ProgramData\APN
2013-09-30 18:31 - 2013-09-30 18:31 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-30 18:30 - 2013-09-30 18:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(1).exe
2013-09-30 18:30 - 2013-09-30 18:20 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-30 18:30 - 2013-09-30 18:20 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-30 18:30 - 2013-09-30 18:20 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-30 18:29 - 2013-09-30 18:29 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-30 18:16 - 2013-09-30 18:16 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(5).exe
2013-09-30 18:06 - 2013-09-30 18:06 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup.txt
2013-09-30 17:40 - 2013-09-30 17:40 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck.exe
2013-09-30 12:45 - 2013-09-30 12:45 - 02347384 _____ (ESET) C:\Users\flatterratz\Downloads\esetsmartinstaller_enu.exe
2013-09-29 18:46 - 2013-09-29 18:46 - 00056925 _____ C:\Users\flatterratz\Downloads\FRST2.txt
2013-09-29 18:32 - 2013-09-29 18:32 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:51 - 2013-09-29 17:51 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:20 - 2013-09-29 17:33 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 12:04 - 2013-09-30 18:44 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:00 - 2013-09-29 12:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 21:17 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-27 21:17 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-27 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-27 21:11 - 2013-09-27 22:00 - 00000000 ____D C:\Qoobox
2013-09-27 21:10 - 2013-09-27 21:55 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:07 - 2013-09-27 21:08 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-22 14:41 - 2013-09-22 20:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-16 23:44 - 2013-09-17 01:42 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-12 01:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-12 01:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-12 01:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 20:15 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-11 20:15 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-11 20:15 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-11 20:15 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-11 20:15 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-11 20:15 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:01 - 2013-09-05 14:02 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 21:18 - 2013-09-03 14:20 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-05 19:28 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-01 19:24 - 2013-09-05 19:28 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-01 19:24 - 2013-09-05 17:26 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-01 19:24 - 2013-09-05 17:26 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-01 19:24 - 2013-09-05 12:55 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:58 - 2013-09-29 17:33 - 00001009 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-01 14:58 - 2013-09-06 11:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 01:47 - 2013-09-01 01:49 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:53 - 2013-09-01 00:56 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:30 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-01 00:02 - 2013-09-01 00:03 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
==================== One Month Modified Files and Folders =======
2013-09-30 20:57 - 2013-09-30 20:57 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(1).exe
2013-09-30 20:56 - 2013-09-30 20:56 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup safety scan.txt
2013-09-30 19:34 - 2013-09-30 19:34 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck(1).exe
2013-09-30 19:31 - 2013-09-30 19:31 - 00000005 _____ C:\Users\flatterratz\AppData\Roaming\mbam.context.scan
2013-09-30 19:17 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-30 19:17 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-30 19:14 - 2011-03-01 14:44 - 02090893 _____ C:\windows\WindowsUpdate.log
2013-09-30 19:09 - 2012-05-11 00:20 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-09-30 19:09 - 2010-12-09 00:59 - 00000000 ____D C:\ProgramData\PDFC
2013-09-30 19:09 - 2009-07-14 06:51 - 00244900 _____ C:\windows\setupact.log
2013-09-30 19:08 - 2011-07-17 05:06 - 01935690 _____ C:\windows\PFRO.log
2013-09-30 18:44 - 2013-09-30 18:44 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-30 18:44 - 2013-09-29 12:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-30 18:37 - 2013-09-30 18:37 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-30 18:32 - 2013-09-30 18:32 - 00000000 ____D C:\ProgramData\APN
2013-09-30 18:31 - 2013-09-30 18:31 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-30 18:31 - 2013-09-30 18:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(1).exe
2013-09-30 18:29 - 2013-09-30 18:29 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-30 18:29 - 2012-12-21 16:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-30 18:26 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-09-30 18:20 - 2013-09-30 18:30 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-30 18:20 - 2013-09-30 18:30 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-30 18:20 - 2013-09-30 18:30 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-30 18:16 - 2013-09-30 18:16 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(5).exe
2013-09-30 18:06 - 2013-09-30 18:06 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup.txt
2013-09-30 17:40 - 2013-09-30 17:40 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck.exe
2013-09-30 12:48 - 2010-12-09 00:40 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-09-30 12:48 - 2010-12-09 00:40 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-09-30 12:48 - 2009-07-14 07:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-30 12:45 - 2013-09-30 12:45 - 02347384 _____ (ESET) C:\Users\flatterratz\Downloads\esetsmartinstaller_enu.exe
2013-09-29 18:46 - 2013-09-29 18:46 - 00056925 _____ C:\Users\flatterratz\Downloads\FRST2.txt
2013-09-29 18:32 - 2013-09-29 18:32 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:51 - 2013-09-29 17:51 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:33 - 2013-09-29 17:20 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:33 - 2013-09-01 14:58 - 00001009 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-29 17:33 - 2013-01-10 22:01 - 00001246 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-29 17:33 - 2012-08-17 15:47 - 00000000 ____D C:\ProgramData\ICQ
2013-09-29 17:33 - 2011-07-16 21:34 - 00001007 _____ C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:02 - 2013-09-29 12:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 22:00 - 2013-09-27 21:11 - 00000000 ____D C:\Qoobox
2013-09-27 22:00 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-27 21:55 - 2013-09-27 21:10 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:50 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-27 21:47 - 2009-07-14 04:34 - 74186752 _____ C:\windows\system32\config\SOFTWARE.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 17825792 _____ C:\windows\system32\config\SYSTEM.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00524288 _____ C:\windows\system32\config\DEFAULT.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-09-27 21:08 - 2013-09-27 21:07 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 15:01 - 2013-03-12 23:13 - 00000000 ____D C:\Users\flatterratz\Desktop\OpenOffice.org 3.4.1 (de) Installation Files
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:48 - 2011-07-16 21:29 - 00000000 ____D C:\Users\flatterratz
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-26 14:54 - 2011-07-24 21:31 - 00000000 ____D C:\Users\flatterratz\AppData\Local\CrashDumps
2013-09-26 13:42 - 2012-08-14 13:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-26 13:42 - 2012-08-14 13:46 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-26 13:42 - 2012-08-14 13:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-23 21:28 - 2012-11-24 20:44 - 00000000 ____D C:\Users\flatterratz\Documents\GTA Vice City User Files
2013-09-22 20:41 - 2013-09-22 14:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-17 01:42 - 2013-09-16 23:44 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:41 - 2009-07-14 06:45 - 04976408 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-12 01:41 - 2013-07-29 01:04 - 00000000 ____D C:\windows\system32\MRT
2013-09-12 01:35 - 2011-09-19 19:09 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-11 15:09 - 2012-07-28 21:35 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Adobe
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\ProgramData\Adobe
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-07 17:53 - 2013-06-22 15:26 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-06 11:09 - 2013-09-01 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-06 01:27 - 2013-01-10 21:56 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-05 23:32 - 2013-08-08 13:16 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleForflatterratz
2013-09-05 23:32 - 2013-08-08 13:16 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleForflatterratz.job
2013-09-05 19:28 - 2013-09-01 19:24 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-05 19:28 - 2013-09-01 19:24 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-05 17:26 - 2013-09-01 19:24 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-05 17:26 - 2013-09-01 19:24 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:03 - 2013-08-17 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-05 14:02 - 2013-09-05 14:01 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-05 13:27 - 2013-01-10 21:56 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-05 13:08 - 2013-01-10 16:37 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-09-05 13:07 - 2013-02-14 14:28 - 00000000 _____ C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-05 12:55 - 2013-09-01 19:24 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-05 12:55 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-03 14:20 - 2013-09-01 21:18 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-04-04 15:01 - 00003264 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-03-18 17:33 - 00003386 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 14:39 - 2012-08-14 13:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 01:49 - 2013-09-01 01:47 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:56 - 2013-09-01 00:53 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:03 - 2013-09-01 00:02 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
Some content of TEMP:
====================
C:\Users\flatterratz\AppData\Local\Temp\175F453A96064739A3827CA04DCAD3FC.exe
C:\Users\flatterratz\AppData\Local\Temp\drm_dialogs.dll
C:\Users\flatterratz\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-21 20:05
==================== End Of Log ============================
--- --- --- |
|
01.10.2013, 16:27
| #8 |
| /// the machine /// TB-Ausbilder | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Chrome bitte deinstallieren, keine Daten behalten und neu installieren. Firefox auch. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Program Files (x86)\LyricsSeeker
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
2013-09-01 19:24 - 2013-09-05 19:28 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-01 19:24 - 2013-09-05 19:28 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-01 19:24 - 2013-09-05 17:26 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-01 19:24 - 2013-09-05 17:26 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-01 19:24 - 2013-09-05 12:55 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.10.2013, 21:02
| #9 |
| | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Hallo Schrauber, iwie geht es hier gerade drunter und drüber. Deshalb erstens hab ich gestern abend den Lyricsseeker gelöscht so in etwa zeitgleich mit der Löschung, hat das Avira genölt. Da war es aber schon zu spät da war die papierkorb leeren Taste schon gedrückt. Die Browser sind neu installiert, aber leider hat das obige mit der Fixlist nicht geklappt egal wo ich sie hin gespeichert habe der FRST hat gesagt er findet sie nicht. Deshalb hab ich ihn auch nochma neu installiert. Hier erst ma ein aktuelles FRST Log und dann probiere ich obiges nochmal FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by flatterratz (administrator) on FLATTERRATZ-HP on 01-10-2013 21:29:53
Running from C:\Users\flatterratz\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\windows\system32\atieclxx.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2013-01-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [489472 2013-01-10] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [7177728 2013-05-30] (Broadcom Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-10-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-06-18] (RealNetworks, Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] - C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-09-24] (APN)
HKU\Feuertanz\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\Feuertanz\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Feuertanz\...\Policies\system: [LogonHoursAction] 2
HKU\Feuertanz\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
SearchScopes: HKCU - Backup.Old.DefaultScope {E38EE736-8F53-4DE1-A867-0E35AD8808F8}
SearchScopes: HKCU - {59F87DB3-BE1B-451E-BC69-551AD34E41F2} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6EE5531F-DBDD-4EDF-8917-10B675B66191} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D2AD5932-5B7F-4E2E-9C75-FEC802354337} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {DEBC633C-67A2-4F44-9904-F868FE5B2B22} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\6hrh7lwx.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\6hrh7lwx.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\6hrh7lwx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [{0ce6ac61-48e9-426f-9268-6f1e8ece06da}] - C:\Program Files (x86)\LyricsSeeker\131.xpi
Chrome:
=======
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh\24.57772_0
CHR Extension: (Google Docs) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (RealDownloader) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\flatterratz\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.11.0.crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lgoiojnjnacbjngolldkokokgpcjbgjj] - C:\Program Files (x86)\LyricsSeeker\131.crx
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-09-24] (APN LLC.)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [280120 2010-10-01] (Hewlett-Packard Company)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE [48128 2013-05-30] (Broadcom Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [18456 2012-01-10] (HandSet Incorporated)
S3 massfilter_hs; C:\Windows\SysWow64\drivers\massfilter_hs.sys [9216 2010-10-20] (HandSet Incorporated)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)
S3 zghsdiag; C:\Windows\System32\DRIVERS\zghsdiag.sys [129304 2010-10-18] (ZTE Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-01 21:29 - 2013-10-01 21:29 - 00000000 ____D C:\FRST
2013-10-01 21:28 - 2013-10-01 21:28 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-10-01 21:26 - 2013-10-01 21:27 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-10-01 20:56 - 2013-10-01 20:57 - 00448512 _____ (OldTimer Tools) C:\Users\flatterratz\Desktop\TFC.exe
2013-10-01 20:19 - 2013-10-01 20:19 - 00001107 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-01 20:19 - 2013-10-01 20:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-01 20:16 - 2013-10-01 20:18 - 00281896 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 24.0.exe
2013-10-01 20:16 - 2013-10-01 20:16 - 22537616 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_de24.0.exe
2013-10-01 20:10 - 2013-10-01 20:10 - 00002215 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-01 20:08 - 2013-10-01 20:08 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-01 19:53 - 2013-10-01 19:53 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-10-01 17:48 - 2013-10-01 17:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(2).exe
2013-10-01 01:19 - 2013-10-01 20:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-01 00:33 - 2013-10-01 13:17 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-30 20:56 - 2013-09-30 20:56 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup safety scan.txt
2013-09-30 19:34 - 2013-09-30 19:34 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck(1).exe
2013-09-30 19:31 - 2013-09-30 19:31 - 00000005 _____ C:\Users\flatterratz\AppData\Roaming\mbam.context.scan
2013-09-30 18:44 - 2013-09-30 18:44 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-30 18:44 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-30 18:37 - 2013-09-30 18:37 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-30 18:32 - 2013-09-30 18:32 - 00000000 ____D C:\ProgramData\APN
2013-09-30 18:31 - 2013-09-30 18:31 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-30 18:30 - 2013-10-01 13:17 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-30 18:30 - 2013-10-01 13:17 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-30 18:30 - 2013-10-01 13:17 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-30 18:30 - 2013-09-30 18:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(1).exe
2013-09-30 18:29 - 2013-09-30 18:29 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-30 18:16 - 2013-09-30 18:16 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(5).exe
2013-09-30 18:06 - 2013-09-30 18:06 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup.txt
2013-09-30 17:40 - 2013-09-30 17:40 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck.exe
2013-09-30 12:45 - 2013-09-30 12:45 - 02347384 _____ (ESET) C:\Users\flatterratz\Downloads\esetsmartinstaller_enu.exe
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:20 - 2013-09-29 17:33 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 12:04 - 2013-09-30 18:44 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:00 - 2013-09-29 12:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 21:17 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-27 21:17 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-27 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-27 21:11 - 2013-09-27 22:00 - 00000000 ____D C:\Qoobox
2013-09-27 21:10 - 2013-09-27 21:55 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:07 - 2013-09-27 21:08 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-22 14:41 - 2013-09-22 20:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-16 23:44 - 2013-09-17 01:42 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-12 01:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-12 01:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-12 01:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 20:15 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-11 20:15 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-11 20:15 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-11 20:15 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-11 20:15 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-11 20:15 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-05 14:01 - 2013-09-05 14:02 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 21:18 - 2013-09-03 14:20 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-05 19:28 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-01 19:24 - 2013-09-05 19:28 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-01 19:24 - 2013-09-05 17:26 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-01 19:24 - 2013-09-05 17:26 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-01 19:24 - 2013-09-05 12:55 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 01:47 - 2013-09-01 01:49 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:53 - 2013-09-01 00:56 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:30 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-01 00:02 - 2013-09-01 00:03 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
==================== One Month Modified Files and Folders =======
2013-10-01 21:29 - 2013-10-01 21:29 - 00000000 ____D C:\FRST
2013-10-01 21:28 - 2013-10-01 21:28 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-10-01 21:27 - 2013-10-01 21:26 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-10-01 21:27 - 2009-07-14 06:51 - 00245180 _____ C:\windows\setupact.log
2013-10-01 21:26 - 2011-03-01 14:44 - 01078479 _____ C:\windows\WindowsUpdate.log
2013-10-01 21:26 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-10-01 20:57 - 2013-10-01 20:56 - 00448512 _____ (OldTimer Tools) C:\Users\flatterratz\Desktop\TFC.exe
2013-10-01 20:21 - 2012-08-17 15:47 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Mozilla
2013-10-01 20:19 - 2013-10-01 20:19 - 00001107 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-01 20:19 - 2013-10-01 20:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-01 20:19 - 2013-10-01 01:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-01 20:18 - 2013-10-01 20:16 - 00281896 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 24.0.exe
2013-10-01 20:16 - 2013-10-01 20:16 - 22537616 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_de24.0.exe
2013-10-01 20:10 - 2013-10-01 20:10 - 00002215 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-01 20:10 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-01 20:10 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-01 20:09 - 2011-10-09 22:15 - 00000000 ____D C:\Program Files (x86)\Google
2013-10-01 20:08 - 2013-10-01 20:08 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-01 20:07 - 2012-08-12 23:09 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Deployment
2013-10-01 20:06 - 2012-08-12 23:09 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Apps\2.0
2013-10-01 20:02 - 2010-12-09 00:59 - 00000000 ____D C:\ProgramData\PDFC
2013-10-01 20:00 - 2012-05-11 00:20 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-10-01 19:59 - 2011-07-17 05:06 - 01936028 _____ C:\windows\PFRO.log
2013-10-01 19:53 - 2013-10-01 19:53 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-10-01 17:48 - 2013-10-01 17:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(2).exe
2013-10-01 13:17 - 2013-10-01 00:33 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-10-01 13:17 - 2013-09-30 18:30 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-10-01 13:17 - 2013-09-30 18:30 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-10-01 13:17 - 2013-09-30 18:30 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-10-01 13:15 - 2012-08-05 22:54 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Mozilla
2013-09-30 20:56 - 2013-09-30 20:56 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup safety scan.txt
2013-09-30 19:34 - 2013-09-30 19:34 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck(1).exe
2013-09-30 19:31 - 2013-09-30 19:31 - 00000005 _____ C:\Users\flatterratz\AppData\Roaming\mbam.context.scan
2013-09-30 18:44 - 2013-09-30 18:44 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-30 18:44 - 2013-09-29 12:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-30 18:37 - 2013-09-30 18:37 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-30 18:32 - 2013-09-30 18:32 - 00000000 ____D C:\ProgramData\APN
2013-09-30 18:31 - 2013-09-30 18:31 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-30 18:31 - 2013-09-30 18:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(1).exe
2013-09-30 18:29 - 2013-09-30 18:29 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-30 18:29 - 2012-12-21 16:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-30 18:16 - 2013-09-30 18:16 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(5).exe
2013-09-30 18:06 - 2013-09-30 18:06 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup.txt
2013-09-30 17:40 - 2013-09-30 17:40 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck.exe
2013-09-30 12:48 - 2010-12-09 00:40 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-09-30 12:48 - 2010-12-09 00:40 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-09-30 12:48 - 2009-07-14 07:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-30 12:45 - 2013-09-30 12:45 - 02347384 _____ (ESET) C:\Users\flatterratz\Downloads\esetsmartinstaller_enu.exe
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:33 - 2013-09-29 17:20 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:33 - 2012-08-17 15:47 - 00000000 ____D C:\ProgramData\ICQ
2013-09-29 17:33 - 2011-07-16 21:34 - 00001007 _____ C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:02 - 2013-09-29 12:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 22:00 - 2013-09-27 21:11 - 00000000 ____D C:\Qoobox
2013-09-27 22:00 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-27 21:55 - 2013-09-27 21:10 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:50 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-27 21:47 - 2009-07-14 04:34 - 74186752 _____ C:\windows\system32\config\SOFTWARE.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 17825792 _____ C:\windows\system32\config\SYSTEM.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00524288 _____ C:\windows\system32\config\DEFAULT.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-09-27 21:08 - 2013-09-27 21:07 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 15:01 - 2013-03-12 23:13 - 00000000 ____D C:\Users\flatterratz\Desktop\OpenOffice.org 3.4.1 (de) Installation Files
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:48 - 2011-07-16 21:29 - 00000000 ____D C:\Users\flatterratz
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-26 14:54 - 2011-07-24 21:31 - 00000000 ____D C:\Users\flatterratz\AppData\Local\CrashDumps
2013-09-26 13:42 - 2012-08-14 13:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-26 13:42 - 2012-08-14 13:46 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-26 13:42 - 2012-08-14 13:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-23 21:28 - 2012-11-24 20:44 - 00000000 ____D C:\Users\flatterratz\Documents\GTA Vice City User Files
2013-09-22 20:41 - 2013-09-22 14:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-17 01:42 - 2013-09-16 23:44 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:41 - 2009-07-14 06:45 - 04976408 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-12 01:41 - 2013-07-29 01:04 - 00000000 ____D C:\windows\system32\MRT
2013-09-12 01:35 - 2011-09-19 19:09 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-11 15:09 - 2012-07-28 21:35 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Adobe
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\ProgramData\Adobe
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-07 17:53 - 2013-06-22 15:26 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-05 23:32 - 2013-08-08 13:16 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleForflatterratz
2013-09-05 23:32 - 2013-08-08 13:16 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleForflatterratz.job
2013-09-05 19:28 - 2013-09-01 19:24 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-05 19:28 - 2013-09-01 19:24 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-05 17:26 - 2013-09-01 19:24 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-05 17:26 - 2013-09-01 19:24 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-05 14:02 - 2013-09-05 14:01 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-05 13:08 - 2013-01-10 16:37 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-09-05 13:07 - 2013-02-14 14:28 - 00000000 _____ C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-05 12:55 - 2013-09-01 19:24 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-05 12:55 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-03 14:20 - 2013-09-01 21:18 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-04-04 15:01 - 00003264 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-03-18 17:33 - 00003386 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 14:39 - 2012-08-14 13:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 01:49 - 2013-09-01 01:47 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:56 - 2013-09-01 00:53 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:03 - 2013-09-01 00:02 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
Some content of TEMP:
====================
C:\Users\flatterratz\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-21 20:05
==================== End Of Log ============================
--- --- --- Danke und Gruß Dir So jetzte hat es geklappt, hatte einen Punkt zu viel im Dateinamen gemacht (schäm) Erst ma das Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-09-2013 02
Ran by flatterratz at 2013-10-01 21:51:40 Run:1
Running from C:\Users\flatterratz\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Program Files (x86)\LyricsSeeker
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
2013-09-01 19:24 - 2013-09-05 19:28 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-01 19:24 - 2013-09-05 19:28 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-01 19:24 - 2013-09-05 17:26 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-01 19:24 - 2013-09-05 17:26 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-01 19:24 - 2013-09-05 12:55 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
*****************
"C:\Program Files (x86)\LyricsSeeker" => File/Directory not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz => Moved successfully.
C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job => Moved successfully.
C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz => Moved successfully.
C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job => Moved successfully.
C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job => Moved successfully.
C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz => Moved successfully.
C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz => Moved successfully.
==== End of Fixlog ====
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by flatterratz (administrator) on FLATTERRATZ-HP on 01-10-2013 21:59:18
Running from C:\Users\flatterratz\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\windows\system32\atieclxx.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2013-01-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [489472 2013-01-10] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [7177728 2013-05-30] (Broadcom Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-10-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-06-18] (RealNetworks, Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] - C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-09-24] (APN)
HKU\Feuertanz\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\Feuertanz\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Feuertanz\...\Policies\system: [LogonHoursAction] 2
HKU\Feuertanz\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
SearchScopes: HKCU - Backup.Old.DefaultScope {E38EE736-8F53-4DE1-A867-0E35AD8808F8}
SearchScopes: HKCU - {59F87DB3-BE1B-451E-BC69-551AD34E41F2} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6EE5531F-DBDD-4EDF-8917-10B675B66191} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D2AD5932-5B7F-4E2E-9C75-FEC802354337} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {DEBC633C-67A2-4F44-9904-F868FE5B2B22} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\6hrh7lwx.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\6hrh7lwx.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\6hrh7lwx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [{0ce6ac61-48e9-426f-9268-6f1e8ece06da}] - C:\Program Files (x86)\LyricsSeeker\131.xpi
Chrome:
=======
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh\24.57772_0
CHR Extension: (Google Docs) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (RealDownloader) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\flatterratz\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.11.0.crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lgoiojnjnacbjngolldkokokgpcjbgjj] - C:\Program Files (x86)\LyricsSeeker\131.crx
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [164816 2013-09-24] (APN LLC.)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [280120 2010-10-01] (Hewlett-Packard Company)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE [48128 2013-05-30] (Broadcom Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [18456 2012-01-10] (HandSet Incorporated)
S3 massfilter_hs; C:\Windows\SysWow64\drivers\massfilter_hs.sys [9216 2010-10-20] (HandSet Incorporated)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)
S3 zghsdiag; C:\Windows\System32\DRIVERS\zghsdiag.sys [129304 2010-10-18] (ZTE Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-01 21:52 - 2013-10-01 21:52 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-10-01 21:31 - 2013-10-01 21:34 - 00031418 _____ C:\Users\flatterratz\Downloads\Addition.txt
2013-10-01 21:29 - 2013-10-01 21:29 - 00000000 ____D C:\FRST
2013-10-01 21:28 - 2013-10-01 21:28 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-10-01 20:56 - 2013-10-01 20:57 - 00448512 _____ (OldTimer Tools) C:\Users\flatterratz\Desktop\TFC.exe
2013-10-01 20:19 - 2013-10-01 20:19 - 00001107 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-01 20:19 - 2013-10-01 20:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-01 20:16 - 2013-10-01 20:18 - 00281896 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 24.0.exe
2013-10-01 20:16 - 2013-10-01 20:16 - 22537616 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_de24.0.exe
2013-10-01 20:10 - 2013-10-01 20:10 - 00002215 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-01 20:08 - 2013-10-01 20:08 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-01 19:53 - 2013-10-01 19:53 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-10-01 17:48 - 2013-10-01 17:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(2).exe
2013-10-01 01:19 - 2013-10-01 20:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-01 00:33 - 2013-10-01 13:17 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-30 20:56 - 2013-09-30 20:56 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup safety scan.txt
2013-09-30 19:34 - 2013-09-30 19:34 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck(1).exe
2013-09-30 19:31 - 2013-09-30 19:31 - 00000005 _____ C:\Users\flatterratz\AppData\Roaming\mbam.context.scan
2013-09-30 18:44 - 2013-09-30 18:44 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-30 18:44 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-30 18:37 - 2013-09-30 18:37 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-30 18:32 - 2013-09-30 18:32 - 00000000 ____D C:\ProgramData\APN
2013-09-30 18:31 - 2013-09-30 18:31 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-30 18:30 - 2013-10-01 13:17 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-30 18:30 - 2013-10-01 13:17 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-30 18:30 - 2013-10-01 13:17 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-30 18:30 - 2013-09-30 18:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(1).exe
2013-09-30 18:29 - 2013-09-30 18:29 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-30 18:16 - 2013-09-30 18:16 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(5).exe
2013-09-30 18:06 - 2013-09-30 18:06 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup.txt
2013-09-30 17:40 - 2013-09-30 17:40 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck.exe
2013-09-30 12:45 - 2013-09-30 12:45 - 02347384 _____ (ESET) C:\Users\flatterratz\Downloads\esetsmartinstaller_enu.exe
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:20 - 2013-09-29 17:33 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 12:04 - 2013-09-30 18:44 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:00 - 2013-09-29 12:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 21:17 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-27 21:17 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-27 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-27 21:17 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-27 21:11 - 2013-09-27 22:00 - 00000000 ____D C:\Qoobox
2013-09-27 21:10 - 2013-09-27 21:55 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:07 - 2013-09-27 21:08 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-22 14:41 - 2013-09-22 20:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-16 23:44 - 2013-09-17 01:42 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-12 01:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-12 01:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-12 01:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 20:15 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-11 20:15 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-11 20:15 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-11 20:15 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-11 20:15 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-11 20:15 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-05 14:01 - 2013-09-05 14:02 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 21:18 - 2013-09-03 14:20 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 01:47 - 2013-09-01 01:49 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:53 - 2013-09-01 00:56 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:30 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-01 00:02 - 2013-09-01 00:03 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
==================== One Month Modified Files and Folders =======
2013-10-01 21:53 - 2009-07-14 06:51 - 00245404 _____ C:\windows\setupact.log
2013-10-01 21:52 - 2013-10-01 21:52 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-10-01 21:48 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-10-01 21:34 - 2013-10-01 21:31 - 00031418 _____ C:\Users\flatterratz\Downloads\Addition.txt
2013-10-01 21:29 - 2013-10-01 21:29 - 00000000 ____D C:\FRST
2013-10-01 21:28 - 2013-10-01 21:28 - 01953880 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-10-01 21:26 - 2011-03-01 14:44 - 01078939 _____ C:\windows\WindowsUpdate.log
2013-10-01 20:57 - 2013-10-01 20:56 - 00448512 _____ (OldTimer Tools) C:\Users\flatterratz\Desktop\TFC.exe
2013-10-01 20:21 - 2012-08-17 15:47 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Mozilla
2013-10-01 20:19 - 2013-10-01 20:19 - 00001107 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-01 20:19 - 2013-10-01 20:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-01 20:19 - 2013-10-01 01:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-01 20:18 - 2013-10-01 20:16 - 00281896 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 24.0.exe
2013-10-01 20:16 - 2013-10-01 20:16 - 22537616 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_de24.0.exe
2013-10-01 20:10 - 2013-10-01 20:10 - 00002215 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-01 20:10 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-01 20:10 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-01 20:09 - 2011-10-09 22:15 - 00000000 ____D C:\Program Files (x86)\Google
2013-10-01 20:08 - 2013-10-01 20:08 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-01 20:07 - 2012-08-12 23:09 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Deployment
2013-10-01 20:06 - 2012-08-12 23:09 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Apps\2.0
2013-10-01 20:02 - 2010-12-09 00:59 - 00000000 ____D C:\ProgramData\PDFC
2013-10-01 20:00 - 2012-05-11 00:20 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-10-01 19:59 - 2011-07-17 05:06 - 01936028 _____ C:\windows\PFRO.log
2013-10-01 19:53 - 2013-10-01 19:53 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-10-01 17:48 - 2013-10-01 17:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(2).exe
2013-10-01 13:17 - 2013-10-01 00:33 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-10-01 13:17 - 2013-09-30 18:30 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-10-01 13:17 - 2013-09-30 18:30 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-10-01 13:17 - 2013-09-30 18:30 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-10-01 13:15 - 2012-08-05 22:54 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Mozilla
2013-09-30 20:56 - 2013-09-30 20:56 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup safety scan.txt
2013-09-30 19:34 - 2013-09-30 19:34 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck(1).exe
2013-09-30 19:31 - 2013-09-30 19:31 - 00000005 _____ C:\Users\flatterratz\AppData\Roaming\mbam.context.scan
2013-09-30 18:44 - 2013-09-30 18:44 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-30 18:44 - 2013-09-29 12:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-30 18:37 - 2013-09-30 18:37 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-30 18:33 - 2013-09-30 18:33 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-30 18:32 - 2013-09-30 18:32 - 00000000 ____D C:\ProgramData\APN
2013-09-30 18:31 - 2013-09-30 18:31 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-30 18:31 - 2013-09-30 18:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300(1).exe
2013-09-30 18:29 - 2013-09-30 18:29 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-30 18:29 - 2012-12-21 16:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-30 18:16 - 2013-09-30 18:16 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(5).exe
2013-09-30 18:06 - 2013-09-30 18:06 - 00000994 _____ C:\Users\flatterratz\Downloads\checkup.txt
2013-09-30 17:40 - 2013-09-30 17:40 - 00891144 _____ C:\Users\flatterratz\Downloads\SecurityCheck.exe
2013-09-30 12:48 - 2010-12-09 00:40 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-09-30 12:48 - 2010-12-09 00:40 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-09-30 12:48 - 2009-07-14 07:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-30 12:45 - 2013-09-30 12:45 - 02347384 _____ (ESET) C:\Users\flatterratz\Downloads\esetsmartinstaller_enu.exe
2013-09-29 18:04 - 2013-09-29 18:04 - 00004312 _____ C:\Users\flatterratz\Downloads\JRT.txt
2013-09-29 18:03 - 2013-09-29 18:03 - 00004312 _____ C:\Users\flatterratz\Desktop\JRT.txt
2013-09-29 17:46 - 2013-09-29 17:46 - 00000000 ____D C:\windows\ERUNT
2013-09-29 17:45 - 2013-09-29 17:45 - 01030305 _____ (Thisisu) C:\Users\flatterratz\Downloads\JRT.exe
2013-09-29 17:40 - 2013-09-29 17:40 - 00027485 _____ C:\Users\flatterratz\Downloads\AdwCleaner[S0].txt
2013-09-29 17:33 - 2013-09-29 17:20 - 00000000 ____D C:\AdwCleaner
2013-09-29 17:33 - 2012-08-17 15:47 - 00000000 ____D C:\ProgramData\ICQ
2013-09-29 17:33 - 2011-07-16 21:34 - 00001007 _____ C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-29 17:20 - 2013-09-29 17:20 - 01042066 _____ C:\Users\flatterratz\Downloads\adwcleaner.exe
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Malwarebytes
2013-09-29 12:04 - 2013-09-29 12:04 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-29 12:02 - 2013-09-29 12:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\flatterratz\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-28 23:15 - 2013-09-28 23:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(4).exe
2013-09-28 22:15 - 2013-09-28 22:15 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(3).exe
2013-09-28 22:14 - 2013-09-28 22:14 - 00088626 _____ C:\Users\flatterratz\Downloads\avira_registry_cleaner_de.zip
2013-09-27 22:00 - 2013-09-27 22:00 - 00024871 _____ C:\ComboFix.txt
2013-09-27 22:00 - 2013-09-27 21:11 - 00000000 ____D C:\Qoobox
2013-09-27 22:00 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-27 21:55 - 2013-09-27 21:10 - 00000000 ____D C:\windows\erdnt
2013-09-27 21:50 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-27 21:47 - 2009-07-14 04:34 - 74186752 _____ C:\windows\system32\config\SOFTWARE.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 17825792 _____ C:\windows\system32\config\SYSTEM.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00524288 _____ C:\windows\system32\config\DEFAULT.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SECURITY.bak
2013-09-27 21:47 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\SAM.bak
2013-09-27 21:08 - 2013-09-27 21:07 - 05129766 ____R (Swearware) C:\Users\flatterratz\Downloads\ComboFix.exe
2013-09-27 18:58 - 2013-09-27 18:58 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(2).exe
2013-09-27 18:15 - 2013-09-27 18:15 - 00004386 _____ C:\Users\flatterratz\Downloads\gmerlog.log2.log
2013-09-27 16:18 - 2013-09-27 16:18 - 335523437 _____ C:\windows\MEMORY.DMP
2013-09-27 16:18 - 2013-09-27 16:18 - 00454568 _____ C:\windows\Minidump\092713-28298-01.dmp
2013-09-27 16:18 - 2013-09-27 16:18 - 00000000 ____D C:\windows\Minidump
2013-09-27 16:06 - 2013-09-27 16:06 - 00006256 _____ C:\Users\flatterratz\Downloads\gmerlog.log
2013-09-27 15:11 - 2013-09-27 15:11 - 00377856 _____ C:\Users\flatterratz\Downloads\gmer_2.1.19163.exe
2013-09-27 15:01 - 2013-03-12 23:13 - 00000000 ____D C:\Users\flatterratz\Desktop\OpenOffice.org 3.4.1 (de) Installation Files
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:48 - 2011-07-16 21:29 - 00000000 ____D C:\Users\flatterratz
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-26 14:54 - 2011-07-24 21:31 - 00000000 ____D C:\Users\flatterratz\AppData\Local\CrashDumps
2013-09-26 13:42 - 2012-08-14 13:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-26 13:42 - 2012-08-14 13:46 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-26 13:42 - 2012-08-14 13:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-23 21:28 - 2012-11-24 20:44 - 00000000 ____D C:\Users\flatterratz\Documents\GTA Vice City User Files
2013-09-22 20:41 - 2013-09-22 14:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-17 01:42 - 2013-09-16 23:44 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:41 - 2009-07-14 06:45 - 04976408 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-12 01:41 - 2013-07-29 01:04 - 00000000 ____D C:\windows\system32\MRT
2013-09-12 01:35 - 2011-09-19 19:09 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-11 15:09 - 2012-07-28 21:35 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Adobe
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\ProgramData\Adobe
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-07 17:53 - 2013-06-22 15:26 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-05 23:32 - 2013-08-08 13:16 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleForflatterratz
2013-09-05 23:32 - 2013-08-08 13:16 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleForflatterratz.job
2013-09-05 14:02 - 2013-09-05 14:01 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-05 13:08 - 2013-01-10 16:37 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-09-05 13:07 - 2013-02-14 14:28 - 00000000 _____ C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-05 12:55 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-03 14:20 - 2013-09-01 21:18 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-04-04 15:01 - 00003264 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-03-18 17:33 - 00003386 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 14:39 - 2012-08-14 13:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 01:49 - 2013-09-01 01:47 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 00:56 - 2013-09-01 00:53 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:03 - 2013-09-01 00:02 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
Some content of TEMP:
====================
C:\Users\flatterratz\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-21 20:05
==================== End Of Log ============================
--- --- --- |
|
02.10.2013, 07:31
| #10 |
| /// the machine /// TB-Ausbilder | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Fertig Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.10.2013, 21:14
| #11 |
| | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter He Schrauber, ähm ja hab leider noch ein Problem gefunden. habe über den Windows Wartungscenter die bereits installierte Updates Liste aufgerufen und musste leider feststellen das mehrere wichtige Sicherheitsupdates fehlgeschlagen sind. Weisst Du vielleicht wie ich diese Updates nachträglich nochmal manuell runterladen kann? Danke und Gruß Dir |
|
03.10.2013, 07:51
| #12 |
| /// the machine /// TB-Ausbilder | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter In dem Du einfach auf Suchen und dann Installieren klickst. Schau auch mal im Reiter bisher installierte Updates ob bei Details ein Fehlercode steht.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.10.2013, 13:38
| #13 |
| | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Hallo Schrauber, sorry hab hier gerade eine extrem schlechte Leitung. Hab schon versucht einige kbs bei google zu suchen und bei microsoft upzudaten. Ging aber daneben. Entweder wegs Validierung oder weil sich das Notebook beim installieren wieder mal aufgehängt hat.(Prozessor ist nicht der Beste, kann aber auch an was anderem liegen) Es ist automatisches updaten eingestellt. Normalerweise macht er das nachts wenn ich ins Bett gehe. Dann lass ich laufen bis er fertig ist und er schaltet sich ja dann eh von alleine ab. Ein paar mal kam es aber vor das 8 Stunden später noch lief, weil er sich wie schon gesagt aufgehängt hatte und ich musste dann mit Brachialmethode abbrechen (Akku raus, weil nichts mehr anderes ging leider) Hier aber schonmal die KB´s und Fehler codes zuerst die sicherheitsupdates, danach keine Ahnung was das alles ist. Alles chronologisch. ----------------------------------------------------- Microsoft .NET Framework 3.5 SP1-Sicherheitsupdate für Windows 7 und Windows Server 2008 R2 für x64-basierte Systeme (KB979916) Installationsdatum: 29.08.2011 13:29 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 80004004 Updatetyp: Wichtig --------------------------------------------------------- Sicherheitsupdate für Microsoft .NET Framework 4 unter Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 für x64-basierte Systeme (KB2656405) Installationsdatum: 10.05.2012 01:18 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 643 Updatetyp: Wichtig ----------------------------------------------------- Kumulatives Sicherheitsupdate für Internet Explorer 9 für Windows 7 für x64-Systeme (KB2744842) Installationsdatum: 22.09.2012 16:38 Installationsstatus: Abgebrochen Fehlerdetails: Code 8024000B Updatetyp: Wichtig --------------------------------------------------- Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2770660) Installationsdatum: 21.12.2012 14:12 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 80004004 Updatetyp: Wichtig --------------------------------------------------------- Hotfix für Windows (KB947821) Installationsdatum: 03.10.2013 00:51 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 1 Updatetyp: Wichtig Fix for KB947821 ------------------------------------------------------------------ Update für Windows 7 für x64-basierte Systeme (KB2505438) Installationsdatum: 30.08.2011 22:56 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 80244018 Updatetyp: Empfohlen ----------------------------------------------------------- Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932) Installationsdatum: 31.08.2011 22:29 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 8E5E01FE Updatetyp: Wichtig -------------------------------------------------- Microsoft .NET Framework*3.5 SP1-Update für Windows*7 und Windows Server*2008 R2 für x64-basierte Systeme (KB982526) Installationsdatum: 31.08.2011 22:31 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 8E5E0442 Updatetyp: Wichtig ---------------------------------------------------- Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932) Installationsdatum: 01.09.2011 17:13 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 80010108 Updatetyp: Wichtig ----------------------------------------------------- Update für Windows 7 für x64-basierte Systeme (KB2505438) Installationsdatum: 01.09.2011 18:32 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 80004004 Updatetyp: Empfohlen -------------------------------------------------------- Windows Internet Explorer 9 für Windows 7 für x64-basierte Systeme Installationsdatum: 19.09.2011 19:32 Installationsstatus: Abgebrochen Fehlerdetails: Code 8024000B Updatetyp: Wichtig ----------------------------------------------------- Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932) Installationsdatum: 19.09.2011 19:32 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800706BE Updatetyp: Wichtig -------------------------------------------------------- Update für die Kompatibilitätsansichtsliste für Internet Explorer*8 für Windows 7 für x64-basierte Systeme (KB2598845) Installationsdatum: 26.10.2011 13:35 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 80004004 Updatetyp: Empfohlen ---------------------------------------------------------- ZTE Corporation - Other hardware - ZTE Handset USB Modem Installationsdatum: 11.06.2012 16:55 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800F020B Updatetyp: Empfohlen ------------------------------------------------------ Google, Inc - Other hardware - ZTE Composite ADB Interface Installationsdatum: 11.06.2012 16:55 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800F020B Updatetyp: Empfohlen -------------------------------------------------------- Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932) Installationsdatum: 05.08.2012 23:34 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 80240020 Updatetyp: Wichtig ----------------------------------------------------------- ZTE Corporation - Other hardware - ZTE Handset USB Modem Installationsdatum: 24.08.2012 21:39 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800F020B Updatetyp: Empfohlen ----------------------------------------------------------------- Google, Inc - Other hardware - ZTE Composite ADB Interface Installationsdatum: 24.08.2012 21:39 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800F020B Updatetyp: Empfohlen ---------------------------------------------------------- Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932) Installationsdatum: 22.09.2012 16:38 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800706BE Updatetyp: Wichtig ---------------------------------------------------------- ZTE Corporation - Other hardware - ZTE Handset USB Modem Installationsdatum: 06.12.2012 03:01 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800F020B Updatetyp: Empfohlen ------------------------------------------------------------ Google, Inc - Other hardware - ZTE Composite ADB Interface Installationsdatum: 06.12.2012 03:01 Installationsstatus: Fehlgeschlagen Fehlerdetails: Code 800F020B Updatetyp: Empfohlen --------------------------------------------------------- |
|
05.10.2013, 19:36
| #14 |
| /// the machine /// TB-Ausbilder | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Systemupdate-Vorbereitungstool behebt Windows Update-Fehler in Windows*7, Windows Vista, Windows Server 2008*R2 und Windows Server 2008 Installier das mal und versuch die Updates nochmal.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.10.2013, 20:32
| #15 |
| | Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter He Schrauber, leider installiert er den Hotfix nicht.  Wie viele Stunden dauert das denn normalerweise? Ist das normal oder bin ich einfach nur zu ungeduldig? wie immer Hundert Millionen Danke Dirs! Gruß Edit: Nach geschlagenen 9 1/2 Stunden hat er es doch geschafft, den Hotfix zu installieren. Leider funzen die entsprechenden Updates von der microsoft support com Seite trotzdem nicht. Es kommen permanent neue Fehlercodes und ähnliches. Die manuelle Suche ist zum Haare raufen.  Gibt es einen einfacheren Weg? Gibt es ein Programm bei Windows das fehlgeschlagene Windows updates automatisch sucht und dann repariert oder nochmal runter lädt? |
|
| Themen zu Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter |
| antivir, antivirus, avira, avira searchfree toolbar, browser, desktop, farbar, farbar recovery scan tool, flash player, google, helper, hijack.startpage, homepage, iexplore.exe, installation, malware, newtab, origin, plug-in, rundll, schutz, search the web, services.exe, suchmaschine, svchost.exe, system, temp, trojan.zbot, vice city, viren, virus |
Linear-Darstellung
