Rvzr-a.akamaihd.net Infektion

oliver68 · 25.11.2013, 19:23

Hallo Trojaner-Board,

ich habe mir offensichtlich irgendwas eingefangen, dass immer wieder Seiten mit den Adressen rvzr-a.akamaihd.net und mit Werbung nervt und mich auf nicht gewünschte Webseiten umleitet.

Im Voraus vielen Dank für die Unterstützung.

Folgende Logs wurden von mir erstellt, leider sind die Malwarebytes Anti-Malware logs(auch nur einer) zu groß, um sie hier darstellen zu können.

1. Defogger:

Code:

ATTFilter

defogger_enable by jpshortstuff (23.02.10.1)
Log created at 00:09 on 24/11/2013 (gloeckno)

Parsing file...


-=E.O.F=-

2.FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013
Ran by gloeckno (administrator) on GAMES-PC on 24-11-2013 17:59:28
Running from C:\Users\gloeckno\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(COMPANYVERS_NAME) C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
(Akamai Technologies, Inc.) C:\Users\gloeckno\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\gloeckno\AppData\Local\Akamai\netsession_win.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
() C:\Users\gloeckno\AppData\Roaming\BrowserCompanion\tbhcn.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Nokia) C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2184520 2009-07-27] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-03-18] (CANON INC.)
HKCU\...\Run: [360desktop] - C:\Program Files\360desktop\360desktop.exe [1411912 2009-11-06] (360desktop Pty. Ltd.)
HKCU\...\Run: [NokiaOviSuite2] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [724536 2011-05-20] (Nokia)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\gloeckno\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [KiesHelper] - C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe [954256 2012-03-31] (Samsung)
MountPoints2: {c27654c3-1503-11df-8833-806e6f6e6963} - E:\start.exe /checksection
HKLM-x32\...\Run: [TrayServer] - C:\Program Files (x86)\MAGIX\Video_deluxe_16_Premium\Trayserver.exe [90112 2008-08-07] (MAGIX AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NokiaMServer] - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [1807360 2011-10-19] (Dominik Reichl)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3521424 2012-03-31] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573584 2012-10-19] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKU\Ines\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2012-03-31] ()
AppInit_DLLs:   [ ] ()
Startup: C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk
ShortcutTarget: tbhcn.lnk -> C:\Users\gloeckno\AppData\Roaming\BrowserCompanion\tbhcn.exe ()
Startup: C:\Users\Ines\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x159C434598D9CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://do-search.com/?type=hp&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://do-search.com/?type=hp&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: HKCU - (No Name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No File
URLSearchHook: HKCU - (No Name) - {0696f815-a3a9-490a-bb14-9ec3350b1276} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll (MindSpark)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
SearchScopes: HKLM-x32 - {a5b9c0f5-5616-47cd-a95f-e43b488faccf} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm284YYde&ptnrS=XPxdm284YYde&si=CK3hkZqC8rICFQFf3godiWMAhw&ptb=42A1EE84-89E2-46BF-999A-E1549F086ED3&psa=&ind=2013071511&st=sb&n=77fd0897&searchfor={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0E5ABC7D-9EB0-44DA-ABC9-21BCBA389C39} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=434061ef-025a-4586-8d56-4a92943000d0&apn_sauid=1D47B571-E9C6-4695-883D-D8750CD994CB
SearchScopes: HKCU - {a5b9c0f5-5616-47cd-a95f-e43b488faccf} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm284YYde&ptnrS=XPxdm284YYde&si=CK3hkZqC8rICFQFf3godiWMAhw&ptb=42A1EE84-89E2-46BF-999A-E1549F086ED3&psa=&ind=2013071511&st=sb&n=77fd0897&searchfor={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb164/?search={searchTerms}&loc=IB_DS&a=6PQDwZs8jd&i=26
SearchScopes: HKCU - {EA151A6A-8138-4779-B8E5-91CCDC013070} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Search Assistant BHO - {5d79f641-c168-40df-a32f-bacea7509e75} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll (MindSpark)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Toolbar BHO - {cb41fc95-f1b3-4797-8bb6-1012ff62abba} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - TelevisionFanatic - {c98d5b61-b0ea-4d48-9839-1079d352d880} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {C98D5B61-B0EA-4D48-9839-1079D352D880} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default
FF user.js: detected! => C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\user.js
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://do-search.com/?type=hp&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524
FF NetworkProxy: "no_proxies_on", "*.local"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @TelevisionFanatic.com/Plugin - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\NP64Stub.dll (MindSpark)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @autodesk.com/DWF - c:\Program Files (x86)\Autodesk\Autodesk Design Review Firefox Add-on v1.1\npADRdwf.dll (Autodesk)
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\do-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Feven 1.5 - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com
FF Extension: TelevisionFanatic - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\64ffxtbr@TelevisionFanatic.com
FF Extension: DealPly  Shopping - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\addon@dealplyshopping.com
FF Extension: Browser Companion Helper - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\bbrs_002@blabbers.com
FF Extension: Flash and Video Download - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
FF Extension: toolbar - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\toolbar@web.de.xpi
FF Extension: ImTranslator - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: Adblock Plus - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM-x32\...\Firefox\Extensions: [64ffxtbr@TelevisionFanatic.com] - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin
FF Extension: TelevisionFanatic - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR Extension: (Feven 1.5) - C:\Users\gloeckno\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg\1.25.48_0
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx
CHR HKLM-x32\...\Chrome\Extension: [bodddioamolcibagionmmobehnbhiakf] - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R3 Blackberry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-02-10] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
R2 TelevisionFanaticService; C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe [42504 2012-10-08] (COMPANYVERS_NAME)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2144056 2013-10-22] (TuneUp Software)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [78336 2013-01-03] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-02-09] (TuneUp Software)
S3 ATICDSDr; \??\C:\Users\gloeckno\AppData\Local\Temp\ATICDSDr.sys [x]
U3 fwtoqpow; \??\C:\Users\gloeckno\AppData\Local\Temp\fwtoqpow.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-24 17:59 - 2013-11-24 17:59 - 00023287 _____ C:\Users\gloeckno\Downloads\FRST.txt
2013-11-24 17:59 - 2013-11-24 17:59 - 00000000 ____D C:\FRST
2013-11-24 17:58 - 2013-11-24 17:58 - 01958440 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST64.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00680560 _____ C:\Users\gloeckno\Downloads\ZipExtractorSetup.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00001182 _____ C:\Users\Ines\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:57 - 2013-11-24 17:57 - 00001158 _____ C:\Users\gloeckno\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:54 - 2013-11-24 17:54 - 01091583 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST.exe
2013-11-24 17:52 - 2013-11-24 17:52 - 105952601 _____ C:\Windows\SysWOW64\�鈯蹬ˆ
2013-11-24 17:38 - 2013-11-24 17:38 - 00000000 ____D C:\Users\gloeckno\Desktop\log files
2013-11-24 17:24 - 2013-11-24 17:24 - 00000000 _____ C:\Users\gloeckno\Desktop\test.log
2013-11-24 17:23 - 2013-11-24 17:23 - 00000000 _____ C:\Users\gloeckno\Desktop\GMER_3rd party scan 2013-11-24_17_23.txt
2013-11-24 00:20 - 2013-11-24 00:20 - 00377856 _____ C:\Users\gloeckno\Downloads\llikksn3.exe
2013-11-24 00:10 - 2013-11-24 00:10 - 00000000 _____ C:\Users\gloeckno\defogger_reenable
2013-11-24 00:09 - 2013-11-24 17:34 - 00000478 _____ C:\Users\gloeckno\Downloads\defogger_disable.log
2013-11-24 00:07 - 2013-11-24 00:07 - 00050477 _____ C:\Users\gloeckno\Downloads\Defogger.exe
2013-11-23 16:34 - 2013-11-23 23:55 - 00068912 _____ C:\Windows\PFRO.log
2013-11-23 11:59 - 2013-11-23 11:59 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-23 11:59 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-23 11:45 - 2013-11-23 11:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\gloeckno\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-23 10:24 - 2013-11-23 10:24 - 00002270 _____ C:\Users\gloeckno\Desktop\SpyHunter.lnk
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\sh4ldr
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 _____ C:\autoexec.bat
2013-11-23 10:24 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-11-23 10:23 - 2013-11-23 10:24 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-11-23 10:19 - 2013-11-23 10:19 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\gloeckno\Downloads\SpyHunter-Installer.exe
2013-11-23 00:37 - 2013-11-23 00:37 - 105792079 _____ C:\Windows\SysWOW64\䱀讻蹬B
2013-11-20 23:37 - 2013-11-20 23:37 - 00002218 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-11-20 23:37 - 2013-11-20 23:37 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-20 23:02 - 2013-11-24 00:13 - 00000336 _____ C:\Windows\setupact.log
2013-11-19 22:29 - 2013-11-19 22:30 - 00000000 ____D C:\Users\gloeckno\Documents\26_Urlaub USA
2013-11-18 23:42 - 2013-11-18 23:42 - 06430443 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule_1.5.3.exe
2013-11-18 23:16 - 2013-11-18 23:17 - 56444792 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_video_dlx_16_premium_9.0.8.2_d.exe
2013-11-18 23:15 - 2013-11-18 23:15 - 04589046 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule.exe
2013-11-18 21:04 - 2013-11-18 21:04 - 00028672 _____ C:\Users\gloeckno\Downloads\90621_A846-EE34-0703-911D-E9D2-0806-E6F6-E696-3K6K.exe
2013-11-17 20:03 - 2013-11-20 23:37 - 00000000 ____D C:\Users\gloeckno\AppData\Local\Google
2013-11-17 20:03 - 2013-11-19 19:45 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-11-17 20:03 - 2013-11-18 20:41 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-11-17 20:03 - 2013-11-17 20:03 - 00003524 _____ C:\Windows\System32\Tasks\DealPly
2013-11-17 20:03 - 2013-11-17 20:03 - 00003372 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-11-17 15:34 - 2013-11-18 19:15 - 00000000 ____D C:\Program Files (x86)\Lupas Rename 2000
2013-11-17 15:34 - 2013-11-17 15:34 - 00760986 _____ (Ivan Anton Albarracin                                       ) C:\Users\gloeckno\Downloads\lupasrename.exe
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\Ines\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\gloeckno\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:08 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 15:08 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 15:08 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-17 15:08 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-17 15:08 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-17 15:08 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-17 15:08 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 15:08 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-17 15:08 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-17 15:08 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-16 10:58 - 2013-11-16 11:43 - 00000000 ____D C:\Program Files\VirtualDub-1.10.4-AMD64
2013-11-16 10:55 - 2013-11-16 10:55 - 02209528 _____ C:\Users\gloeckno\Downloads\VirtualDub-1.10.4-AMD64.zip
2013-11-16 10:53 - 2013-11-16 10:53 - 00618912 _____ C:\Users\gloeckno\Downloads\VirtualDub 64 Bit - CHIP-Downloader.exe
2013-11-16 00:33 - 2013-11-16 00:33 - 00003188 _____ C:\Windows\System32\Tasks\{6C6B0F20-1380-4B34-955A-CFEC9F5EC3D5}
2013-11-16 00:32 - 2013-11-16 00:32 - 01053496 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\virtualdubplugins_basispaket_de.exe
2013-11-16 00:04 - 2013-11-16 00:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 00:52 - 2013-11-15 00:52 - 00000000 ____D C:\Program Files (x86)\AdorageI-SAL
2013-11-15 00:52 - 2013-11-15 00:49 - 00520192 _____ (proDAD GmbH) C:\Windows\SysWOW64\prodad-codec.dll
2013-11-15 00:52 - 2013-11-15 00:49 - 00321088 _____ (proDAD GmbH) C:\Windows\SysWOW64\proDAD-PA-Support.dll
2013-11-15 00:51 - 2013-11-15 00:51 - 00000000 ____D C:\ProgramData\proDAD
2013-11-15 00:49 - 2013-11-15 00:53 - 00051418 _____ C:\adorage-protocol.txt
2013-11-15 00:34 - 2013-11-15 00:53 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\proDAD
2013-11-15 00:34 - 2013-11-15 00:34 - 00000000 ____D C:\Program Files (x86)\proDAD
2013-11-14 20:44 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 20:44 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 20:44 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 20:44 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 20:44 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 20:44 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 20:44 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 20:44 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 20:44 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 20:44 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 20:44 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 20:44 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 20:44 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 20:44 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 20:44 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 20:44 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 20:44 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 20:44 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 20:44 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 20:44 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 20:44 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 20:44 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 20:44 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 20:44 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 20:44 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 20:44 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 20:44 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 20:44 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 20:44 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 20:44 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 00:55 - 2013-11-19 18:36 - 00003900 _____ C:\Windows\System32\Tasks\Philips-Online-Aktualisierungsprogramm
2013-11-11 20:52 - 2013-11-11 20:52 - 00000000 ____D C:\Users\gloeckno\Documents\Philips Intelligent Agent
2013-11-11 20:51 - 2013-11-11 20:53 - 00001189 _____ C:\Users\Public\Desktop\Philips Intelligent Agent.lnk
2013-11-11 20:50 - 2013-11-11 20:50 - 01526952 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Intelligent_Agent_2.1_Setup.exe
2013-11-11 20:39 - 2013-11-11 20:39 - 00001347 _____ C:\Users\gloeckno\Desktop\Verwalten SPD8020-7EB3EF.lnk
2013-11-11 20:39 - 2013-11-11 20:39 - 00001191 _____ C:\Users\gloeckno\Desktop\Durchsuchen SPD8020-7EB3EF.lnk
2013-11-11 19:58 - 2013-11-11 20:53 - 00000000 ____D C:\ProgramData\Philips
2013-11-11 19:58 - 2013-11-11 20:51 - 00000000 ____D C:\Program Files (x86)\Philips
2013-11-11 19:58 - 2013-11-11 19:58 - 00001239 _____ C:\Users\Public\Desktop\Philips network storage wizard.lnk
2013-11-11 19:57 - 2013-11-11 19:57 - 01497416 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Network_Storage_Wizard_1.2_Setup.exe
2013-11-10 17:55 - 2013-11-10 17:55 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-10 17:54 - 2013-11-10 17:55 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-10 17:54 - 2013-11-10 17:55 - 00000000 ____D C:\Program Files\iTunes
2013-11-10 17:54 - 2013-11-10 17:55 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-10 17:54 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2013-11-24 17:59 - 2013-11-24 17:59 - 00023287 _____ C:\Users\gloeckno\Downloads\FRST.txt
2013-11-24 17:59 - 2013-11-24 17:59 - 00000000 ____D C:\FRST
2013-11-24 17:58 - 2013-11-24 17:58 - 01958440 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST64.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00680560 _____ C:\Users\gloeckno\Downloads\ZipExtractorSetup.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00001182 _____ C:\Users\Ines\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:57 - 2013-11-24 17:57 - 00001158 _____ C:\Users\gloeckno\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:57 - 2009-07-14 05:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-24 17:57 - 2009-07-14 05:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-24 17:54 - 2013-11-24 17:54 - 01091583 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST.exe
2013-11-24 17:54 - 2012-07-15 11:44 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\BrowserCompanion
2013-11-24 17:52 - 2013-11-24 17:52 - 105952601 _____ C:\Windows\SysWOW64\�鈯蹬ˆ
2013-11-24 17:52 - 2010-02-08 23:49 - 01976925 _____ C:\Windows\WindowsUpdate.log
2013-11-24 17:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-11-24 17:38 - 2013-11-24 17:38 - 00000000 ____D C:\Users\gloeckno\Desktop\log files
2013-11-24 17:34 - 2013-11-24 00:09 - 00000478 _____ C:\Users\gloeckno\Downloads\defogger_disable.log
2013-11-24 17:27 - 2012-07-06 06:57 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-24 17:24 - 2013-11-24 17:24 - 00000000 _____ C:\Users\gloeckno\Desktop\test.log
2013-11-24 17:23 - 2013-11-24 17:23 - 00000000 _____ C:\Users\gloeckno\Desktop\GMER_3rd party scan 2013-11-24_17_23.txt
2013-11-24 00:20 - 2013-11-24 00:20 - 00377856 _____ C:\Users\gloeckno\Downloads\llikksn3.exe
2013-11-24 00:19 - 2009-07-14 18:58 - 00664618 _____ C:\Windows\system32\perfh007.dat
2013-11-24 00:19 - 2009-07-14 18:58 - 00134786 _____ C:\Windows\system32\perfc007.dat
2013-11-24 00:19 - 2009-07-14 06:13 - 01527740 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-24 00:13 - 2013-11-20 23:02 - 00000336 _____ C:\Windows\setupact.log
2013-11-24 00:13 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-24 00:10 - 2013-11-24 00:10 - 00000000 _____ C:\Users\gloeckno\defogger_reenable
2013-11-24 00:10 - 2010-02-08 23:55 - 00000000 ____D C:\Users\gloeckno
2013-11-24 00:07 - 2013-11-24 00:07 - 00050477 _____ C:\Users\gloeckno\Downloads\Defogger.exe
2013-11-23 23:55 - 2013-11-23 16:34 - 00068912 _____ C:\Windows\PFRO.log
2013-11-23 23:53 - 2012-09-18 07:21 - 00000000 ____D C:\Windows\SysWOW64\WNLT
2013-11-23 19:24 - 2010-04-15 20:24 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{1C7ECCFC-09AD-48A2-944A-0E2E2CD2AF35}
2013-11-23 16:34 - 2013-10-20 19:45 - 00000000 ____D C:\Windows\SysWOW64\jmdp
2013-11-23 16:32 - 2013-04-11 07:46 - 00000000 ____D C:\Windows\SysWOW64\ARFC
2013-11-23 11:59 - 2013-11-23 11:59 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-23 11:45 - 2013-11-23 11:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\gloeckno\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-23 10:24 - 2013-11-23 10:24 - 00002270 _____ C:\Users\gloeckno\Desktop\SpyHunter.lnk
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\sh4ldr
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 _____ C:\autoexec.bat
2013-11-23 10:24 - 2013-11-23 10:23 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-11-23 10:19 - 2013-11-23 10:19 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\gloeckno\Downloads\SpyHunter-Installer.exe
2013-11-23 00:37 - 2013-11-23 00:37 - 105792079 _____ C:\Windows\SysWOW64\䱀讻蹬B
2013-11-20 23:37 - 2013-11-20 23:37 - 00002218 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-11-20 23:37 - 2013-11-20 23:37 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-20 23:37 - 2013-11-17 20:03 - 00000000 ____D C:\Users\gloeckno\AppData\Local\Google
2013-11-19 22:30 - 2013-11-19 22:29 - 00000000 ____D C:\Users\gloeckno\Documents\26_Urlaub USA
2013-11-19 20:02 - 2011-07-13 22:42 - 00213504 ___SH C:\Users\gloeckno\Desktop\Thumbs.db
2013-11-19 19:49 - 2010-02-10 23:07 - 00000000 ____D C:\Windows\system32\appmgmt
2013-11-19 19:47 - 2010-02-10 22:56 - 00000000 ____D C:\Windows\UltraDefrag
2013-11-19 19:45 - 2013-11-17 20:03 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-11-19 19:45 - 2010-02-08 23:56 - 00000000 ___RD C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-19 18:36 - 2013-11-13 00:55 - 00003900 _____ C:\Windows\System32\Tasks\Philips-Online-Aktualisierungsprogramm
2013-11-18 23:42 - 2013-11-18 23:42 - 06430443 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule_1.5.3.exe
2013-11-18 23:17 - 2013-11-18 23:16 - 56444792 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_video_dlx_16_premium_9.0.8.2_d.exe
2013-11-18 23:15 - 2013-11-18 23:15 - 04589046 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule.exe
2013-11-18 21:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-18 21:04 - 2013-11-18 21:04 - 00028672 _____ C:\Users\gloeckno\Downloads\90621_A846-EE34-0703-911D-E9D2-0806-E6F6-E696-3K6K.exe
2013-11-18 20:43 - 2012-07-06 06:57 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-18 20:43 - 2012-04-20 05:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-18 20:43 - 2011-05-13 00:42 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-18 20:43 - 2010-03-01 21:05 - 00000000 ____D C:\Users\gloeckno\AppData\Local\Adobe
2013-11-18 20:41 - 2013-11-17 20:03 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-11-18 20:10 - 2012-11-20 07:21 - 00000000 ____D C:\HDW41_TMP
2013-11-18 19:15 - 2013-11-17 15:34 - 00000000 ____D C:\Program Files (x86)\Lupas Rename 2000
2013-11-18 19:15 - 2013-10-16 21:11 - 00001937 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-18 19:15 - 2013-10-16 21:11 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-18 19:11 - 2010-05-08 19:10 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-11-17 20:03 - 2013-11-17 20:03 - 00003524 _____ C:\Windows\System32\Tasks\DealPly
2013-11-17 20:03 - 2013-11-17 20:03 - 00003372 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-11-17 20:03 - 2010-04-15 21:17 - 00001237 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-17 20:03 - 2010-02-08 23:56 - 00001621 _____ C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-17 15:34 - 2013-11-17 15:34 - 00760986 _____ (Ivan Anton Albarracin                                       ) C:\Users\gloeckno\Downloads\lupasrename.exe
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\Ines\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\gloeckno\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:23 - 2010-05-24 14:09 - 00000000 ____D C:\Users\gloeckno\Downloads\MLP_Bank
2013-11-17 15:11 - 2012-05-03 17:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 15:07 - 2013-08-18 13:28 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 15:02 - 2010-02-09 00:09 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-16 11:43 - 2013-11-16 10:58 - 00000000 ____D C:\Program Files\VirtualDub-1.10.4-AMD64
2013-11-16 10:55 - 2013-11-16 10:55 - 02209528 _____ C:\Users\gloeckno\Downloads\VirtualDub-1.10.4-AMD64.zip
2013-11-16 10:53 - 2013-11-16 10:53 - 00618912 _____ C:\Users\gloeckno\Downloads\VirtualDub 64 Bit - CHIP-Downloader.exe
2013-11-16 00:33 - 2013-11-16 00:33 - 00003188 _____ C:\Windows\System32\Tasks\{6C6B0F20-1380-4B34-955A-CFEC9F5EC3D5}
2013-11-16 00:32 - 2013-11-16 00:32 - 01053496 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\virtualdubplugins_basispaket_de.exe
2013-11-16 00:32 - 2011-03-08 15:06 - 00000000 ____D C:\Users\gloeckno\Documents\How to do
2013-11-16 00:04 - 2013-11-16 00:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 00:53 - 2013-11-15 00:49 - 00051418 _____ C:\adorage-protocol.txt
2013-11-15 00:53 - 2013-11-15 00:34 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\proDAD
2013-11-15 00:52 - 2013-11-15 00:52 - 00000000 ____D C:\Program Files (x86)\AdorageI-SAL
2013-11-15 00:51 - 2013-11-15 00:51 - 00000000 ____D C:\ProgramData\proDAD
2013-11-15 00:49 - 2013-11-15 00:52 - 00520192 _____ (proDAD GmbH) C:\Windows\SysWOW64\prodad-codec.dll
2013-11-15 00:49 - 2013-11-15 00:52 - 00321088 _____ (proDAD GmbH) C:\Windows\SysWOW64\proDAD-PA-Support.dll
2013-11-15 00:34 - 2013-11-15 00:34 - 00000000 ____D C:\Program Files (x86)\proDAD
2013-11-13 22:14 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-11-11 20:53 - 2013-11-11 20:51 - 00001189 _____ C:\Users\Public\Desktop\Philips Intelligent Agent.lnk
2013-11-11 20:53 - 2013-11-11 19:58 - 00000000 ____D C:\ProgramData\Philips
2013-11-11 20:52 - 2013-11-11 20:52 - 00000000 ____D C:\Users\gloeckno\Documents\Philips Intelligent Agent
2013-11-11 20:51 - 2013-11-11 19:58 - 00000000 ____D C:\Program Files (x86)\Philips
2013-11-11 20:50 - 2013-11-11 20:50 - 01526952 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Intelligent_Agent_2.1_Setup.exe
2013-11-11 20:39 - 2013-11-11 20:39 - 00001347 _____ C:\Users\gloeckno\Desktop\Verwalten SPD8020-7EB3EF.lnk
2013-11-11 20:39 - 2013-11-11 20:39 - 00001191 _____ C:\Users\gloeckno\Desktop\Durchsuchen SPD8020-7EB3EF.lnk
2013-11-11 19:58 - 2013-11-11 19:58 - 00001239 _____ C:\Users\Public\Desktop\Philips network storage wizard.lnk
2013-11-11 19:57 - 2013-11-11 19:57 - 01497416 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Network_Storage_Wizard_1.2_Setup.exe
2013-11-11 05:50 - 2010-02-09 00:10 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-10 17:55 - 2013-11-10 17:55 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-10 17:55 - 2013-11-10 17:54 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-10 17:55 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files\iTunes
2013-11-10 17:55 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-10 17:54 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files\iPod
2013-11-03 20:12 - 2009-07-14 03:34 - 74711040 _____ C:\Windows\system32\config\SOFTWARE_tureg_old
2013-11-03 20:12 - 2009-07-14 03:34 - 18612224 _____ C:\Windows\system32\config\SYSTEM_tureg_old
2013-11-03 20:12 - 2009-07-14 03:34 - 00024576 _____ C:\Windows\system32\config\SECURITY_tureg_old
2013-11-03 20:09 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\DEFAULT_tureg_old
2013-11-03 20:09 - 2009-07-14 03:34 - 00069632 _____ C:\Windows\system32\config\SAM_tureg_old
2013-11-02 14:10 - 2011-03-15 22:51 - 00000000 ___DC C:\Users\gloeckno\AppData\Local\MigWiz
2013-10-27 18:28 - 2012-03-26 19:05 - 00003248 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-10-27 18:27 - 2012-03-26 19:05 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2012

Some content of TEMP:
====================
C:\Users\gloeckno\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\gloeckno\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\gloeckno\AppData\Local\Temp\SHSetup.exe
C:\Users\Ines\AppData\Local\Temp\AskSLib.dll
C:\Users\Ines\AppData\Local\Temp\contentDATs.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-21 00:39

==================== End Of Log ============================

3: Addition.txt:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013
Ran by gloeckno (administrator) on GAMES-PC on 24-11-2013 17:59:28
Running from C:\Users\gloeckno\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(COMPANYVERS_NAME) C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
(Akamai Technologies, Inc.) C:\Users\gloeckno\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\gloeckno\AppData\Local\Akamai\netsession_win.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
() C:\Users\gloeckno\AppData\Roaming\BrowserCompanion\tbhcn.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Nokia) C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2184520 2009-07-27] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.EXE [767312 2009-03-18] (CANON INC.)
HKCU\...\Run: [360desktop] - C:\Program Files\360desktop\360desktop.exe [1411912 2009-11-06] (360desktop Pty. Ltd.)
HKCU\...\Run: [NokiaOviSuite2] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [724536 2011-05-20] (Nokia)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\gloeckno\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [KiesHelper] - C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe [954256 2012-03-31] (Samsung)
MountPoints2: {c27654c3-1503-11df-8833-806e6f6e6963} - E:\start.exe /checksection
HKLM-x32\...\Run: [TrayServer] - C:\Program Files (x86)\MAGIX\Video_deluxe_16_Premium\Trayserver.exe [90112 2008-08-07] (MAGIX AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NokiaMServer] - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [1807360 2011-10-19] (Dominik Reichl)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3521424 2012-03-31] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1573584 2012-10-19] (Ask)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKU\Ines\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2012-03-31] ()
AppInit_DLLs:   [ ] ()
Startup: C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk
ShortcutTarget: tbhcn.lnk -> C:\Users\gloeckno\AppData\Roaming\BrowserCompanion\tbhcn.exe ()
Startup: C:\Users\Ines\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x159C434598D9CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://do-search.com/?type=hp&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://do-search.com/?type=hp&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: HKCU - (No Name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No File
URLSearchHook: HKCU - (No Name) - {0696f815-a3a9-490a-bb14-9ec3350b1276} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll (MindSpark)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://do-search.com/web/?type=ds&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524&q={searchTerms}
SearchScopes: HKLM-x32 - {a5b9c0f5-5616-47cd-a95f-e43b488faccf} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm284YYde&ptnrS=XPxdm284YYde&si=CK3hkZqC8rICFQFf3godiWMAhw&ptb=42A1EE84-89E2-46BF-999A-E1549F086ED3&psa=&ind=2013071511&st=sb&n=77fd0897&searchfor={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0E5ABC7D-9EB0-44DA-ABC9-21BCBA389C39} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=434061ef-025a-4586-8d56-4a92943000d0&apn_sauid=1D47B571-E9C6-4695-883D-D8750CD994CB
SearchScopes: HKCU - {a5b9c0f5-5616-47cd-a95f-e43b488faccf} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=XPxdm284YYde&ptnrS=XPxdm284YYde&si=CK3hkZqC8rICFQFf3godiWMAhw&ptb=42A1EE84-89E2-46BF-999A-E1549F086ED3&psa=&ind=2013071511&st=sb&n=77fd0897&searchfor={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb164/?search={searchTerms}&loc=IB_DS&a=6PQDwZs8jd&i=26
SearchScopes: HKCU - {EA151A6A-8138-4779-B8E5-91CCDC013070} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Search Assistant BHO - {5d79f641-c168-40df-a32f-bacea7509e75} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64SrcAs.dll (MindSpark)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Toolbar BHO - {cb41fc95-f1b3-4797-8bb6-1012ff62abba} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - TelevisionFanatic - {c98d5b61-b0ea-4d48-9839-1079d352d880} - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64bar.dll (MindSpark)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {C98D5B61-B0EA-4D48-9839-1079D352D880} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default
FF user.js: detected! => C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\user.js
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://do-search.com/?type=hp&ts=1384715023&from=tugs&uid=SAMSUNGXHD204UI_S2H7J9CB201524
FF NetworkProxy: "no_proxies_on", "*.local"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @TelevisionFanatic.com/Plugin - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\NP64Stub.dll (MindSpark)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @autodesk.com/DWF - c:\Program Files (x86)\Autodesk\Autodesk Design Review Firefox Add-on v1.1\npADRdwf.dll (Autodesk)
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\do-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Feven 1.5 - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com
FF Extension: TelevisionFanatic - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\64ffxtbr@TelevisionFanatic.com
FF Extension: DealPly  Shopping - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\addon@dealplyshopping.com
FF Extension: Browser Companion Helper - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\bbrs_002@blabbers.com
FF Extension: Flash and Video Download - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
FF Extension: toolbar - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\toolbar@web.de.xpi
FF Extension: ImTranslator - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: Adblock Plus - C:\Users\gloeckno\AppData\Roaming\Mozilla\Firefox\Profiles\xavrde6v.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM-x32\...\Firefox\Extensions: [64ffxtbr@TelevisionFanatic.com] - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin
FF Extension: TelevisionFanatic - C:\Program Files (x86)\TelevisionFanatic\bar\1.bin
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR Extension: (Feven 1.5) - C:\Users\gloeckno\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg\1.25.48_0
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx
CHR HKLM-x32\...\Chrome\Extension: [bodddioamolcibagionmmobehnbhiakf] - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R3 Blackberry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2009-02-10] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2013-10-18] (Enigma Software Group USA, LLC.)
R2 TelevisionFanaticService; C:\Program Files (x86)\TelevisionFanatic\bar\1.bin\64barsvc.exe [42504 2012-10-08] (COMPANYVERS_NAME)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2144056 2013-10-22] (TuneUp Software)
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-05-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [78336 2013-01-03] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-02-09] (TuneUp Software)
S3 ATICDSDr; \??\C:\Users\gloeckno\AppData\Local\Temp\ATICDSDr.sys [x]
U3 fwtoqpow; \??\C:\Users\gloeckno\AppData\Local\Temp\fwtoqpow.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-24 17:59 - 2013-11-24 17:59 - 00023287 _____ C:\Users\gloeckno\Downloads\FRST.txt
2013-11-24 17:59 - 2013-11-24 17:59 - 00000000 ____D C:\FRST
2013-11-24 17:58 - 2013-11-24 17:58 - 01958440 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST64.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00680560 _____ C:\Users\gloeckno\Downloads\ZipExtractorSetup.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00001182 _____ C:\Users\Ines\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:57 - 2013-11-24 17:57 - 00001158 _____ C:\Users\gloeckno\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:54 - 2013-11-24 17:54 - 01091583 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST.exe
2013-11-24 17:52 - 2013-11-24 17:52 - 105952601 _____ C:\Windows\SysWOW64\�鈯蹬ˆ
2013-11-24 17:38 - 2013-11-24 17:38 - 00000000 ____D C:\Users\gloeckno\Desktop\log files
2013-11-24 17:24 - 2013-11-24 17:24 - 00000000 _____ C:\Users\gloeckno\Desktop\test.log
2013-11-24 17:23 - 2013-11-24 17:23 - 00000000 _____ C:\Users\gloeckno\Desktop\GMER_3rd party scan 2013-11-24_17_23.txt
2013-11-24 00:20 - 2013-11-24 00:20 - 00377856 _____ C:\Users\gloeckno\Downloads\llikksn3.exe
2013-11-24 00:10 - 2013-11-24 00:10 - 00000000 _____ C:\Users\gloeckno\defogger_reenable
2013-11-24 00:09 - 2013-11-24 17:34 - 00000478 _____ C:\Users\gloeckno\Downloads\defogger_disable.log
2013-11-24 00:07 - 2013-11-24 00:07 - 00050477 _____ C:\Users\gloeckno\Downloads\Defogger.exe
2013-11-23 16:34 - 2013-11-23 23:55 - 00068912 _____ C:\Windows\PFRO.log
2013-11-23 11:59 - 2013-11-23 11:59 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-23 11:59 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-23 11:45 - 2013-11-23 11:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\gloeckno\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-23 10:24 - 2013-11-23 10:24 - 00002270 _____ C:\Users\gloeckno\Desktop\SpyHunter.lnk
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\sh4ldr
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 _____ C:\autoexec.bat
2013-11-23 10:24 - 2012-06-22 11:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-11-23 10:23 - 2013-11-23 10:24 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-11-23 10:19 - 2013-11-23 10:19 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\gloeckno\Downloads\SpyHunter-Installer.exe
2013-11-23 00:37 - 2013-11-23 00:37 - 105792079 _____ C:\Windows\SysWOW64\䱀讻蹬B
2013-11-20 23:37 - 2013-11-20 23:37 - 00002218 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-11-20 23:37 - 2013-11-20 23:37 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-20 23:02 - 2013-11-24 00:13 - 00000336 _____ C:\Windows\setupact.log
2013-11-19 22:29 - 2013-11-19 22:30 - 00000000 ____D C:\Users\gloeckno\Documents\26_Urlaub USA
2013-11-18 23:42 - 2013-11-18 23:42 - 06430443 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule_1.5.3.exe
2013-11-18 23:16 - 2013-11-18 23:17 - 56444792 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_video_dlx_16_premium_9.0.8.2_d.exe
2013-11-18 23:15 - 2013-11-18 23:15 - 04589046 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule.exe
2013-11-18 21:04 - 2013-11-18 21:04 - 00028672 _____ C:\Users\gloeckno\Downloads\90621_A846-EE34-0703-911D-E9D2-0806-E6F6-E696-3K6K.exe
2013-11-17 20:03 - 2013-11-20 23:37 - 00000000 ____D C:\Users\gloeckno\AppData\Local\Google
2013-11-17 20:03 - 2013-11-19 19:45 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-11-17 20:03 - 2013-11-18 20:41 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-11-17 20:03 - 2013-11-17 20:03 - 00003524 _____ C:\Windows\System32\Tasks\DealPly
2013-11-17 20:03 - 2013-11-17 20:03 - 00003372 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-11-17 15:34 - 2013-11-18 19:15 - 00000000 ____D C:\Program Files (x86)\Lupas Rename 2000
2013-11-17 15:34 - 2013-11-17 15:34 - 00760986 _____ (Ivan Anton Albarracin                                       ) C:\Users\gloeckno\Downloads\lupasrename.exe
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\Ines\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\gloeckno\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:08 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-17 15:08 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-17 15:08 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-17 15:08 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-17 15:08 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-17 15:08 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-17 15:08 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-17 15:08 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-17 15:08 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-17 15:08 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-17 15:08 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-17 15:08 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-16 10:58 - 2013-11-16 11:43 - 00000000 ____D C:\Program Files\VirtualDub-1.10.4-AMD64
2013-11-16 10:55 - 2013-11-16 10:55 - 02209528 _____ C:\Users\gloeckno\Downloads\VirtualDub-1.10.4-AMD64.zip
2013-11-16 10:53 - 2013-11-16 10:53 - 00618912 _____ C:\Users\gloeckno\Downloads\VirtualDub 64 Bit - CHIP-Downloader.exe
2013-11-16 00:33 - 2013-11-16 00:33 - 00003188 _____ C:\Windows\System32\Tasks\{6C6B0F20-1380-4B34-955A-CFEC9F5EC3D5}
2013-11-16 00:32 - 2013-11-16 00:32 - 01053496 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\virtualdubplugins_basispaket_de.exe
2013-11-16 00:04 - 2013-11-16 00:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 00:52 - 2013-11-15 00:52 - 00000000 ____D C:\Program Files (x86)\AdorageI-SAL
2013-11-15 00:52 - 2013-11-15 00:49 - 00520192 _____ (proDAD GmbH) C:\Windows\SysWOW64\prodad-codec.dll
2013-11-15 00:52 - 2013-11-15 00:49 - 00321088 _____ (proDAD GmbH) C:\Windows\SysWOW64\proDAD-PA-Support.dll
2013-11-15 00:51 - 2013-11-15 00:51 - 00000000 ____D C:\ProgramData\proDAD
2013-11-15 00:49 - 2013-11-15 00:53 - 00051418 _____ C:\adorage-protocol.txt
2013-11-15 00:34 - 2013-11-15 00:53 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\proDAD
2013-11-15 00:34 - 2013-11-15 00:34 - 00000000 ____D C:\Program Files (x86)\proDAD
2013-11-14 20:44 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 20:44 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 20:44 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 20:44 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 20:44 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 20:44 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 20:44 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 20:44 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 20:44 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 20:44 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 20:44 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 20:44 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 20:44 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 20:44 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 20:44 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 20:44 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 20:44 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 20:44 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 20:44 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 20:44 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 20:44 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 20:44 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 20:44 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 20:44 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 20:44 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 20:44 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 20:44 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 20:44 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 20:44 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 20:44 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 00:55 - 2013-11-19 18:36 - 00003900 _____ C:\Windows\System32\Tasks\Philips-Online-Aktualisierungsprogramm
2013-11-11 20:52 - 2013-11-11 20:52 - 00000000 ____D C:\Users\gloeckno\Documents\Philips Intelligent Agent
2013-11-11 20:51 - 2013-11-11 20:53 - 00001189 _____ C:\Users\Public\Desktop\Philips Intelligent Agent.lnk
2013-11-11 20:50 - 2013-11-11 20:50 - 01526952 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Intelligent_Agent_2.1_Setup.exe
2013-11-11 20:39 - 2013-11-11 20:39 - 00001347 _____ C:\Users\gloeckno\Desktop\Verwalten SPD8020-7EB3EF.lnk
2013-11-11 20:39 - 2013-11-11 20:39 - 00001191 _____ C:\Users\gloeckno\Desktop\Durchsuchen SPD8020-7EB3EF.lnk
2013-11-11 19:58 - 2013-11-11 20:53 - 00000000 ____D C:\ProgramData\Philips
2013-11-11 19:58 - 2013-11-11 20:51 - 00000000 ____D C:\Program Files (x86)\Philips
2013-11-11 19:58 - 2013-11-11 19:58 - 00001239 _____ C:\Users\Public\Desktop\Philips network storage wizard.lnk
2013-11-11 19:57 - 2013-11-11 19:57 - 01497416 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Network_Storage_Wizard_1.2_Setup.exe
2013-11-10 17:55 - 2013-11-10 17:55 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-10 17:54 - 2013-11-10 17:55 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-10 17:54 - 2013-11-10 17:55 - 00000000 ____D C:\Program Files\iTunes
2013-11-10 17:54 - 2013-11-10 17:55 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-10 17:54 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2013-11-24 17:59 - 2013-11-24 17:59 - 00023287 _____ C:\Users\gloeckno\Downloads\FRST.txt
2013-11-24 17:59 - 2013-11-24 17:59 - 00000000 ____D C:\FRST
2013-11-24 17:58 - 2013-11-24 17:58 - 01958440 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST64.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00680560 _____ C:\Users\gloeckno\Downloads\ZipExtractorSetup.exe
2013-11-24 17:57 - 2013-11-24 17:57 - 00001182 _____ C:\Users\Ines\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:57 - 2013-11-24 17:57 - 00001158 _____ C:\Users\gloeckno\Desktop\Continue Zip Extractor Installation.lnk
2013-11-24 17:57 - 2009-07-14 05:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-24 17:57 - 2009-07-14 05:45 - 00014960 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-24 17:54 - 2013-11-24 17:54 - 01091583 _____ (Farbar) C:\Users\gloeckno\Downloads\FRST.exe
2013-11-24 17:54 - 2012-07-15 11:44 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\BrowserCompanion
2013-11-24 17:52 - 2013-11-24 17:52 - 105952601 _____ C:\Windows\SysWOW64\�鈯蹬ˆ
2013-11-24 17:52 - 2010-02-08 23:49 - 01976925 _____ C:\Windows\WindowsUpdate.log
2013-11-24 17:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-11-24 17:38 - 2013-11-24 17:38 - 00000000 ____D C:\Users\gloeckno\Desktop\log files
2013-11-24 17:34 - 2013-11-24 00:09 - 00000478 _____ C:\Users\gloeckno\Downloads\defogger_disable.log
2013-11-24 17:27 - 2012-07-06 06:57 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-24 17:24 - 2013-11-24 17:24 - 00000000 _____ C:\Users\gloeckno\Desktop\test.log
2013-11-24 17:23 - 2013-11-24 17:23 - 00000000 _____ C:\Users\gloeckno\Desktop\GMER_3rd party scan 2013-11-24_17_23.txt
2013-11-24 00:20 - 2013-11-24 00:20 - 00377856 _____ C:\Users\gloeckno\Downloads\llikksn3.exe
2013-11-24 00:19 - 2009-07-14 18:58 - 00664618 _____ C:\Windows\system32\perfh007.dat
2013-11-24 00:19 - 2009-07-14 18:58 - 00134786 _____ C:\Windows\system32\perfc007.dat
2013-11-24 00:19 - 2009-07-14 06:13 - 01527740 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-24 00:13 - 2013-11-20 23:02 - 00000336 _____ C:\Windows\setupact.log
2013-11-24 00:13 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-24 00:10 - 2013-11-24 00:10 - 00000000 _____ C:\Users\gloeckno\defogger_reenable
2013-11-24 00:10 - 2010-02-08 23:55 - 00000000 ____D C:\Users\gloeckno
2013-11-24 00:07 - 2013-11-24 00:07 - 00050477 _____ C:\Users\gloeckno\Downloads\Defogger.exe
2013-11-23 23:55 - 2013-11-23 16:34 - 00068912 _____ C:\Windows\PFRO.log
2013-11-23 23:53 - 2012-09-18 07:21 - 00000000 ____D C:\Windows\SysWOW64\WNLT
2013-11-23 19:24 - 2010-04-15 20:24 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{1C7ECCFC-09AD-48A2-944A-0E2E2CD2AF35}
2013-11-23 16:34 - 2013-10-20 19:45 - 00000000 ____D C:\Windows\SysWOW64\jmdp
2013-11-23 16:32 - 2013-04-11 07:46 - 00000000 ____D C:\Windows\SysWOW64\ARFC
2013-11-23 11:59 - 2013-11-23 11:59 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-23 11:59 - 2013-11-23 11:59 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-23 11:45 - 2013-11-23 11:45 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\gloeckno\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-23 10:24 - 2013-11-23 10:24 - 00002270 _____ C:\Users\gloeckno\Desktop\SpyHunter.lnk
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\sh4ldr
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-23 10:24 - 2013-11-23 10:24 - 00000000 _____ C:\autoexec.bat
2013-11-23 10:24 - 2013-11-23 10:23 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2013-11-23 10:19 - 2013-11-23 10:19 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\gloeckno\Downloads\SpyHunter-Installer.exe
2013-11-23 00:37 - 2013-11-23 00:37 - 105792079 _____ C:\Windows\SysWOW64\䱀讻蹬B
2013-11-20 23:37 - 2013-11-20 23:37 - 00002218 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-11-20 23:37 - 2013-11-20 23:37 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-20 23:37 - 2013-11-17 20:03 - 00000000 ____D C:\Users\gloeckno\AppData\Local\Google
2013-11-19 22:30 - 2013-11-19 22:29 - 00000000 ____D C:\Users\gloeckno\Documents\26_Urlaub USA
2013-11-19 20:02 - 2011-07-13 22:42 - 00213504 ___SH C:\Users\gloeckno\Desktop\Thumbs.db
2013-11-19 19:49 - 2010-02-10 23:07 - 00000000 ____D C:\Windows\system32\appmgmt
2013-11-19 19:47 - 2010-02-10 22:56 - 00000000 ____D C:\Windows\UltraDefrag
2013-11-19 19:45 - 2013-11-17 20:03 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-11-19 19:45 - 2010-02-08 23:56 - 00000000 ___RD C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-19 18:36 - 2013-11-13 00:55 - 00003900 _____ C:\Windows\System32\Tasks\Philips-Online-Aktualisierungsprogramm
2013-11-18 23:42 - 2013-11-18 23:42 - 06430443 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule_1.5.3.exe
2013-11-18 23:17 - 2013-11-18 23:16 - 56444792 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_video_dlx_16_premium_9.0.8.2_d.exe
2013-11-18 23:15 - 2013-11-18 23:15 - 04589046 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\patch_geomodule.exe
2013-11-18 21:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-18 21:04 - 2013-11-18 21:04 - 00028672 _____ C:\Users\gloeckno\Downloads\90621_A846-EE34-0703-911D-E9D2-0806-E6F6-E696-3K6K.exe
2013-11-18 20:43 - 2012-07-06 06:57 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-18 20:43 - 2012-04-20 05:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-18 20:43 - 2011-05-13 00:42 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-18 20:43 - 2010-03-01 21:05 - 00000000 ____D C:\Users\gloeckno\AppData\Local\Adobe
2013-11-18 20:41 - 2013-11-17 20:03 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro
2013-11-18 20:10 - 2012-11-20 07:21 - 00000000 ____D C:\HDW41_TMP
2013-11-18 19:15 - 2013-11-17 15:34 - 00000000 ____D C:\Program Files (x86)\Lupas Rename 2000
2013-11-18 19:15 - 2013-10-16 21:11 - 00001937 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-18 19:15 - 2013-10-16 21:11 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-18 19:11 - 2010-05-08 19:10 - 00000000 ____D C:\ProgramData\CanonIJPLM
2013-11-17 20:03 - 2013-11-17 20:03 - 00003524 _____ C:\Windows\System32\Tasks\DealPly
2013-11-17 20:03 - 2013-11-17 20:03 - 00003372 _____ C:\Windows\System32\Tasks\DealPlyUpdate
2013-11-17 20:03 - 2010-04-15 21:17 - 00001237 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-17 20:03 - 2010-02-08 23:56 - 00001621 _____ C:\Users\gloeckno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-17 15:34 - 2013-11-17 15:34 - 00760986 _____ (Ivan Anton Albarracin                                       ) C:\Users\gloeckno\Downloads\lupasrename.exe
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\Ines\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:34 - 2013-11-17 15:34 - 00001013 _____ C:\Users\gloeckno\Desktop\Lupas Rename 2000.lnk
2013-11-17 15:23 - 2010-05-24 14:09 - 00000000 ____D C:\Users\gloeckno\Downloads\MLP_Bank
2013-11-17 15:11 - 2012-05-03 17:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 15:07 - 2013-08-18 13:28 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 15:02 - 2010-02-09 00:09 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-16 11:43 - 2013-11-16 10:58 - 00000000 ____D C:\Program Files\VirtualDub-1.10.4-AMD64
2013-11-16 10:55 - 2013-11-16 10:55 - 02209528 _____ C:\Users\gloeckno\Downloads\VirtualDub-1.10.4-AMD64.zip
2013-11-16 10:53 - 2013-11-16 10:53 - 00618912 _____ C:\Users\gloeckno\Downloads\VirtualDub 64 Bit - CHIP-Downloader.exe
2013-11-16 00:33 - 2013-11-16 00:33 - 00003188 _____ C:\Windows\System32\Tasks\{6C6B0F20-1380-4B34-955A-CFEC9F5EC3D5}
2013-11-16 00:32 - 2013-11-16 00:32 - 01053496 _____ (MAGIX AG) C:\Users\gloeckno\Downloads\virtualdubplugins_basispaket_de.exe
2013-11-16 00:32 - 2011-03-08 15:06 - 00000000 ____D C:\Users\gloeckno\Documents\How to do
2013-11-16 00:04 - 2013-11-16 00:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 00:53 - 2013-11-15 00:49 - 00051418 _____ C:\adorage-protocol.txt
2013-11-15 00:53 - 2013-11-15 00:34 - 00000000 ____D C:\Users\gloeckno\AppData\Roaming\proDAD
2013-11-15 00:52 - 2013-11-15 00:52 - 00000000 ____D C:\Program Files (x86)\AdorageI-SAL
2013-11-15 00:51 - 2013-11-15 00:51 - 00000000 ____D C:\ProgramData\proDAD
2013-11-15 00:49 - 2013-11-15 00:52 - 00520192 _____ (proDAD GmbH) C:\Windows\SysWOW64\prodad-codec.dll
2013-11-15 00:49 - 2013-11-15 00:52 - 00321088 _____ (proDAD GmbH) C:\Windows\SysWOW64\proDAD-PA-Support.dll
2013-11-15 00:34 - 2013-11-15 00:34 - 00000000 ____D C:\Program Files (x86)\proDAD
2013-11-13 22:14 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-11-11 20:53 - 2013-11-11 20:51 - 00001189 _____ C:\Users\Public\Desktop\Philips Intelligent Agent.lnk
2013-11-11 20:53 - 2013-11-11 19:58 - 00000000 ____D C:\ProgramData\Philips
2013-11-11 20:52 - 2013-11-11 20:52 - 00000000 ____D C:\Users\gloeckno\Documents\Philips Intelligent Agent
2013-11-11 20:51 - 2013-11-11 19:58 - 00000000 ____D C:\Program Files (x86)\Philips
2013-11-11 20:50 - 2013-11-11 20:50 - 01526952 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Intelligent_Agent_2.1_Setup.exe
2013-11-11 20:39 - 2013-11-11 20:39 - 00001347 _____ C:\Users\gloeckno\Desktop\Verwalten SPD8020-7EB3EF.lnk
2013-11-11 20:39 - 2013-11-11 20:39 - 00001191 _____ C:\Users\gloeckno\Desktop\Durchsuchen SPD8020-7EB3EF.lnk
2013-11-11 19:58 - 2013-11-11 19:58 - 00001239 _____ C:\Users\Public\Desktop\Philips network storage wizard.lnk
2013-11-11 19:57 - 2013-11-11 19:57 - 01497416 _____ (Philips                                                     ) C:\Users\gloeckno\Downloads\Philips_Network_Storage_Wizard_1.2_Setup.exe
2013-11-11 05:50 - 2010-02-09 00:10 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-10 17:55 - 2013-11-10 17:55 - 00001789 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-10 17:55 - 2013-11-10 17:54 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-10 17:55 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files\iTunes
2013-11-10 17:55 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-11-10 17:54 - 2013-11-10 17:54 - 00000000 ____D C:\Program Files\iPod
2013-11-03 20:12 - 2009-07-14 03:34 - 74711040 _____ C:\Windows\system32\config\SOFTWARE_tureg_old
2013-11-03 20:12 - 2009-07-14 03:34 - 18612224 _____ C:\Windows\system32\config\SYSTEM_tureg_old
2013-11-03 20:12 - 2009-07-14 03:34 - 00024576 _____ C:\Windows\system32\config\SECURITY_tureg_old
2013-11-03 20:09 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\DEFAULT_tureg_old
2013-11-03 20:09 - 2009-07-14 03:34 - 00069632 _____ C:\Windows\system32\config\SAM_tureg_old
2013-11-02 14:10 - 2011-03-15 22:51 - 00000000 ___DC C:\Users\gloeckno\AppData\Local\MigWiz
2013-10-27 18:28 - 2012-03-26 19:05 - 00003248 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-10-27 18:27 - 2012-03-26 19:05 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2012

Some content of TEMP:
====================
C:\Users\gloeckno\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\gloeckno\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\gloeckno\AppData\Local\Temp\SHSetup.exe
C:\Users\Ines\AppData\Local\Temp\AskSLib.dll
C:\Users\Ines\AppData\Local\Temp\contentDATs.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-21 00:39

==================== End Of Log ============================

4.1: MBAM SCAN Nr1/ Nr.2 / nr.3 / Nr. 4 (in zip file)

Rvzr-a.akamaihd.net Infektion

Log-Analyse und Auswertung: Rvzr-a.akamaihd.net Infektion

Rvzr-a.akamaihd.net Infektion

Ähnliche Themen: Rvzr-a.akamaihd.net Infektion