Fedpol Trojaner Kobik CH-Edition

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by SYSTEM on MINWINPC on 09-11-2013 20:37:11
Running from G:\
Windows Vista (TM) Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [SMSERIAL] - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [729088 2006-10-09] (Motorola Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [827392 2007-01-13] (Synaptics, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4390912 2007-03-09] (Realtek Semiconductor)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [174872 2007-02-12] (Intel Corporation)
HKLM\...\Run: [QPService] - C:\Program Files\HP\QuickPlay\QPService.exe [176128 2007-04-24] (CyberLink Corp.)
HKLM\...\Run: [QlbCtrl] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [159744 2007-02-13] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [HP Health Check Scheduler] - C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [50696 2007-03-12] (Hewlett-Packard)
HKLM\...\Run: [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [472776 2007-03-01] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [WAWifiMessage] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [317128 2007-01-11] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [CognizanceTS] - rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [39792 2008-10-15] (Adobe Systems Incorporated)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1564872 2012-06-06] (Ask)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [TkBellExe] - C:\Program Files\Real\RealPlayer\Update\realsched.exe [295512 2013-09-06] (RealNetworks, Inc.)
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44128 2006-11-08] (soft thinks)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Meinname Muehsam\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Meinname Muehsam\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2009-02-20] (Google Inc.)
HKU\Meinname Muehsam\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\wmpnscfg.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Meinname Muehsam\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-10-02] (Skype Technologies S.A.)
AppInit_DLLs: APSHook.dll [ 2006-07-13] (Cognizance Corporation)
Lsa: [Notification Packages] scecli ASWLNPkg
Startup: C:\Users\Meinname Muehsam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfdrodq4.lnk
ShortcutTarget: lfdrodq4.lnk -> C:\PROGRA~2\4qdordfl.dss (Shirley Plantation Corporation)

========================== Services (Whitelisted) =================

S2 ASBroker; c:\Program Files\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll [74240 2007-02-07] (Cognizance Corporation)
S2 ASChannel; c:\Program Files\Bioscrypt\VeriSoft\Bin\AsChnl.dll [131584 2006-06-22] (Cognizance Corporation)
S2 CLCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [262243 2007-04-24] ()
S2 CLSched; C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [106593 2007-04-24] ()
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-01-09] (Hewlett-Packard Development Company, L.P.)
S2 gupdate1ca44ff123a0d00; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-10-04] (Google Inc.)
S2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [62984 2007-03-14] (Hewlett-Packard)
S2 NIS; C:\Program Files\Norton Internet Security\Engine\20.4.0.40\diMaster.dll [556336 2013-05-29] (Symantec Corporation)
S2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 Winmgmt; C:\PROGRA~2\4qdordfl.dss [206848 2013-10-30] (Shirley Plantation Corporation)
S2 Automatisches LiveUpdate - Scheduler; "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [140424 2007-03-28] (AuthenTec, Inc.)
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20131101.003\BHDrvx86.sys [1096280 2013-10-23] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1404000.028\ccSetx86.sys [134744 2013-04-15] (Symantec Corporation)
S3 Dot4Scan; C:\Windows\System32\DRIVERS\Dot4Scan.sys [10752 2008-01-19] (Microsoft Corporation)
S1 eabfiltr; C:\Windows\System32\DRIVERS\eabfiltr.sys [8192 2006-11-30] (Hewlett-Packard Development Company, L.P.)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-08-27] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-08-27] (Symantec Corporation)
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20131107.001\IDSvix86.sys [393816 2013-10-28] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20131108.002\NAVENG.SYS [93272 2013-11-08] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20131108.002\NAVEX15.SYS [1612376 2013-11-08] (Symantec Corporation)
S3 SRTSP; C:\Windows\system32\drivers\NIS\1404000.028\SRTSP.SYS [603224 2013-05-15] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1404000.028\SRTSPX.SYS [32344 2013-03-04] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NIS\1404000.028\SYMDS.SYS [367704 2013-05-20] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1404000.028\SYMEFA.SYS [934488 2013-05-22] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2013-07-21] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1404000.028\Ironx86.SYS [175264 2012-07-27] (Symantec Corporation)
S1 SYMTDIv; C:\Windows\system32\drivers\NIS\1404000.028\SYMTDIV.SYS [352344 2013-04-24] (Symantec Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-09 20:36 - 2013-11-09 20:36 - 00000000 ____D C:\FRST
2013-11-09 11:09 - 2013-11-09 11:09 - 00000000 ____D C:\Windows\pss
2013-11-08 22:32 - 2013-11-08 22:32 - 00001889 _____ C:\Users\Public\Desktop\Adobe Reader 8.lnk
2013-11-08 22:32 - 2013-11-08 22:32 - 00001889 _____ C:\ProgramData\Desktop\Adobe Reader 8.lnk
2013-10-30 17:45 - 2013-10-30 17:50 - 00000285 _____ C:\ProgramData\lfdrodq4.reg
2013-10-30 17:44 - 2013-11-09 19:49 - 95025368 ____T C:\ProgramData\lfdrodq4.bxx
2013-10-30 17:44 - 2013-11-09 19:49 - 00000000 _____ C:\ProgramData\lfdrodq4.fvv
2013-10-30 17:44 - 2013-10-30 17:44 - 00206848 _____ (Shirley Plantation Corporation) C:\ProgramData\4qdordfl.dss
2013-10-11 21:54 - 2013-09-22 11:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-10-11 21:54 - 2013-09-22 11:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-10-11 21:54 - 2013-09-22 11:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-10-11 21:54 - 2013-09-22 11:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-10-11 21:54 - 2013-09-22 11:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-10-11 21:54 - 2013-09-22 11:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-10-11 21:54 - 2013-09-22 11:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-10-11 21:54 - 2013-09-22 11:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-10-11 21:54 - 2013-09-22 11:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-10-11 21:54 - 2013-09-22 11:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-10-11 21:54 - 2013-09-22 11:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-10-11 21:54 - 2013-09-22 11:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-10-11 21:54 - 2013-09-22 11:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-10-11 21:54 - 2013-09-22 11:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-10-11 21:54 - 2013-09-22 11:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-10-11 21:54 - 2013-09-22 10:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-10-11 20:05 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-10-11 20:05 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-10-11 20:05 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-10-11 20:05 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-10-11 20:05 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-10-11 20:05 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-10-11 20:05 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-10-11 20:05 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-10-11 20:05 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-10-11 20:05 - 2013-08-01 04:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-10-11 20:05 - 2013-08-01 03:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\System32\cdd.dll
2013-10-11 20:04 - 2013-08-29 08:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-10-11 20:04 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2013-10-11 20:03 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
2013-10-11 20:03 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
2013-10-11 20:03 - 2013-06-29 03:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
2013-10-11 20:03 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys
2013-10-11 20:03 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
2013-10-11 20:03 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
2013-10-11 20:02 - 2013-07-12 10:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbvideo.sys
2013-10-11 20:02 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys
2013-10-11 20:01 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\System32\comctl32.dll
2013-10-11 20:01 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\System32\atmlib.dll
2013-10-11 20:01 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2013-10-11 19:59 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidparse.sys

==================== One Month Modified Files and Folders =======

2013-11-09 20:36 - 2013-11-09 20:36 - 00000000 ____D C:\FRST
2013-11-09 19:54 - 2009-12-04 16:12 - 00032726 _____ C:\ProgramData\nvModes.dat
2013-11-09 19:54 - 2009-12-04 16:12 - 00032726 _____ C:\ProgramData\nvModes.001
2013-11-09 19:54 - 2008-03-02 07:17 - 01413366 _____ C:\Windows\WindowsUpdate.log
2013-11-09 19:53 - 2010-01-14 14:42 - 00000000 ____D C:\Users\Meinname Muehsam\AppData\Local\CrashDumps
2013-11-09 19:53 - 2007-06-28 07:34 - 00000148 _____ C:\Users\Public\Documents\hpqp.ini
2013-11-09 19:50 - 2007-06-28 07:51 - 00000000 ____D C:\Windows\SMINST
2013-11-09 19:49 - 2013-10-30 17:44 - 95025368 ____T C:\ProgramData\lfdrodq4.bxx
2013-11-09 19:49 - 2013-10-30 17:44 - 00000000 _____ C:\ProgramData\lfdrodq4.fvv
2013-11-09 19:49 - 2006-11-02 13:47 - 00003168 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-09 19:49 - 2006-11-02 13:47 - 00003168 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-09 19:01 - 2008-05-03 19:24 - 00000680 _____ C:\Users\Meinname Muehsam\AppData\Local\d3d9caps.dat
2013-11-09 17:20 - 2008-03-02 07:17 - 00000012 _____ C:\Windows\bthservsdp.dat
2013-11-09 16:14 - 2006-11-02 13:52 - 00076117 _____ C:\Windows\setupact.log
2013-11-09 15:49 - 2008-04-14 19:38 - 00000000 ____D C:\Users\Meinname Muehsam\AppData\Roaming\Skype
2013-11-09 11:09 - 2013-11-09 11:09 - 00000000 ____D C:\Windows\pss
2013-11-08 22:32 - 2013-11-08 22:32 - 00001889 _____ C:\Users\Public\Desktop\Adobe Reader 8.lnk
2013-11-08 22:32 - 2013-11-08 22:32 - 00001889 _____ C:\ProgramData\Desktop\Adobe Reader 8.lnk
2013-10-30 21:29 - 2010-10-12 20:04 - 00000000 ____D C:\Users\Meinname Muehsam\Documents\Sohn1
2013-10-30 21:27 - 2012-10-13 20:27 - 00000000 ____D C:\Users\Meinname Muehsam\Documents\Sohn2
2013-10-30 21:21 - 2009-05-29 10:55 - 00000000 ____D C:\Users\Meinname Muehsam\Documents\Sohn3
2013-10-30 17:50 - 2013-10-30 17:45 - 00000285 _____ C:\ProgramData\lfdrodq4.reg
2013-10-30 17:44 - 2013-10-30 17:44 - 00206848 _____ (Shirley Plantation Corporation) C:\ProgramData\4qdordfl.dss
2013-10-30 17:39 - 2011-12-17 22:49 - 00000000 ____D C:\Users\Meinname Muehsam\Documents\Stellenbewerbung Meinname
2013-10-30 17:36 - 2006-11-02 11:33 - 01559094 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-29 14:32 - 2007-06-28 07:27 - 00847276 _____ C:\Windows\PFRO.log
2013-10-17 20:16 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-17 12:47 - 2010-08-07 20:13 - 00000000 ___RD C:\Program Files\Skype
2013-10-17 12:47 - 2008-04-14 19:38 - 00000000 ____D C:\ProgramData\Skype
2013-10-12 15:27 - 2006-11-02 13:47 - 00379288 _____ C:\Windows\System32\FNTCACHE.DAT
2013-10-12 15:16 - 2009-10-11 15:14 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-11 22:02 - 2013-08-17 21:57 - 00000000 ____D C:\Windows\System32\MRT
2013-10-11 21:59 - 2006-11-02 11:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-10-10 20:41 - 2012-04-22 16:52 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-10-10 20:41 - 2011-05-17 12:35 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\ProgramData\4qdordfl.dss
C:\ProgramData\lfdrodq4.reg
C:\Users\Meinname Muehsam\ptw12.exe


Some content of TEMP:
====================
C:\Users\Meinname Muehsam\AppData\Local\Temp\ApnStub.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\contentDATs.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FlashLockV222.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FlashPlayerUpdate04.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FlashPlayerUpdate05.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\HPQSi.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\i4jdel0.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\install_flashplayer11x32axau_gtbp_chra_aih.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u13-windows-i586-p-iftw.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u15-windows-i586-iftw.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u19-windows-i586-iftw-rv.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u5-windows-i586-p-iftw_1b121abb.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-6u7-windows-i586-p-iftw_bdb28397.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\msg50DD.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\msg9667.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\msgB56D.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\setup.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\stubhelper.dll
C:\Users\Meinname Muehsam\AppData\Local\Temp\symcdefsv5i32.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\SymLCSVC.EXE
C:\Users\Meinname Muehsam\AppData\Local\Temp\{B6FB8E67-4C38-4968-8D3A-F28243F6A827}-25.0.1364.97_24.0.1312.57_chrome_updater.exe
C:\Users\Meinname Muehsam\AppData\Local\Temp\~tmf2920084987192213550.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

6
Restore point made on: 2013-08-27 20:50:55
Restore point made on: 2013-09-12 19:47:04
Restore point made on: 2013-09-12 21:07:30
Restore point made on: 2013-10-11 21:36:43
Restore point made on: 2013-10-30 23:53:50
Restore point made on: 2013-11-09 13:55:23

==================== Memory info =========================== 

Percentage of memory in use: 26%
Total physical RAM: 2045.81 MB
Available physical RAM: 1505.34 MB
Total Pagefile: 1775.55 MB
Available Pagefile: 1589.81 MB
Total Virtual: 2047.88 MB
Available Virtual: 1959.38 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:141.62 GB) (Free:61.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:149.05 GB) (Free:148.58 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:7.43 GB) (Free:2.5 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:0.12 GB) (Free:0.12 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: F0CFFAAE)
Partition 1: (Active) - (Size=142 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 149 GB) (Disk ID: FA2A057A)
Partition 1: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 124 MB) (Disk ID: 008497C9)
Partition 1: (Active) - (Size=124 MB) - (Type=0B)


LastRegBack: 2013-11-09 19:56

==================== End Of Log ============================