Windows Vista - Interpol Trojaner mit Sperrschirm

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.21.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Andreas :: ANDREAS-PC [Administrator]

Schutz: Aktiviert

21.10.2013 19:01:44
mbam-log-2013-10-21 (19-01-44).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 207587
Laufzeit: 7 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 56
C:\ProgramData\Systweak\Advanced System Protector (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Systweak\Advanced System Protector\2.1.1000.12150 (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Systweak\Advanced System Protector\signatures (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Systweak\Advanced System Protector\updates (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Roaming\Systweak\Advanced System Protector (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Roaming\Systweak\Advanced System Protector\2.1.1000.12150 (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Roaming\Systweak\Advanced System Protector\Backup (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Roaming\Systweak\Advanced System Protector\Logs (PUP.Optional.AdvancedSystemProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1 (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\content (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\content\lib (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\content\modules (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\content\widgets (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\content\widgets\com.djboxservice.dj.DJBox (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\content\widgets\com.djboxservice.dj.DJBox\thumbs (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\content\widgets\net.vmn.www.RadioBeta (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\data (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\data\search (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\data\weather (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\panels (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\panels\css (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\panels\default (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\panels\default\css (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\panels\default\images (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\panels\default\scripts (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\panels\images (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\debugbar (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\uwa (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\weatherbutton (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\icons (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\lib\weatherbutton\panels\images (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\searchbar (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\Music Toolbar\Datamngr\SRTOOL~1\IE\chrome\skin\options (PUP.Optional.MusicBoxToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Roaming\Systweak\RegClean Pro (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Roaming\Systweak\RegClean Pro\Version 6.1 (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BonanzaDealsLive (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BonanzaDealsLive\Update (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\BonanzaDealsLive\Update\Log (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Local\BonanzaDealsLive (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Local\BonanzaDealsLive\CrashReports (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0 (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj\3.5.0.0_0\images (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BonanzaDealsLive (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BonanzaDealsLive\CrashReports (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BonanzaDealsLive\Update (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BonanzaDealsLive\Update\Download (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BonanzaDealsLive\Update\Install (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BonanzaDealsLive\Update\Offline (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files\BonanzaDealsLive\Update\Offline\{0D4E000F-CA47-4A91-8B1A-8E4EC2EEA3A2} (PUP.Optional.BonanzaDeals.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

# AdwCleaner v3.010 - Bericht erstellt am 21/10/2013 um 19:39:49
# Updated 20/10/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# Benutzername : Andreas - ANDREAS-PC
# Gestartet von : C:\Users\Andreas\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\Systweak
Ordner Gelöscht : C:\ProgramData\torchcrashhandler
Ordner Gelöscht : C:\Program Files\Advanced System Protector
Ordner Gelöscht : C:\Program Files\BonanzaDeals
Ordner Gelöscht : C:\Program Files\iMesh Applications
Ordner Gelöscht : C:\Program Files\jZip
Ordner Gelöscht : C:\Program Files\Music Toolbar
Ordner Gelöscht : C:\Program Files\MyPC Backup 
Ordner Gelöscht : C:\Program Files\RegClean Pro
Ordner Gelöscht : C:\Program Files\Whilokii
Ordner Gelöscht : C:\Users\Andreas\AppData\Local\jZip
Ordner Gelöscht : C:\Users\Andreas\AppData\Local\torch
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16514


*************************

AdwCleaner[R0].txt - [1923 octets] - [21/10/2013 19:38:14]
AdwCleaner[S0].txt - [1832 octets] - [21/10/2013 19:39:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1892 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows Vista (TM) Home Basic x86
Ran by Andreas on 21.10.2013 at 20:07:33,17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Andreas\appdata\locallow\datamngr"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.10.2013 at 20:12:13,67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-10-2013
Ran by Andreas (administrator) on ANDREAS-PC on 21-10-2013 20:21:18
Running from C:\Users\Andreas\Downloads
Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
(McAfee, Inc.) C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
(McAfee, Inc.) C:\Program Files\McAfee\MPF\MPFSrv.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSK\MskSrver.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
(Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
(McAfee, Inc.) c:\PROGRA~1\mcafee.com\agent\mcagent.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(McAfee, Inc.) C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
(McAfee, Inc.) c:\PROGRA~1\mcafee\msc\mcuimgr.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [NDSTray.exe] - NDSTray.exe
HKLM\...\Run: [mcagent_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [582992 2007-08-03] (McAfee, Inc.)
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-08-08] (Google)
HKLM\...\Run: [Google EULA Launcher] - c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe [20480 2008-05-28] ( )
HKLM\...\Run: [Toshiba TEMPO] - C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe [103824 2008-04-24] (Toshiba Europe GmbH)
HKLM\...\Run: [topi] - C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [581632 2007-07-10] (TOSHIBA)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [6037504 2008-04-08] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [431456 2008-01-17] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509816 2008-06-24] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [716800 2008-05-09] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe [574864 2008-01-11] (Toshiba)
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [40368 2011-08-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-03-29] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKCU\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKCU\...\Run: [Update Service] - C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe [19456 2009-08-09] (Teknum Systems AS)
HKCU\...\Run: [Treepack] - C:\Users\Andreas\AppData\Roaming\Servpack\atladv.exe [1 2011-06-19] ()
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-04-24] (TOSHIBA)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [TOSCDSPD] - C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-04-24] (TOSHIBA)
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll [ 2010-08-08] (Google)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: McAfee Phishing Filter - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll ()
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll (McAfee, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} https://webmail.kendle.com/iNotes6W.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 195.234.128.7 195.234.128.16

========================== Services (Whitelisted) =================

R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2008-04-17] (TOSHIBA CORPORATION)
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-08-08] (Google)
S3 jswpsapi; C:\Program Files\Jumpstart\jswpsapi.exe [954368 2008-04-16] (Atheros Communications, Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 mcmscsvc; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [767976 2008-01-09] (McAfee, Inc.)
R2 McNASvc; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2458128 2008-01-25] (McAfee, Inc.)
S3 McODS; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [378184 2007-11-07] (McAfee, Inc.)
R2 McProxy; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [359248 2007-08-15] (McAfee, Inc.)
R2 McShield; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [144704 2007-07-24] (McAfee, Inc.)
R3 McSysmon; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [695624 2007-12-05] (McAfee, Inc.)
R2 MpfService; C:\Program Files\McAfee\MPF\MPFSrv.exe [856864 2007-07-18] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\McAfee\MSK\MskSrver.exe [23880 2007-11-26] (McAfee, Inc.)
R2 TempoMonitoringService; C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [99720 2008-04-24] (Toshiba Europe GmbH)
R2 TOSHIBA SMART Log Service; C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [126976 2008-02-06] (TOSHIBA Corporation)
R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.)

==================== Drivers (Whitelisted) ====================

R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [79304 2007-11-22] (McAfee, Inc.)
R3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [35240 2007-11-22] (McAfee, Inc.)
R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [201320 2007-11-22] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [33832 2007-11-22] (McAfee, Inc.)
R3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [40488 2007-12-02] (McAfee, Inc.)
R1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [125728 2007-07-13] (McAfee, Inc.)
S3 USB_RNDIS; C:\Windows\System32\DRIVERS\usb8023.sys [15872 2013-02-12] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Andreas\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-21 20:12 - 2013-10-21 20:12 - 00000713 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-10-21 20:07 - 2013-10-21 20:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-21 20:05 - 2013-10-21 20:04 - 01033335 _____ (Thisisu) C:\Users\Andreas\Desktop\JRT.exe
2013-10-21 19:38 - 2013-10-21 19:40 - 00000000 ____D C:\AdwCleaner
2013-10-21 19:36 - 2013-10-21 19:35 - 01060070 _____ C:\Users\Andreas\Desktop\adwcleaner.exe
2013-10-21 18:22 - 2013-10-21 18:22 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000911 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-21 18:21 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-21 03:12 - 2013-09-22 12:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-21 03:12 - 2013-09-22 12:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-21 03:12 - 2013-09-22 12:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-21 03:12 - 2013-09-22 12:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-21 03:12 - 2013-09-22 12:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-21 03:12 - 2013-09-22 12:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-21 03:12 - 2013-09-22 12:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-21 03:12 - 2013-09-22 12:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-21 03:12 - 2013-09-22 12:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-21 03:12 - 2013-09-22 12:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-21 03:12 - 2013-09-22 12:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-21 03:12 - 2013-09-22 12:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-21 03:12 - 2013-09-22 12:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-21 03:12 - 2013-09-22 12:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-21 03:12 - 2013-09-22 12:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-21 03:12 - 2013-09-22 11:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-20 20:31 - 2013-10-20 20:31 - 00011367 _____ C:\ComboFix.txt
2013-10-20 20:14 - 2013-10-20 20:31 - 00000000 ____D C:\ComboFix
2013-10-20 19:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-20 19:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-20 19:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-20 19:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-20 19:43 - 2013-10-20 20:31 - 00000000 ____D C:\Qoobox
2013-10-20 19:42 - 2013-10-20 20:29 - 00000000 ____D C:\Windows\erdnt
2013-10-20 19:41 - 2013-10-20 19:41 - 05135479 ____R (Swearware) C:\Users\Andreas\Desktop\ComboFix.exe
2013-10-20 14:33 - 2013-08-29 09:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-20 14:33 - 2013-08-27 04:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-20 14:33 - 2013-08-27 04:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-20 14:33 - 2013-08-27 04:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-20 14:33 - 2013-08-27 04:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-20 14:33 - 2013-08-27 03:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-20 14:33 - 2013-08-27 03:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-20 14:33 - 2013-08-27 03:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-20 14:33 - 2013-08-27 03:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-20 14:33 - 2013-08-27 03:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-20 14:33 - 2013-08-01 05:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-20 14:33 - 2013-08-01 04:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-20 14:33 - 2013-07-20 12:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-20 14:31 - 2013-07-12 11:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-20 14:31 - 2013-06-29 04:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-20 14:31 - 2013-06-29 04:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-20 14:31 - 2013-06-29 04:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-20 14:31 - 2013-06-29 04:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-20 14:31 - 2013-06-27 01:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-20 14:31 - 2011-05-05 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-20 14:31 - 2011-05-05 15:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-20 14:30 - 2013-07-04 06:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-20 14:30 - 2013-07-03 04:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-20 14:30 - 2013-07-03 04:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-20 14:30 - 2013-06-04 06:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-20 14:30 - 2013-06-04 03:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-20 14:27 - 2013-10-20 14:29 - 00020006 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-10-20 14:16 - 2013-10-20 14:16 - 00000000 ____D C:\FRST
2013-10-20 14:15 - 2013-10-20 14:16 - 01087515 _____ (Farbar) C:\Users\Andreas\Downloads\FRST.exe
2013-10-20 13:18 - 2013-10-20 13:20 - 00000000 ____D C:\sh4ldr
2013-10-20 13:18 - 2013-10-20 13:18 - 00000000 ____D C:\Program Files\Enigma Software Group

==================== One Month Modified Files and Folders =======

2013-10-21 20:12 - 2013-10-21 20:12 - 00000713 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-10-21 20:07 - 2013-10-21 20:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-21 20:04 - 2013-10-21 20:05 - 01033335 _____ (Thisisu) C:\Users\Andreas\Desktop\JRT.exe
2013-10-21 20:01 - 2012-04-03 00:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-21 20:01 - 2008-08-13 14:15 - 00019259 _____ C:\Windows\system32\Config.MPF
2013-10-21 19:42 - 2006-11-02 14:58 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-21 19:42 - 2006-11-02 14:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-21 19:42 - 2006-11-02 14:45 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-21 19:41 - 2006-11-02 14:58 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-21 19:40 - 2013-10-21 19:38 - 00000000 ____D C:\AdwCleaner
2013-10-21 19:40 - 2009-06-29 15:31 - 01681680 _____ C:\Windows\WindowsUpdate.log
2013-10-21 19:35 - 2013-10-21 19:36 - 01060070 _____ C:\Users\Andreas\Desktop\adwcleaner.exe
2013-10-21 18:22 - 2013-10-21 18:22 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000911 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-21 18:21 - 2013-10-21 18:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-21 03:54 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-21 03:52 - 2008-01-21 10:21 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-21 03:46 - 2006-11-02 14:44 - 00405480 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-21 03:45 - 2008-01-21 05:02 - 00030128 _____ C:\Windows\PFRO.log
2013-10-21 03:25 - 2008-08-13 14:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-21 03:18 - 2013-08-17 13:43 - 00000000 ____D C:\Windows\system32\MRT
2013-10-21 03:15 - 2006-11-02 12:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-20 20:31 - 2013-10-20 20:31 - 00011367 _____ C:\ComboFix.txt
2013-10-20 20:31 - 2013-10-20 20:14 - 00000000 ____D C:\ComboFix
2013-10-20 20:31 - 2013-10-20 19:43 - 00000000 ____D C:\Qoobox
2013-10-20 20:31 - 2006-11-02 13:18 - 00000000 __RHD C:\Users\Default
2013-10-20 20:31 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-10-20 20:29 - 2013-10-20 19:42 - 00000000 ____D C:\Windows\erdnt
2013-10-20 20:28 - 2006-11-02 12:23 - 00000215 _____ C:\Windows\system.ini
2013-10-20 19:41 - 2013-10-20 19:41 - 05135479 ____R (Swearware) C:\Users\Andreas\Desktop\ComboFix.exe
2013-10-20 14:29 - 2013-10-20 14:27 - 00020006 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-10-20 14:16 - 2013-10-20 14:16 - 00000000 ____D C:\FRST
2013-10-20 14:16 - 2013-10-20 14:15 - 01087515 _____ (Farbar) C:\Users\Andreas\Downloads\FRST.exe
2013-10-20 14:10 - 2006-11-02 14:49 - 00104843 _____ C:\Windows\setupact.log
2013-10-20 14:04 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-10-20 14:04 - 2006-11-02 12:22 - 48758784 _____ C:\Windows\system32\config\software_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 42729472 _____ C:\Windows\system32\config\components_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 22020096 _____ C:\Windows\system32\config\system_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-10-20 14:04 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-10-20 14:03 - 2009-06-29 15:49 - 00000000 ____D C:\Users\Andreas
2013-10-20 14:03 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-10-20 14:03 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-10-20 14:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-10-20 13:20 - 2013-10-20 13:18 - 00000000 ____D C:\sh4ldr
2013-10-20 13:18 - 2013-10-20 13:18 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-10-20 13:16 - 2008-08-13 14:16 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-10-20 12:56 - 2009-06-29 15:53 - 00000000 ____D C:\Users\Andreas\AppData\Local\Google
2013-10-20 11:30 - 2013-05-26 18:19 - 03172352 _____ C:\Users\Andreas\Desktop\CD.xls
2013-10-20 11:30 - 2013-05-26 18:19 - 00286208 _____ C:\Users\Andreas\Desktop\Verkauf 2012 u. 2013.xls
2013-10-09 13:01 - 2012-04-03 00:13 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-09 13:01 - 2011-10-03 21:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-09 12:14 - 2013-02-26 15:49 - 00012078 _____ C:\Users\Andreas\Desktop\ThatsEntertainment_130226.xlsx
2013-09-22 12:29 - 2013-10-21 03:12 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-22 12:22 - 2013-10-21 03:12 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-22 12:22 - 2013-10-21 03:12 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-22 12:14 - 2013-10-21 03:12 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-22 12:13 - 2013-10-21 03:12 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-22 12:13 - 2013-10-21 03:12 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-22 12:12 - 2013-10-21 03:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-22 12:09 - 2013-10-21 03:12 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-22 12:08 - 2013-10-21 03:12 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-22 12:07 - 2013-10-21 03:12 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-22 12:06 - 2013-10-21 03:12 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-22 12:05 - 2013-10-21 03:12 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-22 12:03 - 2013-10-21 03:12 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-22 12:03 - 2013-10-21 03:12 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-22 12:03 - 2013-10-21 03:12 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-22 11:59 - 2013-10-21 03:12 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

Some content of TEMP:
====================
C:\Users\Andreas\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-21 19:47

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-10-2013
Ran by Andreas at 2013-10-21 20:22:40
Running from C:\Users\Andreas\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: McAfee VirusScan (Enabled - Out of date) {2A28CCAF-2E53-0F80-A82C-9572D1C24D8C}
AS: McAfee VirusScan (Enabled - Up to date) {91492D4B-0869-000E-929C-AE00AA450731}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Personal Firewall (Disabled) {12134D8A-643C-0ED8-8373-3C472F110AF7}

==================== Installed Programs ======================

32 Bit HP CIO Components Installer (Version: 7.1.8)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Reader 8.3.1 - Deutsch (Version: 8.3.1)
AIO_CDA_ProductContext (Version: 82.0.233.000)
AIO_CDA_Software (Version: 82.0.233.000)
AIO_Scan (Version: 82.0.173.000)
Atheros Driver Installation Program (Version: 5.0)
Atheros Wi-Fi Protected Setup Library
BufferChm (Version: 82.0.173.000)
C4100 (Version: 82.0.233.000)
c4100_Help (Version: 82.0.233.000)
CD/DVD Drive Acoustic Silencer (Version: 2.02.03)
Cisco EAP-FAST Module (Version: 2.1.6)
Cisco LEAP Module (Version: 1.0.12)
Cisco PEAP Module (Version: 1.0.13)
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000)
Copy (Version: 82.0.188.000)
CustomerResearchQFolder (Version: 1.00.0000)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Destinations (Version: 82.0.173.000)
DeviceManagementQFolder (Version: 1.00.0000)
DocProc (Version: 8.1.0.0)
DocProcQFolder (Version: 1.00.0000)
DVD MovieFactory for TOSHIBA (Version: 5.51)
eSupportQFolder (Version: 1.00.0000)
Fax (Version: 82.0.188.000)
Google Desktop (Version: 5.9.1005.12335)
HandyBits ZipNGo
HDAUDIO Soft Data Fax Modem with SmartCP (Version: 7.70.00.50)
HP Customer Participation Program 8.0 (Version: 8.0)
HP Imaging Device Functions 8.0 (Version: 8.0)
HP OCR Software 8.0 (Version: 8.0)
HP Photosmart Essential (Version: 1.12.0.46)
HP Photosmart.All-In-One Driver Software 8.0 .A (Version: 8.0)
HP Product Assistant (Version: 100.000.001.000)
HP Solution Center 8.0 (Version: 8.0)
HP Update (Version: 5.003.001.001)
HPProductAssistant (Version: 82.0.173.000)
HPSSupply (Version: 2.1.3.0000)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java Auto Updater (Version: 2.0.7.2)
Java(TM) 6 Update 38 (Version: 6.0.380)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
MarketResearch (Version: 82.0.174.000)
McAfee SecurityCenter
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Works (Version: 9.7.0621)
Microsoft XML Parser (Version: 8.20.8730.4)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
myphotobook 3.6 (Version: 3.6)
NetWaiting (Version: 2.5.52)
Picasa 3 (Version: 3.8)
RCA Digital Cable Modem
Realtek 8169 8168 8101E 8102E Ethernet Driver (Version: 1.00.0000)
Realtek High Definition Audio Driver (Version: 6.0.1.5599)
Realtek USB 2.0 Card Reader (Version: )
Scan (Version: 8.1.0.0)
SolutionCenter (Version: 82.0.188.000)
Status (Version: 82.0.173.000)
Synaptics Pointing Device Driver (Version: 10.1.8.0)
Toolbox (Version: 82.0.173.000)
TOSHIBA Assist (Version: 2.01.08)
TOSHIBA Benutzerhandbücher (Version: 7.40)
TOSHIBA ConfigFree (Version: 7.2.20)
TOSHIBA Disc Creator (Version: 2.0.1.3)
TOSHIBA DVD PLAYER (Version: 1.31.14)
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)
TOSHIBA Hardware Setup (Version: 2.00.08)
Toshiba Online Product Information (Version: 1.00.0012)
TOSHIBA Recovery Disc Creator (Version: 2.0.0.1b)
TOSHIBA Supervisor Password (Version: 2.00.04)
Toshiba TEMPRO (Version: 1.1)
TOSHIBA Value Added Package (Version: 1.1.24)
TrayApp (Version: 82.0.188.000)
TRDCReminder (Version: 1.00.0015)
TRORDCLauncher (Version: 1.0.0.1)
UnloadSupport (Version: 1.00.0000)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition
WebReg (Version: 82.0.173.000)
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series (Version: 9.00.3374)

==================== Restore Points  =========================

20-10-2013 11:17:08 Installed SpyHunter
20-10-2013 11:54:41 Wiederherstellungsvorgang
21-10-2013 01:01:40 Windows Update

==================== Hosts content: ==========================

2006-11-02 12:23 - 2013-10-20 20:28 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {18DFD9FC-082E-4E9B-8285-5F21D2B4EDAE} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2D2DEC4F-74BB-4FB5-9626-21B3A60365F1} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\pla.dll [2008-01-21] (Microsoft Corporation)
Task: {2D9122CA-9AD1-435C-8DA5-3F3854294CE6} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-12] (Microsoft Corporation)
Task: {5916F864-469C-4391-8604-E4EA141A2699} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {7B7DF01D-43DA-46FC-9CFE-39CDD562AFFE} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {7C5A51E8-1AD7-48C6-8879-257A8A9609F5} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8B0E6FAB-F43A-4988-AF0A-A21646C212F0} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {9ED703A9-5FFD-40D5-895A-4385EE1509DE} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {BB84C0BB-8879-4293-985B-6DD26088F1E5} - System32\Tasks\McDefragTask => c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04] (McAfee, Inc.)
Task: {C551CAB5-D089-48D3-8873-E5B116F1A629} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {EE30DF1A-3C5A-421F-81F7-E6BB2DBF104D} - System32\Tasks\McQcTask => c:\PROGRA~1\mcafee\mqc\QcConsol.exe [2007-12-04] (McAfee, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\McDefragTask.job => C:\Windows\system32\defrag.exe
Task: C:\Windows\Tasks\McQcTask.job => c:\PROGRA~1\mcafee\mqc\QcConsol.exe

==================== Loaded Modules (whitelisted) =============

2008-08-13 14:16 - 2010-08-08 18:29 - 00034816 _____ () C:\Program Files\Google\Google Desktop Search\gzlib.dll
2008-03-06 10:14 - 2008-03-06 10:14 - 05121912 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2007-12-14 21:40 - 2007-12-14 21:40 - 00090112 _____ () C:\Program Files\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll
2008-08-13 13:53 - 2006-10-10 11:44 - 00009728 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll
2007-12-25 12:03 - 2007-12-25 12:03 - 00015184 _____ () C:\Program Files\Toshiba\PCDiag\NotifyPCD.dll
2006-10-07 12:57 - 2006-10-07 12:57 - 00053248 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2006-12-10 21:51 - 2006-12-10 21:51 - 00065536 ____R () C:\Program Files\HP\Digital Imaging\bin\crm\xmlparse.dll
2006-12-10 21:51 - 2006-12-10 21:51 - 00077824 ____R () C:\Program Files\HP\Digital Imaging\bin\crm\xmltok.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============

Name: HDAUDIO Soft Data Fax Modem with SmartCP
Description: HDAUDIO Soft Data Fax Modem with SmartCP
Class Guid: {4d36e96d-e325-11ce-bfc1-08002be10318}
Manufacturer: CXT
Service: Modem
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 59%
Total physical RAM: 1915.25 MB
Available physical RAM: 774.02 MB
Total Pagefile: 4075.79 MB
Available Pagefile: 2686.41 MB
Total Virtual: 2047.88 MB
Available Virtual: 1916.09 MB

==================== Drives ================================

Drive c: (Vista) (Fixed) (Total:74.37 GB) (Free:32.34 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data) (Fixed) (Total:73.21 GB) (Free:68.53 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 256ECCE7)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=74 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=73 GB) - (Type=07 NTFS)

==================== End Of Log ============================