| |
| |||||||
Log-Analyse und Auswertung: Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.09.2013, 19:37
| #1 |
 |  Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter Hallo alle miteinander, Bin gerade mehr als ratlos, deshalb hier erst mal die Problembeschreibung: Bis jetzt habe ich zwei verschieden Antisoftwares ausprobiert. Einmal die Bezahlversion von Norton und Avira free. Vor etwa einem halben Jahr war dann eine sehr gemeine Malware auf dem PC, die permanent >20 Seiten geöffnet hat bei jedem dritten Klick. Norton hat den Virus nicht gefunden, deshalb Norton rausgeschmissen und Avira drauf. Avira hat den Virus gleich erkannt und in Quarantäne gesetzt. Seitdem habe ich nur noch die kostenlose Aviraversion drauf. Diese hat im letzten Jahr ebenfalls nur zwei drei Viren erkannt. Die erkannten Viren befanden sich aber schon seit mindestens 2 Jahren auf dem Rechner!!! Waren setup Dateien u.a. von Mozillafirefox. Jetztige Probleme: Habe ständig neue Suchmaschinen ohne irgendetwas neu installiert zu haben, Mozilla Firefox geht auf und zu, der ganze PC fährt ebenso von Geisterhand herunter und ich werde andauernd ausgeloggt. Der Windowswartungscenter behauptet desöfteren, Avira sei nicht aktiv, während Avira selbst aber das Gegenteil behauptet und mit wird der Zugriff zum aktivieren und deaktivieren verweigert. Nach dem ich unten stehende Logfiles gemacht habe, musste ich den Virenschutz zweimalig, de und neuinstallieren um hier zumindest ansatzweise geschützt schreiben zu können, da alle Neustarts um Avira wieder in Gang zu bringen zwecklos waren. Deshalb sind leider keine der Funde dort mehr da. Hoffe es ist okay die Logs per Kopierfunktion einzufügen, habe zur besseren Übersicht rote Trennlinien eingefügt. Vielen, vielen, vielen unendlich lieben Dank im Vorraus Gruß Britta ----------------------------------------------------------------- defogger_disable by jpshortstuff (23.02.10.1) Log created at 14:48 on 27/09/2013 (flatterratz) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- ----------------------------------------------------------------- FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by flatterratz (administrator) on FLATTERRATZ-HP on 27-09-2013 15:04:51
Running from C:\Users\flatterratz\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\windows\system32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\windows\system32\atibtmon.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe
(Wsys Co., Ltd.) C:\ProgramData\eSafe\eGdpSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Microsoft Corporation) C:\windows\system32\LogonUI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\windows\system32\SnippingTool.exe
(Microsoft Corporation) C:\windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corporation) C:\windows\system32\taskmgr.exe
(Farbar) C:\Users\flatterratz\Downloads\FRST64(2).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2174760 2013-01-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [489472 2013-01-10] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [7177728 2013-05-30] (Broadcom Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKCU\...\Run: [FDPRO-516] - C:\Program Files (x86)\Fighters\FighterLauncher.exe FDPRO
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {09716e91-fe90-11e1-a7e6-cc52af0dd39b} - E:\AutoRun.exe
MountPoints2: {a7c6750a-d9b3-11e1-93d9-64315086516c} - D:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {acefb5c9-d0ba-11e0-94e5-cc52af0dd39b} - D:\setup_vmc_lite.exe /checkApplicationPresence
MountPoints2: {bc680915-d80b-11e1-85d5-64315086516c} - D:\AutoRun.exe
MountPoints2: {bc680921-d80b-11e1-85d5-64315086516c} - D:\AutoRun.exe
MountPoints2: {bc68092d-d80b-11e1-85d5-64315086516c} - E:\AutoRun.exe
MountPoints2: {d9de7587-fff9-11e1-93d7-cc52af0dd39b} - D:\AutoRun.exe
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Guard.Mail.ru.gui] - C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-08-17] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-10-01] (Hewlett-Packard Company)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-06-18] (RealNetworks, Inc.)
HKLM-x32\...\Run: [CanonQuickMenu] - C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1279120 2012-09-27] (CANON INC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKU\Feuertanz\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-02-22] (Hewlett-Packard Company)
HKU\Feuertanz\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\Feuertanz\...\Policies\system: [LogonHoursAction] 2
HKU\Feuertanz\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs-x32: c:\progra~3\browse~1\25911~1.18\{c16c1~1\mngr.dll [ ] ()
Startup: C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
ProxyEnable: Internet Explorer proxy is enabled.
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKCU\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = hxxp://de.msn.com/?ocid=EIE9HP&PC=UP50
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034489
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM-x32 - Backup.Old.DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKLM-x32 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKCU - Backup.Old.DefaultScope {E38EE736-8F53-4DE1-A867-0E35AD8808F8}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=117223&tt=4712_2&babsrc=SP_ss&mntrId=88bae139000000000000cc52af0dd39b
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1378034491
SearchScopes: HKCU - {59F87DB3-BE1B-451E-BC69-551AD34E41F2} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {6B916290-38B3-4EBC-A858-7E71C3D049B9} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=3c6b90ac-5880-4494-964e-5b3a2666bf24&apn_sauid=3167E310-0F01-425A-BB32-2A23188E187B
SearchScopes: HKCU - {6EE5531F-DBDD-4EDF-8917-10B675B66191} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://int.search-results.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=360&chn=retail&geo=DE&ver=6
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb185/?search={searchTerms}&loc=IB_DS&a=6R8LRgUnVD&i=26
SearchScopes: HKCU - {D2AD5932-5B7F-4E2E-9C75-FEC802354337} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {DEBC633C-67A2-4F44-9904-F868FE5B2B22} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {E38EE736-8F53-4DE1-A867-0E35AD8808F8} URL = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ddrnw&chnl=ddrnw&cd=2XzuyEtN2Y1L1Qzu0C0CyDtB0A0FtD0D0DtAzy0B0EtCtAzytN0D0Tzu0CtBtBtCtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1745046667
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\PROGRA~2\Funmoods\1.5.23.22\bh\escort.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Funmoods Toolbar - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\PROGRA~2\Funmoods\1.5.23.22\escorTlbr.dll No File
Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default
FF user.js: detected! => C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\user.js
FF NewTab: hxxp://www.delta-homes.com/newtab/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=nt&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380232706
FF DefaultSearchEngine: Search the web (Babylon)
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Search the web (Babylon)
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @real.com/nppl3260;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.2 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.2.32 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\mngr.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\my-web-search.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\safesearch.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\delta-homes.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\data
FF Extension: check4change-owner - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\check4change-owner@mozdev.org.xpi
FF Extension: firebug - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: helperframework - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\helperframework@zonemedia.com.xpi
FF Extension: toolbar - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\toolbar@web.de.xpi
FF Extension: toolbar_AVIRA-V7 - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\flatterratz\AppData\Roaming\Mozilla\Firefox\Profiles\tofyfz9f.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM-x32\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF HKCU\...\Firefox\Extensions: [{0ce6ac61-48e9-426f-9268-6f1e8ece06da}] - C:\Program Files (x86)\LyricsSeeker\131.xpi
FF Extension: No Name - C:\Program Files (x86)\LyricsSeeker\131.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380236274
Chrome:
=======
CHR Extension: (Avira Toolbar) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.19.38091_0
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh\20.53263_0
CHR Extension: (Google Drive) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Funmoods) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh\2.1.3_0
CHR Extension: (YouTube) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Facebook) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm\1.0.3_0
CHR Extension: (Newtab) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj\7.0.18.1_0
CHR Extension: (Google Search) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Facebook Disconnect) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpepffjfmamnambagiibghpglaidiec\1.3.0_0
CHR Extension: (RealDownloader) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0
CHR Extension: (New tab for Chrome\u2122) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0
CHR Extension: (Lyrics Seeker) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgoiojnjnacbjngolldkokokgpcjbgjj\1.131_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\FLATTE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\FLATTE~1\AppData\Local\funmoods.crx
CHR HKLM\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\FLATTE~1\AppData\Local\funmoods-speeddial.crx
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaabfjnbeinlpljodiajipidiompfl] - C:\Users\flatterratz\AppData\Local\APN\GoogleCRXs\aaaaabfjnbeinlpljodiajipidiompfl_7.15.11.0.crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\FLATTE~1\AppData\Local\funmoods.crx
CHR HKLM-x32\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\FLATTE~1\AppData\Local\funmoods-speeddial.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\flatterratz\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
CHR HKLM-x32\...\Chrome\Extension: [jifflliplgeajjdhmkcfnngfpgbjonjg] - C:\Program Files (x86)\Perion\NewTab\newTab.crx
CHR HKLM-x32\...\Chrome\Extension: [lgoiojnjnacbjngolldkokokgpcjbgjj] - C:\Program Files (x86)\LyricsSeeker\131.crx
CHR HKLM-x32\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files (x86)\Perion\ChromeInfoBar\ChromeInfoBar.crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=TOSHIBAXMK2565GSX_X0SCP14ETXXX0SCP14ET&ts=1380236274
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Guard.Mail.ru; C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe [1564368 2012-08-17] ()
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [280120 2010-10-01] (Hewlett-Packard Company)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE [48128 2013-05-30] (Broadcom Corporation)
R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [303680 2013-09-01] (Wsys Co., Ltd.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [18456 2012-01-10] (HandSet Incorporated)
S3 massfilter_hs; C:\Windows\SysWow64\drivers\massfilter_hs.sys [9216 2010-10-20] (HandSet Incorporated)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [96384 2010-05-21] (Realtek Semiconductor Corp.)
S3 zghsdiag; C:\Windows\System32\DRIVERS\zghsdiag.sys [129304 2010-10-18] (ZTE Incorporated)
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-27 15:04 - 2013-09-27 15:04 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(2).exe
2013-09-27 14:50 - 2013-09-27 14:50 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(1).exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-22 14:41 - 2013-09-22 20:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-16 23:44 - 2013-09-17 01:42 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-13 14:27 - 2013-09-13 14:27 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-12 01:41 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-12 01:41 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-12 01:41 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-12 01:41 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-12 01:41 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-12 01:41 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-12 01:41 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-12 01:41 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-12 01:41 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 20:15 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-11 20:15 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-11 20:15 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-11 20:15 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-11 20:15 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-11 20:15 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-11 20:15 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-11 20:15 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-11 20:15 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-11 20:15 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-11 20:15 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-11 20:15 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-11 20:15 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 20:15 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-11 20:15 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-11 20:15 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:23 - 2013-09-05 14:23 - 01947160 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-05 14:01 - 2013-09-05 14:02 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 21:18 - 2013-09-03 14:20 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-05 19:28 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-01 19:24 - 2013-09-05 19:28 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-01 19:24 - 2013-09-05 17:26 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-01 19:24 - 2013-09-05 17:26 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-01 19:24 - 2013-09-05 12:55 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:58 - 2013-09-26 23:58 - 00001427 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-01 14:58 - 2013-09-06 11:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 13:22 - 2013-09-27 14:08 - 00000000 ____D C:\ProgramData\eSafe
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 13:21 - 2013-09-05 14:28 - 00000000 ____D C:\Program Files (x86)\LyricsSeeker
2013-09-01 13:21 - 2013-09-05 13:11 - 00000400 _____ C:\windows\Tasks\Lyrics Seeker Update.job
2013-09-01 13:21 - 2013-09-01 13:21 - 00003060 _____ C:\windows\System32\Tasks\Lyrics Seeker Update
2013-09-01 01:47 - 2013-09-01 01:49 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 01:11 - 2013-09-01 01:11 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-09-01 01:04 - 2013-09-01 01:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-01 01:01 - 2013-09-04 14:35 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-01 01:00 - 2013-09-01 01:00 - 00000000 ____D C:\ProgramData\APN
2013-09-01 00:58 - 2013-09-01 00:58 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-01 00:57 - 2013-09-04 14:35 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-01 00:57 - 2013-09-04 14:35 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-01 00:57 - 2013-09-01 00:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-01 00:57 - 2013-03-06 16:13 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-09-01 00:53 - 2013-09-01 00:56 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:30 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-01 00:02 - 2013-09-01 00:03 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
==================== One Month Modified Files and Folders =======
2013-09-27 15:04 - 2013-09-27 15:04 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(2).exe
2013-09-27 15:01 - 2013-03-12 23:13 - 00000000 ____D C:\Users\flatterratz\Desktop\OpenOffice.org 3.4.1 (de) Installation Files
2013-09-27 14:50 - 2013-09-27 14:50 - 01953854 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64(1).exe
2013-09-27 14:48 - 2013-09-27 14:48 - 00000484 _____ C:\Users\flatterratz\Downloads\defogger_disable.log
2013-09-27 14:48 - 2013-09-27 14:48 - 00000000 _____ C:\Users\flatterratz\defogger_reenable
2013-09-27 14:48 - 2011-07-16 21:29 - 00000000 ____D C:\Users\flatterratz
2013-09-27 14:47 - 2013-09-27 14:47 - 00050477 _____ C:\Users\flatterratz\Downloads\Defogger.exe
2013-09-27 14:16 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-27 14:16 - 2009-07-14 06:45 - 00019856 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-27 14:12 - 2011-03-01 14:44 - 01932180 _____ C:\windows\WindowsUpdate.log
2013-09-27 14:08 - 2013-09-01 13:22 - 00000000 ____D C:\ProgramData\eSafe
2013-09-27 14:05 - 2010-12-09 00:59 - 00000000 ____D C:\ProgramData\PDFC
2013-09-27 14:05 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2013-09-27 14:04 - 2012-05-11 00:20 - 00065536 _____ C:\windows\system32\Ikeext.etl
2013-09-27 14:03 - 2009-07-14 06:51 - 00243052 _____ C:\windows\setupact.log
2013-09-26 23:58 - 2013-09-01 14:58 - 00001427 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-26 14:54 - 2011-07-24 21:31 - 00000000 ____D C:\Users\flatterratz\AppData\Local\CrashDumps
2013-09-26 13:42 - 2012-08-14 13:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-26 13:42 - 2012-08-14 13:46 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-26 13:42 - 2012-08-14 13:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-23 21:28 - 2012-11-24 20:44 - 00000000 ____D C:\Users\flatterratz\Documents\GTA Vice City User Files
2013-09-22 20:41 - 2013-09-22 14:41 - 98597466 _____ C:\windows\SysWOW64\峦�A
2013-09-21 02:07 - 2013-01-10 22:01 - 00002437 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-20 20:43 - 2013-09-20 20:43 - 98487876 _____ C:\windows\SysWOW64\ꗒﲓ¯
2013-09-17 01:42 - 2013-09-16 23:44 - 97872530 _____ C:\windows\SysWOW64\⨭š
2013-09-13 23:07 - 2010-12-09 00:40 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-09-13 23:07 - 2010-12-09 00:40 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-09-13 23:07 - 2009-07-14 07:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-13 14:27 - 2013-09-13 14:27 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 11:44 - 2011-07-16 21:34 - 00000000 ___RD C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:41 - 2009-07-14 06:45 - 04976408 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-12 01:41 - 2013-07-29 01:04 - 00000000 ____D C:\windows\system32\MRT
2013-09-12 01:35 - 2011-09-19 19:09 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-11 15:13 - 2011-07-17 05:06 - 01926452 _____ C:\windows\PFRO.log
2013-09-11 15:09 - 2012-07-28 21:35 - 00000000 ____D C:\Users\flatterratz\AppData\Local\Adobe
2013-09-11 15:07 - 2013-09-11 15:07 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\ProgramData\Adobe
2013-09-11 15:06 - 2011-07-24 20:33 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-11 14:46 - 2013-09-11 14:46 - 97124766 _____ C:\windows\SysWOW64\ط똟u
2013-09-07 21:34 - 2013-09-07 21:34 - 96533415 _____ C:\windows\SysWOW64\⮸c
2013-09-07 17:53 - 2013-06-22 15:26 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-09-06 11:09 - 2013-09-01 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-06 01:27 - 2013-01-10 21:56 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-05 23:32 - 2013-08-08 13:16 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleForflatterratz
2013-09-05 23:32 - 2013-08-08 13:16 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleForflatterratz.job
2013-09-05 19:28 - 2013-09-01 19:24 - 00003004 _____ C:\windows\System32\Tasks\ReclaimerUpdateXML_flatterratz
2013-09-05 19:28 - 2013-09-01 19:24 - 00000390 _____ C:\windows\Tasks\ReclaimerUpdateXML_flatterratz.job
2013-09-05 17:26 - 2013-09-01 19:24 - 00003008 _____ C:\windows\System32\Tasks\ReclaimerUpdateFiles_flatterratz
2013-09-05 17:26 - 2013-09-01 19:24 - 00000394 _____ C:\windows\Tasks\ReclaimerUpdateFiles_flatterratz.job
2013-09-05 14:28 - 2013-09-01 13:21 - 00000000 ____D C:\Program Files (x86)\LyricsSeeker
2013-09-05 14:24 - 2013-09-05 14:24 - 00000000 ____D C:\FRST
2013-09-05 14:23 - 2013-09-05 14:23 - 01947160 _____ (Farbar) C:\Users\flatterratz\Downloads\FRST64.exe
2013-09-05 14:03 - 2013-08-17 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-05 14:02 - 2013-09-05 14:01 - 22240760 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup_23.0.1.exe
2013-09-05 13:51 - 2013-09-05 13:51 - 01110476 _____ C:\Users\flatterratz\Downloads\7z920(1).exe
2013-09-05 13:27 - 2013-01-10 21:56 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-05 13:11 - 2013-09-01 13:21 - 00000400 _____ C:\windows\Tasks\Lyrics Seeker Update.job
2013-09-05 13:08 - 2013-01-10 16:37 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-09-05 13:07 - 2013-02-14 14:28 - 00000000 _____ C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-05 12:55 - 2013-09-01 19:24 - 00000400 _____ C:\windows\Tasks\RNUpgradeHelperLogonPrompt_flatterratz.job
2013-09-05 12:55 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-04 14:35 - 2013-09-01 01:01 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-09-04 14:35 - 2013-09-01 00:57 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-09-04 14:35 - 2013-09-01 00:57 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-09-03 14:20 - 2013-09-03 14:20 - 00003364 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-03 14:20 - 2013-09-01 21:18 - 00003242 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-04-04 15:01 - 00003264 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-02 00:01 - 2013-03-18 17:33 - 00003386 _____ C:\windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2407356875-34449621-2769195153-1000
2013-09-01 19:24 - 2013-09-01 19:24 - 00003648 _____ C:\windows\System32\Tasks\RNUpgradeHelperResumePrompt_flatterratz
2013-09-01 19:24 - 2013-09-01 19:24 - 00002712 _____ C:\windows\System32\Tasks\RNUpgradeHelperLogonPrompt_flatterratz
2013-09-01 16:08 - 2013-09-01 16:08 - 01069944 _____ (Solid State Networks) C:\Users\flatterratz\Downloads\install_reader11_de_mssd_aaa_aih.exe
2013-09-01 14:55 - 2013-09-01 14:55 - 00282008 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox Setup Stub 23.0.1.exe
2013-09-01 14:54 - 2012-12-18 00:46 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-09-01 14:39 - 2012-08-14 13:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-01 13:22 - 2013-09-01 13:22 - 22404568 _____ (Mozilla) C:\Users\flatterratz\Downloads\Firefox_Setup [1].exe
2013-09-01 13:21 - 2013-09-01 13:21 - 00003060 _____ C:\windows\System32\Tasks\Lyrics Seeker Update
2013-09-01 13:21 - 2011-07-16 21:34 - 00001727 _____ C:\Users\flatterratz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-01 01:49 - 2013-09-01 01:47 - 22595960 _____ (Mozilla) C:\Users\flatterratz\Downloads\WEB.DE_Firefox_Setup.exe
2013-09-01 01:11 - 2013-09-01 01:11 - 00000000 ____D C:\Users\flatterratz\AppData\Local\AskPartnerNetwork
2013-09-01 01:04 - 2013-09-01 01:04 - 00000000 ____D C:\Users\flatterratz\AppData\Roaming\Avira
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-09-01 01:01 - 2013-09-01 01:01 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-09-01 01:00 - 2013-09-01 01:00 - 00000000 ____D C:\ProgramData\APN
2013-09-01 00:58 - 2013-09-01 00:58 - 00002026 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-09-01 00:57 - 2013-09-01 00:57 - 00000000 ____D C:\Program Files (x86)\Avira
2013-09-01 00:57 - 2012-12-21 16:14 - 00000000 ____D C:\ProgramData\Avira
2013-09-01 00:56 - 2013-09-01 00:53 - 110344048 _____ C:\Users\flatterratz\Downloads\avira_free4045_antivirus_de.exe
2013-09-01 00:52 - 2013-09-01 00:52 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus(1).exe
2013-09-01 00:03 - 2013-09-01 00:02 - 02092792 _____ C:\Users\flatterratz\Downloads\avira_free_antivirus.exe
Some content of TEMP:
====================
C:\Users\flatterratz\AppData\Local\Temp\1acmxyo3.dll
C:\Users\flatterratz\AppData\Local\Temp\APNStub.exe
C:\Users\flatterratz\AppData\Local\Temp\AskSLib.dll
C:\Users\flatterratz\AppData\Local\Temp\drm_dialogs.dll
C:\Users\flatterratz\AppData\Local\Temp\Extract.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\flatterratz\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\flatterratz\AppData\Local\Temp\MSETUP4.EXE
C:\Users\flatterratz\AppData\Local\Temp\NEWEBDB.tmp.exe
C:\Users\flatterratz\AppData\Local\Temp\setup.exe
C:\Users\flatterratz\AppData\Local\Temp\SIntf16.dll
C:\Users\flatterratz\AppData\Local\Temp\SIntf32.dll
C:\Users\flatterratz\AppData\Local\Temp\SIntfNT.dll
C:\Users\flatterratz\AppData\Local\Temp\SP57760.exe
C:\Users\flatterratz\AppData\Local\Temp\sp58915.exe
C:\Users\flatterratz\AppData\Local\Temp\SP60504.exe
C:\Users\flatterratz\AppData\Local\Temp\stubhelper.dll
C:\Users\flatterratz\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\flatterratz\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\flatterratz\AppData\Local\Temp\WEB.DE_Toolbar_IE_Setup.exe
C:\Users\flatterratz\AppData\Local\Temp\WEB.DE_Toolbar_IE_Special.exe
C:\Users\flatterratz\AppData\Local\Temp\webde_onlinespeicher_setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-21 20:05
==================== End Of Log ============================
----------------------------------------------------------------- GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-27 18:15:42
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK2565GSX rev.GJ002C 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\FLATTE~1\AppData\Local\Temp\awddrpow.sys
---- User code sections - GMER 2.1 ----
.text C:\ProgramData\eSafe\eGdpSvc.exe[1444] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\ProgramData\eSafe\eGdpSvc.exe[1444] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[476] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[476] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3468] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3468] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3536] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\Guard-ICQ\GuardICQ.exe[3536] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3908] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3908] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
.text C:\windows\SysWOW64\RunDll32.exe[3264] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779b1465 2 bytes [9B, 77]
.text C:\windows\SysWOW64\RunDll32.exe[3264] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779b14bb 2 bytes [9B, 77]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af188330
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af188330@0019631311f5 0x47 0x98 0xC9 0xB5 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af188330@c864c7a9eaf7 0xFE 0xBD 0x3B 0x6C ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af188330 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af188330@0019631311f5 0x47 0x98 0xC9 0xB5 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af188330@c864c7a9eaf7 0xFE 0xBD 0x3B 0x6C ...
---- EOF - GMER 2.1 ----
|
| Themen zu Virenschutz erkennt Viren nicht, Browser spinnen, PC fährt einfach runter |
| antivir, antivirus, avira, avira searchfree toolbar, browser, desktop, farbar, farbar recovery scan tool, flash player, google, helper, hijack.startpage, homepage, iexplore.exe, installation, malware, newtab, origin, plug-in, rundll, schutz, search the web, services.exe, suchmaschine, svchost.exe, system, temp, trojan.zbot, vice city, viren, virus |
Baum-Darstellung