Der lapptop hat viele fehler und will skype auch nicht instalieren

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-25 18:43:50
Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500325AS rev.0003HPM1 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Alexej\AppData\Local\Temp\ugdiqpog.sys


---- Kernel code sections - GMER 2.1 ----

.text     C:\Windows\System32\win32k.sys!W32pServiceTable                                                                         fffff9600012f800 3 bytes [C0, 82, 02]
.text     C:\Windows\System32\win32k.sys!W32pServiceTable + 4                                                                     fffff9600012f804 3 bytes [41, BC, FA]
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                        suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                        suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                        suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                        suspicious modification

---- Threads - GMER 2.1 ----

Thread    C:\Windows\system32\SearchIndexer.exe [3752:1332]                                                                       000007fef59d39f0

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00247e74bfb4                                             
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                        
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files (x86)\DAEMON Tools Lite\
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x56 0x02 0x20 0x1C ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                               
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x0C 0xDE 0xB0 0xE4 ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                          
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x81 0x57 0x0C 0xA4 ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                          
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0xBE 0xB6 0xD8 0xC6 ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2                          
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                    0xBE 0xB6 0xD8 0xC6 ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3                          
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                    0xBE 0xB6 0xD8 0xC6 ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{41c77516-4b32-46e2-8aef-1004f6a30164}@Dhcpv6State  0
Reg       HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00247e74bfb4 (not active ControlSet)                         
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                    
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                         C:\Program Files (x86)\DAEMON Tools Lite\
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                         0
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                      0x56 0x02 0x20 0x1C ...
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)           
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                0x20 0x01 0x00 0x00 ...
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                             0x0C 0xDE 0xB0 0xE4 ...
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)      
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                        0x81 0x57 0x0C 0xA4 ...
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)      
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                        0xBE 0xB6 0xD8 0xC6 ...
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)      
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12                        0xBE 0xB6 0xD8 0xC6 ...
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3 (not active ControlSet)      
Reg       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq3@hdf12                        0xBE 0xB6 0xD8 0xC6 ...

---- EOF - GMER 2.1 ----
         

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:15 on 25/10/2013 (Alexej)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-10-2013
Ran by Alexej (administrator) on ALEXEJ-PC on 25-10-2013 18:24:02
Running from C:\Users\Alexej\Downloads
Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
(MusicLab, LLC) C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
() C:\Program Files (x86)\SMINST\BLService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Alexej\Downloads\FRST64 (1).exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [914224 2008-11-18] (Hewlett-Packard)
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [442368 2009-06-03] (IDT, Inc.)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKCU\...\Run: [HPAdvisor] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-26] (Hewlett-Packard)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [EPSON Stylus DX4000 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBEE.EXE /FU "C:\Users\Alexej\AppData\Local\Temp\E_SC2A3.tmp" /EF "HKCU"
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20472992 2013-10-02] (Skype Technologies S.A.)
HKCU\...\Run: [Advanced SystemCare 6] - C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe [491840 2013-01-15] (IObit)
HKCU\...\Policies\Explorer: [NoInstrumentation] 1
MountPoints2: {6844138f-7166-11de-aa7c-00247e74bfb4} - F:\demo32.exe club.dbd
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-08-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DVDAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-11-28] (CyberLink Corp.)
HKLM-x32\...\Run: [TSMAgent] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1316136 2008-12-25] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer for HP TouchSmart] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-12-25] (CyberLink)
HKLM-x32\...\Run: [TVAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe [210216 2009-01-21] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [218408 2008-11-14] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2008-11-26] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2010-02-25] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-10-30] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Health Check Scheduler] - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75008 2008-10-09] (Hewlett-Packard)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-05-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-01-12] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SSDMonitor] - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [103896 2012-02-03] (PC Tools)
HKLM-x32\...\Run: [DATAMNGR] - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe [1693800 2012-03-04] (MusicLab, LLC)
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-26] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-26] (Hewlett-Packard)
AppInit_DLLs: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll  [1791408 2012-03-04] (MusicLab, LLC)
AppInit_DLLs-x32: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll  [1233840 2012-03-04] (MusicLab, LLC)
Startup: C:\Users\Alexej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Alexej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe (AVM Berlin)
Startup: C:\Users\Alexej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.bearshare.net
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  No File
URLSearchHook: (No Name) - {09900DE8-1DCA-443F-9243-26FF581438AF} -  No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}
SearchScopes: HKLM - {7BD92223-3340-4218-B2DC-CAADA62C56BF} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}
SearchScopes: HKLM - {B4F381CE-68D8-4179-A60A-797EC0C34865} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {BFF76C5E-CBC4-495C-B661-5C006E231FBD} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {7BD92223-3340-4218-B2DC-CAADA62C56BF} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
SearchScopes: HKLM-x32 - {B4F381CE-68D8-4179-A60A-797EC0C34865} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM-x32 - {BFF76C5E-CBC4-495C-B661-5C006E231FBD} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://www.bing.com/search?FORM=UP22DF&PC=UP22&dt=120412&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKCU - {13112CE7-A765-4298-8441-DF4E1C46C95E} URL = hxxp://go.mail.ru/search?lfilter=y&mailru=1&q={searchTerms}
SearchScopes: HKCU - {1F096B29-E9DA-4D64-8D63-936BE7762CC5} URL = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=401f3b9b0000000000000022fac147c8&tlver=1.4.19.19&affID=17160
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {7BD92223-3340-4218-B2DC-CAADA62C56BF} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search/web?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
SearchScopes: HKCU - {B4F381CE-68D8-4179-A60A-797EC0C34865} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKCU - {BFF76C5E-CBC4-495C-B661-5C006E231FBD} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
SearchScopes: HKCU - {F1B4D8C9-25AD-46B4-B686-B02153FC18E7} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: DataMngr - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\x64\BrowserConnection.dll (MusicLab, LLC)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
BHO-x32: No Name - {7E853D72-626A-48EC-A868-BA8D5E23E045} -  No File
BHO-x32: No Name - {8984B388-A5BB-4DF7-B274-77B879E179DB} -  No File
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: DataMngr - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\BrowserConnection.dll (MusicLab, LLC)
BHO-x32: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Advanced SystemCare 6\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO-x32: Wincore Mediabar - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll ()
BHO-x32: No Name - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} -  No File
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} -  No File
Toolbar: HKLM-x32 - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
Toolbar: HKLM-x32 - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} -  No File
Toolbar: HKLM-x32 - No Name - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  No File
Toolbar: HKLM-x32 - No Name - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} -  No File
Toolbar: HKLM-x32 - No Name - {09900DE8-1DCA-443F-9243-26FF581438AF} -  No File
Toolbar: HKLM-x32 - Wincore Mediabar - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll ()
Toolbar: HKCU - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} -  No File
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 08 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 01 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 02 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 03 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 15 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Tcpip\..\Interfaces\{E8D9E329-0D06-4AC5-AB72-523E3D9511DD}: [NameServer]62.109.121.2 62.109.121.1

FireFox:
========
FF ProfilePath: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default
FF user.js: detected! => C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @IObit.com/np_Asc_Plugin - C:\Program Files (x86)\IObit\Advanced SystemCare 6\BrowerProtect\np_Asc_plugin.dll (IObit)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.69 - C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.69 - C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=8 - C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\icqplugin.gif
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\icqplugin.src
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\mailru.xml
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\mailru.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\ascsurfingprotection@iobit.com
FF Extension: Babylon - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\ffxtlbr@babylon.com
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\staged-xpis
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07}-trash
FF Extension: Wincore Mediabar - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

Chrome: 
=======
CHR HomePage: hxxp://search.bearshare.net
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Extension: (Lamborghini Sesto Elemento Theme) - C:\Users\Alexej\AppData\Local\Google\Chrome\User Data\Default\Extensions\dappigdjllcnkkoacaoolciaolaaiemb\1.0_0
CHR Extension: (Babylon Translator) - C:\Users\Alexej\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.9_0
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Alexej\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files (x86)\IObit\Advanced SystemCare 6\BrowerProtect\ASC_GhromePluginFor6.crx

==================== Services (Whitelisted) =================

S2 AcronisOSSReinstallSvc; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2235448 2007-03-26] ()
R2 AdvancedSystemCareService6; C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [528192 2013-02-25] (IObit)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
S3 COMSysApp; C:\Windows\SysWow64\dllhost.exe [7168 2006-11-02] (Microsoft Corporation)
R2 IGDCTRL; C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE [87344 2007-09-04] (AVM Berlin)
R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [793048 2012-02-03] (PC Tools)
R2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365952 2008-12-17] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe [239104 2009-06-03] (IDT, Inc.)
R2 TVCapSvc; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2008-11-26] ()
R2 TVSched; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2008-11-26] ()
R2 WSearch; C:\Windows\SysWow64\SearchIndexer.exe [441344 2009-04-11] (Microsoft Corporation)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [x]
S2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [x]

==================== Drivers (Whitelisted) ====================

R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [17720 2010-11-26] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-07-15] (Duplex Secure Ltd.)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2008-11-28] (CyberLink Corp.)
U4 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-25 18:23 - 2013-10-25 18:23 - 01955412 _____ (Farbar) C:\Users\Alexej\Downloads\FRST64 (1).exe
2013-10-25 18:23 - 2013-10-25 18:23 - 00000000 ____D C:\FRST
2013-10-25 18:15 - 2013-10-25 18:15 - 00000584 _____ C:\Users\Alexej\Downloads\defogger_disable.log
2013-10-25 18:15 - 2013-10-25 18:15 - 00000020 _____ C:\Users\Alexej\defogger_reenable
2013-10-25 18:14 - 2013-10-25 18:14 - 01955412 _____ (Farbar) C:\Users\Alexej\Downloads\FRST64.exe
2013-10-25 18:14 - 2013-10-25 18:14 - 00050477 _____ C:\Users\Alexej\Downloads\Defogger.exe
2013-10-25 18:12 - 2013-10-25 18:12 - 00000034 _____ C:\Windows\setupact.log
2013-10-25 18:12 - 2013-10-25 18:12 - 00000000 _____ C:\Windows\setuperr.log
2013-10-25 18:08 - 2013-10-25 18:08 - 01551008 _____ (Skype Technologies S.A.) C:\Users\Alexej\Downloads\SkypeSetup.exe
2013-10-25 16:12 - 2013-10-25 16:12 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\Malwarebytes
2013-10-25 16:11 - 2013-10-25 17:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-25 16:11 - 2013-10-25 16:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-23 16:48 - 2013-10-25 16:18 - 00000000 ____D C:\Program Files (x86)\Skype(223)
2013-10-22 17:32 - 2013-10-22 17:32 - 00000679 _____ C:\Users\Alexej\Documents\Uninstall STAR WARS The Old Republic.log
2013-10-22 17:24 - 2013-10-24 17:38 - 00010290 _____ C:\Windows\PFRO.log
2013-10-17 14:44 - 2013-10-17 14:44 - 00000000 ____D C:\ProgramData\WindowsSearch
2013-10-13 12:45 - 2013-10-13 12:45 - 00000000 __SHD C:\found.000
2013-10-11 11:13 - 2013-10-22 17:22 - 00000000 ____D C:\ProgramData\Avira
2013-10-11 10:49 - 2013-10-11 10:58 - 115068344 _____ C:\Users\Alexej\avira_free_antivirus_de.exe
2013-10-10 15:23 - 2013-09-22 17:43 - 17833984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 15:23 - 2013-09-22 17:01 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 15:23 - 2013-09-22 16:42 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 15:23 - 2013-09-22 16:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 15:23 - 2013-09-22 16:33 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-10 15:23 - 2013-09-22 16:33 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 15:23 - 2013-09-22 16:30 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-10 15:23 - 2013-09-22 16:27 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 15:23 - 2013-09-22 16:23 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-10 15:23 - 2013-09-22 16:22 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 15:23 - 2013-09-22 16:21 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-10 15:23 - 2013-09-22 16:19 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 15:23 - 2013-09-22 16:19 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 15:23 - 2013-09-22 16:16 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-10 15:23 - 2013-09-22 16:15 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 15:23 - 2013-09-22 16:07 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 15:23 - 2013-09-22 12:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-10 15:23 - 2013-09-22 12:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-10 15:23 - 2013-09-22 12:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-10 15:23 - 2013-09-22 12:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-10-10 15:23 - 2013-09-22 12:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-10 15:23 - 2013-09-22 12:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-10 15:23 - 2013-09-22 12:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-10-10 15:23 - 2013-09-22 12:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-10 15:23 - 2013-09-22 12:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-10-10 15:23 - 2013-09-22 12:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-10 15:23 - 2013-09-22 12:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-10-10 15:23 - 2013-09-22 12:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-10 15:23 - 2013-09-22 12:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-10 15:23 - 2013-09-22 12:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-10 15:23 - 2013-09-22 12:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-10-10 15:23 - 2013-09-22 11:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-10 07:34 - 2013-08-29 09:48 - 02775552 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 07:34 - 2013-08-01 06:10 - 00901568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 07:34 - 2013-08-01 05:37 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-10-10 07:33 - 2013-08-27 04:32 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-10 07:33 - 2013-08-27 04:30 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-10 07:33 - 2013-08-27 04:06 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-10 07:33 - 2013-08-27 04:00 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-10 07:33 - 2013-08-27 04:00 - 01149952 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-10 07:33 - 2013-08-27 03:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-10-10 07:33 - 2013-08-27 03:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-10-10 07:33 - 2013-08-27 03:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-10-10 07:33 - 2013-08-27 03:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-10-10 07:33 - 2013-07-20 12:45 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 07:33 - 2013-07-20 12:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 07:33 - 2013-07-12 11:19 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\SET2963.tmp
2013-10-10 07:33 - 2013-07-04 06:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-10 07:33 - 2013-07-04 06:13 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 07:33 - 2013-07-03 04:55 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 07:33 - 2013-07-03 04:22 - 00031616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00007552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:33 - 2013-06-27 01:00 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 07:33 - 2013-06-04 06:16 - 00048128 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 07:33 - 2013-06-04 06:16 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-10 07:33 - 2013-06-04 04:01 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 07:33 - 2013-06-04 03:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-10 07:33 - 2011-05-05 16:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 07:33 - 2011-05-05 16:17 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

==================== One Month Modified Files and Folders =======

2013-10-25 18:23 - 2013-10-25 18:23 - 01955412 _____ (Farbar) C:\Users\Alexej\Downloads\FRST64 (1).exe
2013-10-25 18:23 - 2013-10-25 18:23 - 00000000 ____D C:\FRST
2013-10-25 18:21 - 2009-08-16 12:48 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\Skype
2013-10-25 18:21 - 2009-05-18 03:36 - 02032405 _____ C:\Windows\WindowsUpdate.log
2013-10-25 18:21 - 2009-01-22 00:48 - 00003578 _____ C:\Windows\System32\Tasks\HP Health Check
2013-10-25 18:17 - 2011-06-18 17:41 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-25 18:17 - 2009-08-03 13:56 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\FRITZ!
2013-10-25 18:17 - 2009-07-22 21:25 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-25 18:17 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-25 18:17 - 2006-11-02 17:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-25 18:17 - 2006-11-02 17:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-25 18:15 - 2013-10-25 18:15 - 00000584 _____ C:\Users\Alexej\Downloads\defogger_disable.log
2013-10-25 18:15 - 2013-10-25 18:15 - 00000020 _____ C:\Users\Alexej\defogger_reenable
2013-10-25 18:15 - 2009-07-08 12:08 - 00000000 ____D C:\Users\Alexej
2013-10-25 18:15 - 2009-05-18 03:36 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-10-25 18:15 - 2006-11-02 17:42 - 00032578 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-25 18:14 - 2013-10-25 18:14 - 01955412 _____ (Farbar) C:\Users\Alexej\Downloads\FRST64.exe
2013-10-25 18:14 - 2013-10-25 18:14 - 00050477 _____ C:\Users\Alexej\Downloads\Defogger.exe
2013-10-25 18:12 - 2013-10-25 18:12 - 00000034 _____ C:\Windows\setupact.log
2013-10-25 18:12 - 2013-10-25 18:12 - 00000000 _____ C:\Windows\setuperr.log
2013-10-25 18:09 - 2012-09-05 21:27 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-25 18:09 - 2009-08-15 12:48 - 00000000 ____D C:\ProgramData\Skype
2013-10-25 18:08 - 2013-10-25 18:08 - 01551008 _____ (Skype Technologies S.A.) C:\Users\Alexej\Downloads\SkypeSetup.exe
2013-10-25 17:53 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\tracing
2013-10-25 17:50 - 2012-08-02 10:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-25 17:46 - 2011-06-18 17:41 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-25 17:45 - 2013-10-25 16:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-25 17:45 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\Msdtc
2013-10-25 17:44 - 2006-11-02 14:33 - 75759616 _____ C:\Windows\system32\config\software_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 63176704 _____ C:\Windows\system32\config\components_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 22020096 _____ C:\Windows\system32\config\system_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 00057344 _____ C:\Windows\system32\config\sam_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 00028672 _____ C:\Windows\system32\config\security_previous
2013-10-25 17:39 - 2012-05-14 12:04 - 00000000 ___HD C:\ProgramData\~0
2013-10-25 17:39 - 2012-04-03 22:01 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-10-25 17:39 - 2012-04-03 21:33 - 00000000 ____D C:\Windows\system32\Drivers\NSSx64
2013-10-25 17:39 - 2012-04-03 21:33 - 00000000 ____D C:\Program Files (x86)\Norton Security Scan
2013-10-25 17:39 - 2011-10-17 22:11 - 00000000 ____D C:\Program Files (x86)\TIOnline
2013-10-25 17:39 - 2011-06-01 09:46 - 00000000 ____D C:\ProgramData\IObit
2013-10-25 17:39 - 2010-09-13 21:51 - 00000000 ____D C:\Program Files (x86)\IObit
2013-10-25 17:39 - 2009-01-22 00:28 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-10-25 17:39 - 2009-01-22 00:28 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-10-25 17:39 - 2009-01-22 00:26 - 00000000 ____D C:\ProgramData\CyberLink
2013-10-25 17:39 - 2009-01-22 00:26 - 00000000 ____D C:\Program Files (x86)\CyberLink
2013-10-25 17:39 - 2009-01-21 23:53 - 00000000 ____D C:\ProgramData\WildTangent
2013-10-25 17:39 - 2009-01-21 23:53 - 00000000 ____D C:\Program Files (x86)\HP Games
2013-10-25 17:39 - 2009-01-21 23:26 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-25 17:39 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\spool
2013-10-25 17:39 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\registration
2013-10-25 16:18 - 2013-10-23 16:48 - 00000000 ____D C:\Program Files (x86)\Skype(223)
2013-10-25 16:12 - 2013-10-25 16:12 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\Malwarebytes
2013-10-25 16:11 - 2013-10-25 16:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-24 19:01 - 2012-04-04 19:00 - 00006376 _____ C:\Windows\SysWOW64\AppLog.log
2013-10-24 18:17 - 2006-11-02 17:21 - 00024576 _____ C:\Windows\system32\umstartup.etl
2013-10-24 17:38 - 2013-10-22 17:24 - 00010290 _____ C:\Windows\PFRO.log
2013-10-22 17:32 - 2013-10-22 17:32 - 00000679 _____ C:\Users\Alexej\Documents\Uninstall STAR WARS The Old Republic.log
2013-10-22 17:22 - 2013-10-11 11:13 - 00000000 ____D C:\ProgramData\Avira
2013-10-21 15:01 - 2011-06-05 15:38 - 00000278 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-10-17 19:00 - 2012-04-03 22:02 - 00000288 _____ C:\Windows\Tasks\RMSchedule.job
2013-10-17 14:44 - 2013-10-17 14:44 - 00000000 ____D C:\ProgramData\WindowsSearch
2013-10-16 15:38 - 2011-06-05 15:38 - 00000286 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-10-13 12:45 - 2013-10-13 12:45 - 00000000 __SHD C:\found.000
2013-10-11 11:24 - 2009-01-22 00:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-11 11:20 - 2009-07-15 16:29 - 00000000 ____D C:\Program Files (x86)\Opera
2013-10-11 10:58 - 2013-10-11 10:49 - 115068344 _____ C:\Users\Alexej\avira_free_antivirus_de.exe
2013-10-11 07:00 - 2009-01-22 07:00 - 00628992 _____ C:\Windows\system32\perfh007.dat
2013-10-11 07:00 - 2009-01-22 07:00 - 00126704 _____ C:\Windows\system32\perfc007.dat
2013-10-11 07:00 - 2006-11-02 14:46 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-10 15:56 - 2006-11-02 17:21 - 00335696 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 15:51 - 2012-09-14 20:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-10 15:31 - 2013-08-11 03:00 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 15:26 - 2006-11-02 14:35 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-09 23:51 - 2012-08-02 10:52 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-09 23:51 - 2012-08-02 10:52 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-09 23:51 - 2012-01-06 18:44 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-08 14:03 - 2009-08-25 14:29 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-10-05 01:46 - 2011-01-12 00:35 - 00000000 ____D C:\ProgramData\Guard.Mail.Ru
2013-10-02 09:00 - 2011-05-04 15:06 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\HpUpdate

Files to move or delete:
====================
C:\Users\Alexej\avira_free_antivirus_de.exe


Some content of TEMP:
====================
C:\Users\Alexej\AppData\Local\Temp\73DD6705C2E24AEC9F1A045D5862BAA6.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-25 18:24

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-10-2013
Ran by Alexej at 2013-10-25 18:25:10
Running from C:\Users\Alexej\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================


==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (x32)
????????? WinRAR (x32)
Âåñåëàÿ ôåðìà 3 (x32)
Acronis*Disk Director Suite (x32 Version: 10.0.2161)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0)
Activation Assistant for the 2007 Microsoft Office suites (x32)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.12.36)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader 9.5.5 - Deutsch (x32 Version: 9.5.5)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.4.634)
Advanced SystemCare 6 (x32 Version: 6.1)
AOL Toolbar 5.0 (x32 Version: 5.2.78.2)
ATI Catalyst Install Manager (Version: 3.0.704.0)
AVM FRITZ!Box Dokumentation (x32)
AVM FRITZ!Box Druckeranschluss (x32)
AVM FRITZ!DSL (x32 Version: 2.04.02)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Graphics Full Existing (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Graphics Full New (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Graphics Light (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Graphics Previews Common (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center InstallProxy (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Chinese Standard (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Chinese Traditional (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Czech (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Danish (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Dutch (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Finnish (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization French (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization German (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Greek (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Hungarian (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Italian (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Japanese (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Korean (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Norwegian (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Polish (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Portuguese (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Russian (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Spanish (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Swedish (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Thai (x32 Version: 2008.1231.1149.21141)
Catalyst Control Center Localization Turkish (x32 Version: 2008.1231.1149.21141)
CCC Help Chinese Standard (x32 Version: 2008.1231.1148.21141)
CCC Help Chinese Traditional (x32 Version: 2008.1231.1148.21141)
CCC Help Czech (x32 Version: 2008.1231.1148.21141)
CCC Help Danish (x32 Version: 2008.1231.1148.21141)
CCC Help Dutch (x32 Version: 2008.1231.1148.21141)
CCC Help English (x32 Version: 2008.1231.1148.21141)
CCC Help Finnish (x32 Version: 2008.1231.1148.21141)
CCC Help French (x32 Version: 2008.1231.1148.21141)
CCC Help German (x32 Version: 2008.1231.1148.21141)
CCC Help Greek (x32 Version: 2008.1231.1148.21141)
CCC Help Hungarian (x32 Version: 2008.1231.1148.21141)
CCC Help Italian (x32 Version: 2008.1231.1148.21141)
CCC Help Japanese (x32 Version: 2008.1231.1148.21141)
CCC Help Korean (x32 Version: 2008.1231.1148.21141)
CCC Help Norwegian (x32 Version: 2008.1231.1148.21141)
CCC Help Polish (x32 Version: 2008.1231.1148.21141)
CCC Help Portuguese (x32 Version: 2008.1231.1148.21141)
CCC Help Russian (x32 Version: 2008.1231.1148.21141)
CCC Help Spanish (x32 Version: 2008.1231.1148.21141)
CCC Help Swedish (x32 Version: 2008.1231.1148.21141)
CCC Help Thai (x32 Version: 2008.1231.1148.21141)
CCC Help Turkish (x32 Version: 2008.1231.1148.21141)
ccc-core-static (x32 Version: 2008.1231.1149.21141)
ccc-utility64 (Version: 2008.1231.1149.21141)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
CyberLink DVD Suite (x32 Version: 6.0.2326)
DAEMON Tools Toolbar (x32 Version: 1.0.8.0552)
Die Schlacht um Mittelerde(tm) (x32)
Die Schlacht um Mittelerde™ II (x32)
EPSON-Drucker-Software
ESU for Microsoft Vista (x32 Version: 1.0.0)
FoxTab PDF Converter (x32)
GameSpy Arcade (x32)
GeoGebra (x32 Version: 3.0.0.0)
Google Chrome (x32 Version: 12.0.742.100)
Google Update Helper (x32 Version: 1.2.183.29)
HP Active Support Library (x32 Version: 3.1.9.1)
HP Advisor (x32 Version: 3.1.9289.3128)
HP Common Access Service Library (x32 Version: 2.00 E6)
HP Customer Experience Enhancements (x32 Version: 5.7.0.2664)
HP Help and Support (x32 Version: 2.1.3.0)
HP Integrated Module with Bluetooth wireless technology 6.0.1.6204 (Version: 6.0.1.6204)
HP MediaSmart DVD (x32 Version: 2.1.2328)
HP MediaSmart Music/Photo/Video (x32 Version: 2.1.2425)
HP MediaSmart SmartMenu (Version: 2.1.7)
HP MediaSmart TV (x32 Version: 2.1.1219)
HP MediaSmart Webcam (x32 Version: 2.1.1124)
HP Quick Launch Buttons (x32 Version: 6.50.16.1)
HP Total Care Setup (x32 Version: 1.1.2413.2876)
HP Update (x32 Version: 5.002.007.004)
HP User Guides 0134 (x32 Version: 1.01.0000)
HP Wireless Assistant (x32 Version: 3.50.12.1)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2)
ICQ Toolbar (x32 Version: 3.0.0)
ICQ7.5 (x32 Version: 7.5)
IDT Audio (x32 Version: 1.0.6087.22)
Ïëàíåòà áèòâû (x32)
Java Auto Updater (x32 Version: 2.0.2.4)
Java(TM) 6 Update 21 (x32 Version: 6.0.210)
Java(TM) 6 Update 7 (x32 Version: 1.6.0.70)
JMicron JMB38X Flash Media Controller Driver (x32 Version: 1.00.20.07)
K-Lite Mega Codec Pack 4.7.5 (x32 Version: 4.7.5)
LabelPrint (x32 Version: 2.5.1118)
LightScribe System Software  1.14.17.1 (x32 Version: 1.14.17.1)
Mail.Ru Агент 5.6 (сборка 3402, для всех пользователей) (x32)
Mail.Ru Спутник 2.3.0.104 (x32)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (x32 Version: 5.1.20913.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 9.7.0621)
Mozilla Firefox (3.5.3) (x32 Version: 3.5.3 (de))
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
muvee Reveal (x32 Version: 7.0.35.7660)
My HP Games (x32 Version: 1.0.0.62)
Norton Security Scan (x32 Version: 3.7.0.18)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
Opera 12.16 (x32 Version: 12.16.1860)
Origin (x32 Version: 8.5.0.4550)
PC Tools Registry Mechanic 11.0 (x32 Version: 11.0)
Power2Go (x32 Version: 6.0.2325)
ProtectSmart Hard Drive Protection (Version: 3.10.1.7)
QLBCASL (x32 Version: 6.40.17.2)
Realtek 8169 8168 8101E 8102E Ethernet Driver (x32 Version: 1.00.0000)
RegClean Pro (x32 Version: 6.21)
SAMSUNG Mobile Modem Driver Set
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Skins (x32 Version: 2008.1231.1149.21141)
Skype Click to Call (x32 Version: 6.3.11079)
Skype™ 6.9 (x32 Version: 6.9.106)
Smart Defrag 2 (x32 Version: 2.7)
softonic-de3 Toolbar (x32 Version: 5.7.1.1)
SPORE Creature Creator Trial Edition (x32 Version: 1.00.0000)
Star Wars: The Old Republic (x32 Version: 1.00)
Steam (x32 Version: 1.0.0.0)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 15.3.29.0)
The Club (x32 Version: 1.00.0000)
TIOnline (x32)
UBitMenuDE (x32 Version: 01.04)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Wincore MediaBar (x32 Version: 3.0.0.122068)
Windows Live Messenger (x32 Version: 8.1.0178.00)
Windows-Treiberpaket - ENE (enecir) HIDClass  (09/04/2008 2.6.0.0) (Version: 09/04/2008 2.6.0.0)

==================== Restore Points  =========================

22-10-2013 15:30:24 Konfiguriert Power2Go
22-10-2013 15:34:48 Konfiguriert LabelPrint
22-10-2013 15:36:55 Konfiguriert PowerStarter
22-10-2013 23:28:51 Windows Update
23-10-2013 14:35:34 Steam wird entfernt
23-10-2013 14:39:58 Removed Skype™ 6.3
23-10-2013 14:41:32 Removed Skype Click to Call
23-10-2013 14:43:11 Removed Java(TM) 6 Update 21
25-10-2013 14:12:06 Removed Skype™ 6.9
25-10-2013 15:32:56 Wiederherstellungsvorgang

==================== Hosts content: ==========================

2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {12B3144D-E0BC-4D77-BA44-7FF04A17F764} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {13264CB1-06B4-4D9A-BF66-4FD42B6CDB6F} - System32\Tasks\{3B2B36C4-F80C-448F-B855-967ABDB72F98} => Firefox.exe hxxp://ui.skype.com/ui/0/5.1.0.112.161/de/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {249A4ECA-6460-4E5B-B04D-4789DE2D754B} - System32\Tasks\ASC6_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare 6\Monitor.exe [2013-01-15] (IObit)
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {28D76E0C-4487-4E37-A0A4-F5CF31937074} - System32\Tasks\Norton Security Scan for Alexej => C:\PROGRA~2\NORTON~2\Engine\370~1.18\Nss.exe
Task: {3F91296F-A2D6-480D-94C7-E195A41B729A} - System32\Tasks\{56AC3323-92C9-4A42-AB26-7A244AF8AF86} => c:\program files (x86)\opera\opera.exe [2013-10-11] (Opera Software)
Task: {4E946E6C-49EC-4FD9-8F58-EB5AF1752C5D} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\pla.dll [2008-01-21] (Microsoft Corporation)
Task: {6350A00C-0A09-4FF7-9FA4-F954AF9584D4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {686BDF33-C4FC-4547-B457-73E93075C86A} - System32\Tasks\{E8D283F8-FF2A-4789-86C9-E9375D037592} => c:\program files (x86)\opera\opera.exe [2013-10-11] (Opera Software)
Task: {6A0F0A9E-026E-4028-A75F-BA04E992BA96} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: {6A4A0B28-3514-4B81-83D2-90E292327E69} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8C43BDCD-6CCA-4EF7-95D3-353F84E0B8EA} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {A37F748C-E8C3-4268-B215-E66D90A5614A} - System32\Tasks\{C973C7C5-F5C6-45C9-BF24-A940EC08F31A} => c:\program files (x86)\opera\opera.exe [2013-10-11] (Opera Software)
Task: {B9F1EC0D-7DE4-4772-8DBC-7487EE8211E3} - System32\Tasks\HP Health Check => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
Task: {BE2FDFFC-D75B-42A6-8028-2D2C3FF97A6B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {BFA1918F-9E9A-4201-BAE2-0FF095F8D30B} - System32\Tasks\{18AA2E15-1168-4541-A1FA-1208C48FEAB9} => c:\program files (x86)\opera\opera.exe [2013-10-11] (Opera Software)
Task: {DC3A54F6-64B8-4AB6-9AE0-151AE2EB3A8C} - System32\Tasks\RMSmartUpdate => C:\Program Files (x86)\PC Tools Registry Mechanic\update.exe [2012-02-03] (PC Tools)
Task: {E1A59AE5-C189-44DF-9304-618B892D28EB} - System32\Tasks\RMSchedule => C:\Program Files (x86)\PC Tools Registry Mechanic\RegMech.exe [2012-02-03] (PC Tools)
Task: {E29B5BBA-A979-4219-913A-F23525D704FF} - System32\Tasks\{2C914D04-EFDB-4DBF-8642-D9433B9549C8} => c:\program files (x86)\opera\opera.exe [2013-10-11] (Opera Software)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {EC4FA709-0EB9-4F74-A629-ED7DCAEF2A15} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Norton Security Scan for Alexej.job => C:\PROGRA~2\NORTON~2\Engine\370~1.18\Nss.exe
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\RMSchedule.job => C:\Program Files (x86)\PC Tools Registry Mechanic\RegMech.exe

==================== Loaded Modules (whitelisted) =============

2008-06-19 13:59 - 2008-06-19 13:59 - 00167936 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2008-12-31 14:36 - 2008-12-31 14:36 - 00118272 _____ () C:\Windows\system32\atitmm64.dll
2008-11-26 17:12 - 2008-11-26 17:12 - 00074536 ____N () C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\Common\MCEMediaStatus64.dll
2009-05-18 03:43 - 2009-05-18 03:43 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2008-10-29 17:34 - 2008-10-29 17:34 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2013-03-13 02:05 - 2013-01-15 19:48 - 00348992 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 6\madExcept_.bpl
2013-03-13 02:05 - 2013-01-15 19:48 - 00183616 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 6\madBasic_.bpl
2013-03-13 02:05 - 2013-01-15 19:48 - 00051008 _____ () C:\Program Files (x86)\IObit\Advanced SystemCare 6\madDisAsm_.bpl
2008-12-25 13:41 - 2008-12-25 13:41 - 00881960 ____N () C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
2009-01-22 00:42 - 2008-12-17 17:11 - 00132480 _____ () C:\Program Files (x86)\SMINST\STWmiM.dll
2011-01-17 16:19 - 2011-06-21 22:34 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2008-11-26 17:13 - 2008-11-26 17:13 - 00263560 ____N () C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\CLCapEngine.dll
2008-11-26 17:13 - 2008-11-26 17:13 - 00038184 ____N () C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\CLCapSvcps.dll
2008-11-26 17:13 - 2008-11-26 17:13 - 00124288 ____N () C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\CLSchMgr.dll
2008-11-26 17:13 - 2008-11-26 17:13 - 00349480 ____N () C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\CLTinyDB.dll
2011-06-18 17:51 - 2011-06-14 01:52 - 03649592 _____ () C:\Program Files (x86)\Google\Chrome\Application\12.0.742.100\pdf.dll
2011-06-18 17:51 - 2011-06-14 01:52 - 00329272 _____ () C:\Program Files (x86)\Google\Chrome\Application\12.0.742.100\ppGoogleNaClPluginChrome.dll
2011-06-18 17:51 - 2011-06-14 01:50 - 01846344 _____ () C:\Program Files (x86)\Google\Chrome\Application\12.0.742.100\avcodec-52.dll
2011-06-18 17:51 - 2011-06-14 01:50 - 00104520 _____ () C:\Program Files (x86)\Google\Chrome\Application\12.0.742.100\avutil-50.dll
2011-06-18 17:51 - 2011-06-14 01:50 - 00203848 _____ () C:\Program Files (x86)\Google\Chrome\Application\12.0.742.100\avformat-52.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/25/2013 06:20:30 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung DelayLoad.exe, Version 6.0.0.2, Zeitstempel 0x508f635c, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18881, Zeitstempel 0x51da3e00, Ausnahmecode 0xc0000022, Fehleroffset 0x0006f52f,
Prozess-ID 0xc14, Anwendungsstartzeit DelayLoad.exe0.

Error: (10/25/2013 06:15:07 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (10/25/2013 06:10:39 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)

Error: (10/25/2013 06:10:38 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)

Error: (10/25/2013 06:10:37 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)

Error: (10/25/2013 06:10:37 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)

Error: (10/25/2013 06:10:37 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)

Error: (10/25/2013 06:10:36 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)

Error: (10/25/2013 06:10:36 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)

Error: (10/25/2013 06:10:36 PM) (Source: MsiInstaller) (User: Alexej-PC)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)


System errors:
=============
Error: (10/25/2013 06:20:39 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070005

Error: (10/25/2013 06:20:09 PM) (Source: Service Control Manager) (User: )
Description: Windows-Dienst für Schriftartencache%%5

Error: (10/25/2013 06:18:23 PM) (Source: Service Control Manager) (User: )
Description: Windows-BilderfassungShellhardwareerkennung%%1058

Error: (10/25/2013 06:18:23 PM) (Source: Service Control Manager) (User: )
Description: Google Update Service (gupdate)%%2

Error: (10/25/2013 06:17:32 PM) (Source: Print) (User: NT-AUTORITÄT)
Description: Der Druckspooler konnte den Drucker EPSON Stylus DX4000 Series nicht unter dem Namen EPSON Stylus DX4000 Series freigeben. Fehler: 2114. Der Drucker kann nicht von anderen Benutzern im Netzwerk verwendet werden.

Error: (10/25/2013 06:17:06 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (10/25/2013 06:15:53 PM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.

Error: (10/25/2013 06:03:00 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070005

Error: (10/25/2013 05:51:22 PM) (Source: WinDefend) (User: )
Description: Beim Laden der Signaturen wurde von %%%82527 ein Fehler festgestellt. Es wird versucht, einen als gültig bekannten Signatursatz wiederherzustellen.

	Versuchte Signaturen: %%%82524

	Fehlercode: 0x8050a001

	Fehlerbeschreibung: Das Programm kann keine Definitionsdateien finden, die dazu dienen, unerwünschte Software zu erkennen. Überprüfen Sie, ob aktualisierte Definitionsdateien vorhanden sind, und versuchen Sie es dann erneut. Weitere Informationen zum Installieren von Updates finden Sie unter "Hilfe und Support". 

	Ladende Signaturen: %%825

	Ladene Signaturversion: 1.161.421.0

	Ladende Modulversion: %%%825270

Error: (10/25/2013 05:50:29 PM) (Source: Service Control Manager) (User: )
Description: 30000LanmanServer


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-04-15 18:50:31.438
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_0f3cadd61ec3b22c\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:30.868
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_0f3cadd61ec3b22c\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:30.363
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_0f3cadd61ec3b22c\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:29.870
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_0f3cadd61ec3b22c\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:29.148
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_0efecf2c1ef1a5d7\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:28.669
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_0efecf2c1ef1a5d7\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:28.189
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_0efecf2c1ef1a5d7\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:27.637
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_0efecf2c1ef1a5d7\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:26.957
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_0f32e3e61ecadee9\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-15 18:50:26.477
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18311_none_0f32e3e61ecadee9\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 4092.25 MB
Available physical RAM: 2401.46 MB
Total Pagefile: 8359.78 MB
Available Pagefile: 6463.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:223.73 GB) (Free:158.85 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:12.03 GB) (Free:1.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (XP) (Fixed) (Total:230 GB) (Free:216.79 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5ABD451A)
Partition 1: (Active) - (Size=224 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=12 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=230 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

ComboFix 13-10-26.01 - Alexej 26.10.2013  14:23:56.1.2 - x64
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.4092.2115 [GMT 2:00]
ausgeführt von:: c:\users\Alexej\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alexej\avira_free_antivirus_de.exe
c:\windows\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-09-26 bis 2013-10-26  ))))))))))))))))))))))))))))))
.
.
2013-10-26 12:39 . 2013-10-26 12:39	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-10-26 12:23 . 2013-10-15 23:20	10280728	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{3721DBF1-E68A-4A50-9488-57A777FEA048}\mpengine.dll
2013-10-25 16:23 . 2013-10-25 16:23	--------	d-----w-	C:\FRST
2013-10-25 14:12 . 2013-10-25 14:12	--------	d-----w-	c:\users\Alexej\AppData\Roaming\Malwarebytes
2013-10-25 14:11 . 2013-10-25 14:11	--------	d-----w-	c:\programdata\Malwarebytes
2013-10-25 14:11 . 2013-10-25 15:45	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-10-23 14:48 . 2013-10-25 14:18	--------	d-----w-	c:\program files (x86)\Skype(223)
2013-10-17 12:44 . 2013-10-17 12:44	--------	d-----w-	c:\programdata\WindowsSearch
2013-10-13 10:45 . 2013-10-13 10:45	--------	d-----w-	C:\found.000
2013-10-11 09:13 . 2013-10-22 15:22	--------	d-----w-	c:\programdata\Avira
2013-10-10 05:34 . 2013-08-01 04:10	901568	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-10-10 05:34 . 2013-08-01 03:37	47104	----a-w-	c:\windows\system32\cdd.dll
2013-10-10 05:34 . 2013-08-29 07:48	2775552	----a-w-	c:\windows\system32\win32k.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-10 13:26 . 2006-11-02 12:35	80541720	----a-w-	c:\windows\system32\mrt.exe
2013-10-09 21:51 . 2012-08-02 08:52	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-10-09 21:51 . 2012-01-06 16:44	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-03 12:35 . 2009-10-03 04:06	278800	------w-	c:\windows\system32\MpSigStub.exe
2013-08-02 14:06 . 2013-08-28 05:38	1706496	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-08-02 04:09 . 2013-08-28 05:38	1548288	----a-w-	c:\windows\SysWow64\WMVDECOD.DLL
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B939CF93-F2CB-443d-956C-DC523D85C9DB}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}]
2012-02-28 08:31	87480	----a-w-	c:\progra~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}"= "c:\progra~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll" [2012-02-28 87480]
.
[HKEY_CLASSES_ROOT\clsid\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"HPAdvisor"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-08-26 1644088]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-10-02 20472992]
"Advanced SystemCare 6"="c:\program files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe" [2013-01-15 491840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-11-28 1148200]
"TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-12-25 1316136]
"CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-12-25 189736]
"TVAgent"="c:\program files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe" [2009-01-21 210216]
"UCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-11-14 218408]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-11-26 210216]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 323640]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-10-30 210216]
"HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2010-05-20 500792]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2012-02-03 103896]
.
c:\users\Alexej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Internet.lnk - c:\program files (x86)\FRITZ!DSL\FritzDsl.exe [2007-9-3 992560]
FRITZ!DSL Protect.lnk - c:\program files (x86)\FRITZ!DSL\FwebProt.exe [2007-9-7 1070384]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-6-19 994856]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll c:\progra~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	\0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files (x86)\IObit\Advanced SystemCare 6\ASCService.exe;c:\program files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Themes
ezSharedSvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14	451872	----a-w-	c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 21:51]
.
2013-10-25 c:\windows\Tasks\RMSchedule.job
- c:\program files (x86)\PC Tools Registry Mechanic\RegMech.exe [2012-04-03 11:34]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-03 442368]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll c:\progra~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.bearshare.net
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://mail.ru
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=401f3b9b0000000000000022fac147c8&tlver=1.4.19.19&affID=17160
IE: &AOL Toolbar-Suche - c:\programdata\AOL\ieToolbar\resources\de-DE\local\search.html
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
LSP: c:\program files (x86)\FRITZ!DSL\\sarah.dll
TCP: Interfaces\{E8D9E329-0D06-4AC5-AB72-523E3D9511DD}: NameServer = 62.109.121.2 62.109.121.1
FF - ProfilePath - c:\users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: content.notify.ontimer - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.switch.threshold - 750000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
Toolbar-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
Toolbar-10 - (no file)
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
Toolbar-10 - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SmartMenu - c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-GameSpy Arcade - c:\progra~2\GAMESP~1\UNWISE.EXE
AddRemove-GeoGebra - c:\program files (x86)\GeoGebra\UninstallerData\Uninstaller.exe
AddRemove-Origin - c:\program files (x86)\Origin\OriginUninstall.exe
AddRemove-Wincore MediaBar - c:\program files (x86)\BearShare Applications\MediaBar\uninstall.exe
AddRemove-{2A9F95AB-65A3-432c-8631-B8BC5BF7477A} - c:\program files (x86)\Electronic Arts\Die Schlacht um Mittelerde II\EAUninstall.exe
AddRemove-{3F290582-3F4E-4B96-009C-E0BABAA40C42} - c:\program files (x86)\EA GAMES\Die Schlacht um Mittelerde(tm)\EAUninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@SACL=
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
@SACL=
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@SACL=
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@SACL=
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Control]
@SACL=
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\EnableFullPage]
@SACL=
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories]
@SACL=
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@SACL=
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@SACL=
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Programmable]
@SACL=
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@SACL=
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@SACL=
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@SACL=
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@SACL=
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Control]
@SACL=
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@SACL=
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Programmable]
@SACL=
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@SACL=
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@SACL=
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@SACL=
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@SACL=
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@SACL=
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid]
@Denied: (A 2) (Everyone)
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@SACL=
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@SACL=
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@SACL=
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@SACL=
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@SACL=
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@SACL=
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\0v2*]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-10-26  14:44:41
ComboFix-quarantined-files.txt  2013-10-26 12:44
.
Vor Suchlauf: 8 Verzeichnis(se), 170.260.082.688 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 170.330.779.648 Bytes frei
.
- - End Of File - - 373DA00B4537DF5229CCF696F0AFDEE7
A36C5E4F47E84449FF07ED3517B43A31
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.26.06

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Alexej :: ALEXEJ-PC [Administrator]

Schutz: Deaktiviert

26.10.2013 19:59:19
mbam-log-2013-10-26 (19-59-19).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 204827
Laufzeit: 4 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (PUP.Optional.Datamngr.A) -> 2724 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 9
HKCR\CLSID\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E} (PUP.Optional.BearshareTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{1A42EA66-2898-4e93-8128-D9A450B27D1D} (PUP.Optional.BearshareTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{F0CF944C-F160-4F65-8F0A-2773322FF357} (PUP.Optional.BearshareTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{B8921CEC-8837-404A-B4C8-4DA63EF33C06} (PUP.Optional.BearshareTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\BearShareIEHelper.DNSGuard (PUP.Optional.BearshareTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\BearShareIEHelper.DNSGuard.1 (PUP.Optional.BearshareTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Systweak\RegClean Pro (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0N1Q1JtGyEtH1U1K1N1L1Y -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DATAMNGR (PUP.Optional.Datamngr.A) -> Daten: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs (PUP.Optional.BearshareTB.A) -> Bösartig: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) Gut: () -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 3
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1 (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\Partial Backups (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 10
C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (PUP.Optional.BearshareTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} (PUP.Optional.Searchqu.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (PUP.Optional.Datamngr.A) -> Löschen bei Neustart.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\ExcludeList.rcp (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\log_06-05-2011.log (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\log_06-06-2011.log (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\results.rcp (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\TempHLList.rcp (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\Partial Backups\00000001.rmx (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Alexej\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\Partial Backups\00000001.rxb (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

# AdwCleaner v3.010 - Bericht erstellt am 26/10/2013 um 20:24:06
# Updated 20/10/2013 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Benutzername : Alexej - ALEXEJ-PC
# Gestartet von : C:\Users\Alexej\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : ICQ Service

***** [ Dateien / Ordner ] *****

[!] Ordner Gelöscht : C:\ProgramData\~0
[!] Ordner Gelöscht : C:\ProgramData\boost_interprocess
[!] Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
[!] Ordner Gelöscht : C:\ProgramData\AlawarWrapper
[!] Ordner Gelöscht : C:\Program Files (x86)\Conduit
[!] Ordner Gelöscht : C:\Program Files (x86)\Mail.Ru
[!] Ordner Gelöscht : C:\Program Files (x86)\vghd
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Local\Mail.Ru
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Local\PackageAware
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\LocalLow\BabylonToolbar
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\LocalLow\Conduit
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\LocalLow\Mail.Ru
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\LocalLow\PriceGong
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\LocalLow\softonic-de3
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\LocalLow\softonic-de3
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\registry mechanic
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\Systweak
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\vghd
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Conduit
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\ICQToolbarData
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
[!] Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{C2D64FF7-0AB8-4263-89C9-EA3B0F8F050C}
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\ffxtlbr@babylon.com
[!] Ordner Gelöscht : C:\Users\Alexej\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Datei Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\.autoreg
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\bingp.xml
Datei Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\Conduit.xml
Datei Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\RegClean Pro

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\DiscoveryHelper.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GIFAnimator.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\IMTrProgress.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\IMWeb.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DnsBHO.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DnsBHO.BHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B939CF93-F2CB-443D-956C-DC523D85C9DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C2D64FF7-0AB8-4263-89C9-EA3B0F8F050C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B939CF93-F2CB-443D-956C-DC523D85C9DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2D64FF7-0AB8-4263-89C9-EA3B0F8F050C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B11A3F81-99AD-482A-BEB8-AFFC50A87B44}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C2D64FF7-0AB8-4263-89C9-EA3B0F8F050C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C2D64FF7-0AB8-4263-89C9-EA3B0F8F050C}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}
Schlüssel Gelöscht : HKCU\Software\BabylonChromeExtension
Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\softonic-de3
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\softonic-de3
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RegClean Pro_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de3 Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wincore MediaBar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\daemon tools toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\softonic-de3 Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wincore MediaBar
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16514

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant]

-\\ Mozilla Firefox v3.5.3 (de)

[ Datei : C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\prefs.js ]


-\\ Google Chrome v12.0.742.100

[ Datei : C:\Users\Alexej\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht : homepage

*************************

AdwCleaner[R0].txt - [13774 octets] - [26/10/2013 20:20:03]
AdwCleaner[S0].txt - [12153 octets] - [26/10/2013 20:24:06]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12214 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows (TM) Vista Home Premium x64
Ran by Alexej on 26.10.2013 at 20:32:09,60
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dt soft\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{7BD92223-3340-4218-B2DC-CAADA62C56BF}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B4F381CE-68D8-4179-A60A-797EC0C34865}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F1B4D8C9-25AD-46B4-B686-B02153FC18E7}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{7BD92223-3340-4218-B2DC-CAADA62C56BF}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B4F381CE-68D8-4179-A60A-797EC0C34865}



~~~ Files

Successfully deleted: [File] C:\Windows\Tasks\rmschedule.job



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Alexej\appdata\locallow\datamngr"
Successfully deleted: [Folder] "C:\Program Files (x86)\bearshare applications"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.10.2013 at 20:43:45,49
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01
Ran by Alexej (administrator) on ALEXEJ-PC on 26-10-2013 20:48:43
Running from C:\Users\Alexej\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
() C:\Program Files (x86)\SMINST\BLService.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(AVM Berlin) C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\SysWOW64\conime.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [914224 2008-11-18] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [442368 2009-06-03] (IDT, Inc.)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKCU\...\Run: [HPAdvisor] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-26] (Hewlett-Packard)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [Advanced SystemCare 6] - C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCTray.exe [491840 2013-01-15] (IObit)
HKCU\...\Policies\Explorer: [NoInstrumentation] 1
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-08-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DVDAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-11-28] (CyberLink Corp.)
HKLM-x32\...\Run: [TSMAgent] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1316136 2008-12-25] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer for HP TouchSmart] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-12-25] (CyberLink)
HKLM-x32\...\Run: [TVAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe [210216 2009-01-21] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [218408 2008-11-14] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2008-11-26] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2010-02-25] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-10-30] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Health Check Scheduler] - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75008 2008-10-09] (Hewlett-Packard)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-05-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552 2010-05-14] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-01-12] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SSDMonitor] - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [103896 2012-02-03] (PC Tools)
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-26] (Hewlett-Packard)
HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088 2009-08-26] (Hewlett-Packard)
AppInit_DLLs:   [1644088 2009-08-26] ()
Startup: C:\Users\Alexej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Alexej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe (AVM Berlin)
Startup: C:\Users\Alexej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru
URLSearchHook: HKCU - (No Name) - {09900DE8-1DCA-443F-9243-26FF581438AF} -  No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = 
SearchScopes: HKLM - {7BD92223-3340-4218-B2DC-CAADA62C56BF} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM - {B4F381CE-68D8-4179-A60A-797EC0C34865} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {BFF76C5E-CBC4-495C-B661-5C006E231FBD} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKLM-x32 - {BFF76C5E-CBC4-495C-B661-5C006E231FBD} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {13112CE7-A765-4298-8441-DF4E1C46C95E} URL = hxxp://go.mail.ru/search?lfilter=y&mailru=1&q={searchTerms}
SearchScopes: HKCU - {BFF76C5E-CBC4-495C-B661-5C006E231FBD} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - {E88E0043-C9D4-4e33-8555-FEE4F5B63060} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
BHO-x32: No Name - {7E853D72-626A-48EC-A868-BA8D5E23E045} -  No File
BHO-x32: No Name - {8984B388-A5BB-4DF7-B274-77B879E179DB} -  No File
BHO-x32: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Advanced SystemCare 6\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO-x32: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKLM-x32 - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
Toolbar: HKLM-x32 - No Name - {09900DE8-1DCA-443F-9243-26FF581438AF} -  No File
Toolbar: HKCU - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} -  No File
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
Winsock: Catalog5 08 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 01 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 02 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 03 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 15 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Tcpip\..\Interfaces\{E8D9E329-0D06-4AC5-AB72-523E3D9511DD}: [NameServer]62.109.121.2 62.109.121.1

FireFox:
========
FF ProfilePath: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @IObit.com/np_Asc_Plugin - C:\Program Files (x86)\IObit\Advanced SystemCare 6\BrowerProtect\np_Asc_plugin.dll (IObit)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.69 - C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.69 - C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=8 - C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\icqplugin.gif
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\icqplugin.src
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\mailru---.xml
FF SearchPlugin: C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\searchplugins\mailru.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\mailru.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\ascsurfingprotection@iobit.com
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\staged-xpis
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: No Name - C:\Users\Alexej\AppData\Roaming\Mozilla\Firefox\Profiles\47bgpcgt.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07}-trash
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Extension: (Lamborghini Sesto Elemento Theme) - C:\Users\Alexej\AppData\Local\Google\Chrome\User Data\Default\Extensions\dappigdjllcnkkoacaoolciaolaaiemb\1.0_0
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Alexej\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0
CHR HKLM-x32\...\Chrome\Extension: [nfengeggddojhakldhlpjdlddgkkjkdd] - C:\Program Files (x86)\IObit\Advanced SystemCare 6\BrowerProtect\ASC_GhromePluginFor6.crx

==================== Services (Whitelisted) =================

S2 AcronisOSSReinstallSvc; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2235448 2007-03-26] ()
R2 AdvancedSystemCareService6; C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [528192 2013-02-25] (IObit)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 IGDCTRL; C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE [87344 2007-09-04] (AVM Berlin)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [793048 2012-02-03] (PC Tools)
R2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365952 2008-12-17] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe [239104 2009-06-03] (IDT, Inc.)
R2 TVCapSvc; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2008-11-26] ()
R2 TVSched; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2008-11-26] ()
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [x]

==================== Drivers (Whitelisted) ====================

S1 Beep; No ImagePath
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [17720 2010-11-26] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-07-15] (Duplex Secure Ltd.)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2008-11-28] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U4 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-26 20:48 - 2013-10-26 20:48 - 01956160 _____ (Farbar) C:\Users\Alexej\Downloads\FRST64.exe
2013-10-26 20:48 - 2013-10-26 20:48 - 01956160 _____ (Farbar) C:\Users\Alexej\Desktop\FRST64.exe
2013-10-26 20:43 - 2013-10-26 20:43 - 00001942 _____ C:\Users\Alexej\Desktop\JRT.txt
2013-10-26 20:32 - 2013-10-26 20:32 - 00000000 ____D C:\Windows\ERUNT
2013-10-26 20:30 - 2013-10-26 20:30 - 01033335 _____ (Thisisu) C:\Users\Alexej\Downloads\JRT.exe
2013-10-26 20:19 - 2013-10-26 20:24 - 00000000 ____D C:\AdwCleaner
2013-10-26 20:18 - 2013-10-26 20:18 - 01060070 _____ C:\Users\Alexej\Downloads\adwcleaner.exe
2013-10-26 19:55 - 2013-10-26 19:55 - 00000966 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-26 19:55 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-26 19:54 - 2013-10-26 19:54 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Alexej\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-26 14:44 - 2013-10-26 14:44 - 00017980 _____ C:\ComboFix.txt
2013-10-26 14:20 - 2013-10-26 14:44 - 00000000 ____D C:\ComboFix
2013-10-26 14:20 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-26 14:20 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-26 14:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-26 14:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-26 14:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-26 14:20 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-26 14:20 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-26 14:20 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-26 14:19 - 2013-10-26 14:44 - 00000000 ____D C:\Qoobox
2013-10-26 14:19 - 2013-10-26 14:18 - 05136694 ____R (Swearware) C:\Users\Alexej\Desktop\ComboFix.exe
2013-10-26 14:18 - 2013-10-26 14:41 - 00000000 ____D C:\Windows\erdnt
2013-10-26 14:18 - 2013-10-26 14:18 - 05136694 ____R (Swearware) C:\Users\Alexej\Downloads\ComboFix.exe
2013-10-25 18:47 - 2013-10-25 18:47 - 00006299 _____ C:\Users\Alexej\Desktop\gege.txt
2013-10-25 18:29 - 2013-10-25 18:29 - 00377856 _____ C:\Users\Alexej\Downloads\gmer_2.1.19163.exe
2013-10-25 18:25 - 2013-10-25 18:26 - 00032314 _____ C:\Users\Alexej\Downloads\Addition.txt
2013-10-25 18:23 - 2013-10-25 18:23 - 00000000 ____D C:\FRST
2013-10-25 18:15 - 2013-10-25 18:15 - 00000584 _____ C:\Users\Alexej\Downloads\defogger_disable.log
2013-10-25 18:15 - 2013-10-25 18:15 - 00000020 _____ C:\Users\Alexej\defogger_reenable
2013-10-25 18:14 - 2013-10-25 18:14 - 00050477 _____ C:\Users\Alexej\Downloads\Defogger.exe
2013-10-25 18:12 - 2013-10-25 18:45 - 00000068 _____ C:\Windows\setupact.log
2013-10-25 18:12 - 2013-10-25 18:12 - 00000000 _____ C:\Windows\setuperr.log
2013-10-25 18:08 - 2013-10-25 18:08 - 01551008 _____ (Skype Technologies S.A.) C:\Users\Alexej\Downloads\SkypeSetup.exe
2013-10-25 16:12 - 2013-10-25 16:12 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\Malwarebytes
2013-10-25 16:11 - 2013-10-26 19:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-25 16:11 - 2013-10-25 16:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-23 16:48 - 2013-10-25 16:18 - 00000000 ____D C:\Program Files (x86)\Skype(223)
2013-10-22 17:32 - 2013-10-22 17:32 - 00000679 _____ C:\Users\Alexej\Documents\Uninstall STAR WARS The Old Republic.log
2013-10-22 17:24 - 2013-10-26 20:26 - 00020636 _____ C:\Windows\PFRO.log
2013-10-17 14:44 - 2013-10-17 14:44 - 00000000 ____D C:\ProgramData\WindowsSearch
2013-10-13 12:45 - 2013-10-13 12:45 - 00000000 ____D C:\found.000
2013-10-11 11:13 - 2013-10-22 17:22 - 00000000 ____D C:\ProgramData\Avira
2013-10-10 15:23 - 2013-09-22 17:43 - 17833984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 15:23 - 2013-09-22 17:01 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 15:23 - 2013-09-22 16:42 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 15:23 - 2013-09-22 16:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 15:23 - 2013-09-22 16:33 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-10 15:23 - 2013-09-22 16:33 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 15:23 - 2013-09-22 16:30 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-10 15:23 - 2013-09-22 16:27 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 15:23 - 2013-09-22 16:23 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-10 15:23 - 2013-09-22 16:22 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 15:23 - 2013-09-22 16:21 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-10 15:23 - 2013-09-22 16:19 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 15:23 - 2013-09-22 16:19 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 15:23 - 2013-09-22 16:16 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-10 15:23 - 2013-09-22 16:15 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 15:23 - 2013-09-22 16:07 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 15:23 - 2013-09-22 12:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-10 15:23 - 2013-09-22 12:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-10 15:23 - 2013-09-22 12:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-10 15:23 - 2013-09-22 12:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-10-10 15:23 - 2013-09-22 12:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-10 15:23 - 2013-09-22 12:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-10 15:23 - 2013-09-22 12:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-10-10 15:23 - 2013-09-22 12:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-10 15:23 - 2013-09-22 12:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-10-10 15:23 - 2013-09-22 12:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-10 15:23 - 2013-09-22 12:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-10-10 15:23 - 2013-09-22 12:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-10 15:23 - 2013-09-22 12:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-10 15:23 - 2013-09-22 12:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-10 15:23 - 2013-09-22 12:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-10-10 15:23 - 2013-09-22 11:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-10 07:34 - 2013-08-29 09:48 - 02775552 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 07:34 - 2013-08-01 06:10 - 00901568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 07:34 - 2013-08-01 05:37 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 01268224 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 00327680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 00287232 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-10 07:33 - 2013-08-27 05:39 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-10-10 07:33 - 2013-08-27 04:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-10-10 07:33 - 2013-08-27 04:32 - 02002944 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-10 07:33 - 2013-08-27 04:30 - 00566272 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-10 07:33 - 2013-08-27 04:06 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-10 07:33 - 2013-08-27 04:00 - 01556480 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-10 07:33 - 2013-08-27 04:00 - 01149952 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-10 07:33 - 2013-08-27 03:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-10-10 07:33 - 2013-08-27 03:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-10-10 07:33 - 2013-08-27 03:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-10-10 07:33 - 2013-08-27 03:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-10-10 07:33 - 2013-07-20 12:45 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 07:33 - 2013-07-20 12:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 07:33 - 2013-07-12 11:19 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\SET2963.tmp
2013-10-10 07:33 - 2013-07-04 06:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-10 07:33 - 2013-07-04 06:13 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 07:33 - 2013-07-03 04:55 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 07:33 - 2013-07-03 04:22 - 00031616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 07:33 - 2013-06-29 04:25 - 00007552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:33 - 2013-06-27 01:00 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 07:33 - 2013-06-04 06:16 - 00048128 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 07:33 - 2013-06-04 06:16 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-10 07:33 - 2013-06-04 04:01 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 07:33 - 2013-06-04 03:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-10 07:33 - 2011-05-05 16:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 07:33 - 2011-05-05 16:17 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

==================== One Month Modified Files and Folders =======

2013-10-26 20:50 - 2012-08-02 10:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-26 20:48 - 2013-10-26 20:48 - 01956160 _____ (Farbar) C:\Users\Alexej\Downloads\FRST64.exe
2013-10-26 20:48 - 2013-10-26 20:48 - 01956160 _____ (Farbar) C:\Users\Alexej\Desktop\FRST64.exe
2013-10-26 20:43 - 2013-10-26 20:43 - 00001942 _____ C:\Users\Alexej\Desktop\JRT.txt
2013-10-26 20:32 - 2013-10-26 20:32 - 00000000 ____D C:\Windows\ERUNT
2013-10-26 20:31 - 2009-05-18 03:36 - 02072696 _____ C:\Windows\WindowsUpdate.log
2013-10-26 20:30 - 2013-10-26 20:30 - 01033335 _____ (Thisisu) C:\Users\Alexej\Downloads\JRT.exe
2013-10-26 20:30 - 2009-01-22 00:48 - 00003578 _____ C:\Windows\System32\Tasks\HP Health Check
2013-10-26 20:26 - 2013-10-22 17:24 - 00020636 _____ C:\Windows\PFRO.log
2013-10-26 20:26 - 2009-07-22 21:25 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-26 20:26 - 2006-11-02 17:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-26 20:26 - 2006-11-02 17:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-26 20:26 - 2006-11-02 17:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-26 20:25 - 2009-05-18 03:36 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-10-26 20:25 - 2006-11-02 17:42 - 00032578 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-26 20:24 - 2013-10-26 20:19 - 00000000 ____D C:\AdwCleaner
2013-10-26 20:18 - 2013-10-26 20:18 - 01060070 _____ C:\Users\Alexej\Downloads\adwcleaner.exe
2013-10-26 20:17 - 2009-08-15 12:48 - 00000000 ____D C:\ProgramData\Skype
2013-10-26 20:12 - 2009-08-16 12:48 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\Skype
2013-10-26 20:09 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\tracing
2013-10-26 19:55 - 2013-10-26 19:55 - 00000966 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-26 19:55 - 2013-10-25 16:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-26 19:54 - 2013-10-26 19:54 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Alexej\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-26 14:44 - 2013-10-26 14:44 - 00017980 _____ C:\ComboFix.txt
2013-10-26 14:44 - 2013-10-26 14:20 - 00000000 ____D C:\ComboFix
2013-10-26 14:44 - 2013-10-26 14:19 - 00000000 ____D C:\Qoobox
2013-10-26 14:44 - 2006-11-02 15:33 - 00000000 __RHD C:\Users\Default
2013-10-26 14:41 - 2013-10-26 14:18 - 00000000 ____D C:\Windows\erdnt
2013-10-26 14:39 - 2006-11-02 14:34 - 00000215 _____ C:\Windows\system.ini
2013-10-26 14:38 - 2009-07-08 12:08 - 00000000 ____D C:\Users\Alexej
2013-10-26 14:18 - 2013-10-26 14:19 - 05136694 ____R (Swearware) C:\Users\Alexej\Desktop\ComboFix.exe
2013-10-26 14:18 - 2013-10-26 14:18 - 05136694 ____R (Swearware) C:\Users\Alexej\Downloads\ComboFix.exe
2013-10-26 14:09 - 2009-08-03 13:56 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\FRITZ!
2013-10-25 19:02 - 2012-04-04 19:00 - 00006376 _____ C:\Windows\SysWOW64\AppLog.log
2013-10-25 18:47 - 2013-10-25 18:47 - 00006299 _____ C:\Users\Alexej\Desktop\gege.txt
2013-10-25 18:45 - 2013-10-25 18:12 - 00000068 _____ C:\Windows\setupact.log
2013-10-25 18:29 - 2013-10-25 18:29 - 00377856 _____ C:\Users\Alexej\Downloads\gmer_2.1.19163.exe
2013-10-25 18:26 - 2013-10-25 18:25 - 00032314 _____ C:\Users\Alexej\Downloads\Addition.txt
2013-10-25 18:23 - 2013-10-25 18:23 - 00000000 ____D C:\FRST
2013-10-25 18:15 - 2013-10-25 18:15 - 00000584 _____ C:\Users\Alexej\Downloads\defogger_disable.log
2013-10-25 18:15 - 2013-10-25 18:15 - 00000020 _____ C:\Users\Alexej\defogger_reenable
2013-10-25 18:14 - 2013-10-25 18:14 - 00050477 _____ C:\Users\Alexej\Downloads\Defogger.exe
2013-10-25 18:12 - 2013-10-25 18:12 - 00000000 _____ C:\Windows\setuperr.log
2013-10-25 18:08 - 2013-10-25 18:08 - 01551008 _____ (Skype Technologies S.A.) C:\Users\Alexej\Downloads\SkypeSetup.exe
2013-10-25 17:45 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\Msdtc
2013-10-25 17:44 - 2006-11-02 14:33 - 75759616 _____ C:\Windows\system32\config\software_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 63176704 _____ C:\Windows\system32\config\components_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 22020096 _____ C:\Windows\system32\config\system_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 00057344 _____ C:\Windows\system32\config\sam_previous
2013-10-25 17:44 - 2006-11-02 14:33 - 00028672 _____ C:\Windows\system32\config\security_previous
2013-10-25 17:39 - 2012-04-03 22:01 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-10-25 17:39 - 2012-04-03 21:33 - 00000000 ____D C:\Windows\system32\Drivers\NSSx64
2013-10-25 17:39 - 2012-04-03 21:33 - 00000000 ____D C:\Program Files (x86)\Norton Security Scan
2013-10-25 17:39 - 2011-10-17 22:11 - 00000000 ____D C:\Program Files (x86)\TIOnline
2013-10-25 17:39 - 2011-06-01 09:46 - 00000000 ____D C:\ProgramData\IObit
2013-10-25 17:39 - 2010-09-13 21:51 - 00000000 ____D C:\Program Files (x86)\IObit
2013-10-25 17:39 - 2009-01-22 00:28 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-10-25 17:39 - 2009-01-22 00:28 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2013-10-25 17:39 - 2009-01-22 00:26 - 00000000 ____D C:\ProgramData\CyberLink
2013-10-25 17:39 - 2009-01-22 00:26 - 00000000 ____D C:\Program Files (x86)\CyberLink
2013-10-25 17:39 - 2009-01-21 23:53 - 00000000 ____D C:\ProgramData\WildTangent
2013-10-25 17:39 - 2009-01-21 23:53 - 00000000 ____D C:\Program Files (x86)\HP Games
2013-10-25 17:39 - 2009-01-21 23:26 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-25 17:39 - 2006-11-02 15:34 - 00000000 ____D C:\Windows\system32\spool
2013-10-25 17:39 - 2006-11-02 15:33 - 00000000 ____D C:\Windows\registration
2013-10-25 16:18 - 2013-10-23 16:48 - 00000000 ____D C:\Program Files (x86)\Skype(223)
2013-10-25 16:12 - 2013-10-25 16:12 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\Malwarebytes
2013-10-25 16:11 - 2013-10-25 16:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-24 18:17 - 2006-11-02 17:21 - 00024576 _____ C:\Windows\system32\umstartup.etl
2013-10-22 17:32 - 2013-10-22 17:32 - 00000679 _____ C:\Users\Alexej\Documents\Uninstall STAR WARS The Old Republic.log
2013-10-22 17:22 - 2013-10-11 11:13 - 00000000 ____D C:\ProgramData\Avira
2013-10-17 14:44 - 2013-10-17 14:44 - 00000000 ____D C:\ProgramData\WindowsSearch
2013-10-13 12:45 - 2013-10-13 12:45 - 00000000 ____D C:\found.000
2013-10-11 11:24 - 2009-01-22 00:21 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-11 11:20 - 2009-07-15 16:29 - 00000000 ____D C:\Program Files (x86)\Opera
2013-10-11 07:00 - 2009-01-22 07:00 - 00628992 _____ C:\Windows\system32\perfh007.dat
2013-10-11 07:00 - 2009-01-22 07:00 - 00126704 _____ C:\Windows\system32\perfc007.dat
2013-10-11 07:00 - 2006-11-02 14:46 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-10 15:56 - 2006-11-02 17:21 - 00335696 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 15:51 - 2012-09-14 20:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-10 15:31 - 2013-08-11 03:00 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 15:26 - 2006-11-02 14:35 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-09 23:51 - 2012-08-02 10:52 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-09 23:51 - 2012-08-02 10:52 - 00003736 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-09 23:51 - 2012-01-06 18:44 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-08 14:03 - 2009-08-25 14:29 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-10-05 01:46 - 2011-01-12 00:35 - 00000000 ____D C:\ProgramData\Guard.Mail.Ru
2013-10-02 09:00 - 2011-05-04 15:06 - 00000000 ____D C:\Users\Alexej\AppData\Roaming\HpUpdate

Some content of TEMP:
====================
C:\Users\Alexej\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-26 20:34

==================== End Of Log ============================
         

--- --- ---

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?