TR/Patched.Ren.Gen in C:\Windows\Temp\ (Windows 7)

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-12-2013 02
Ran by Munira (administrator) on HEXENKATZE on 03-12-2013 20:53:48
Running from C:\Users\Munira\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.0.4555.0\AdAwareService.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_41f81f5ce017c35c\stacsv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
() C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_41f81f5ce017c35c\AEstSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Fork Ltd.) C:\Prey\platform\windows\cronsvc.exe
() C:\Program Files\STMicroelectronics\Accelerometer\InstallFilterService.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
() C:\Program Files\STMicroelectronics\Accelerometer\FF_Protection.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Creative Technology Ltd) C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.0.4555.0\AdAwareTray.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Audible, Inc.) C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_9_900_152.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
() C:\Users\Munira\Desktop\Defogger.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1602856 2010-01-07] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [495708 2010-01-05] (IDT, Inc.)
HKLM\...\Run: [FreeFallProtection] - C:\Program Files\STMicroelectronics\Accelerometer\FF_Protection.exe [2384896 2009-07-22] ()
HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-12-29] (CyberLink Corp.)
HKLM\...\Run: [Dell Webcam Central] - C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [409744 2009-06-24] (Creative Technology Ltd)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [623992 2008-10-14] (Adobe Systems Inc.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-19] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [Ad-Aware Browsing Protection] - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [559696 2013-09-27] (Lavasoft)
HKLM\...\Run: [AdAwareTray] - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.0.4555.0\AdAwareTray.exe [2162008 2013-10-18] ()
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [Update Service] - C:\Program Files\Common Files\Teknum Systems\update.exe [19456 2013-01-20] (Teknum Systems AS)
HKCU\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
Startup: C:\Users\Munira\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

ProxyServer: localhost:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {2F457B8F-4310-4798-B3CE-D77BA09202D2} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Munira\AppData\Roaming\Mozilla\Firefox\Profiles\m5i4lydh.Munira
FF NewTab: about:blank
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101727.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Munira\AppData\Roaming\Mozilla\Firefox\Profiles\m5i4lydh.Munira\searchplugins\dictcc.xml
FF SearchPlugin: C:\Users\Munira\AppData\Roaming\Mozilla\Firefox\Profiles\m5i4lydh.Munira\searchplugins\linguee-de-en.xml
FF SearchPlugin: C:\Users\Munira\AppData\Roaming\Mozilla\Firefox\Profiles\m5i4lydh.Munira\searchplugins\thesaurus---referencecom.xml
FF SearchPlugin: C:\Users\Munira\AppData\Roaming\Mozilla\Firefox\Profiles\m5i4lydh.Munira\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

========================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 CronService; C:\Prey\platform\windows\cronsvc.exe [23552 2012-11-28] (Fork Ltd.)
R2 InstallFilterService; C:\Program Files\STMicroelectronics\Accelerometer\InstallFilterService.exe [60928 2009-11-30] ()
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.0.4555.0\AdAwareService.exe [497744 2013-10-18] ()
R2 MSSQL$ACROSS; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 Samsung UPD Service; C:\Windows\System32\SUPDSvc.exe [132464 2010-03-16] (Samsung Electronics CO., LTD.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_41f81f5ce017c35c\STacSV.exe [229458 2010-01-05] (IDT, Inc.)
R2 wgsslvpnsrc; C:\Program Files\WatchGuard\WatchGuard Mobile VPN with SSL\wgsslvpnsrc.exe [101376 2012-06-13] ()

==================== Drivers (Whitelisted) ====================

R3 Acceler; C:\Windows\System32\DRIVERS\Acceler.sys [41648 2009-12-02] (ST Microelectronics)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-11-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-03-26] (Avira GmbH)
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26112 2011-10-24] (The OpenVPN Project)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [340624 2013-07-17] (BitDefender S.R.L.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Munira\AppData\Local\Temp\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-03 20:53 - 2013-12-03 20:53 - 01092545 _____ (Farbar) C:\Users\Munira\Desktop\FRST.exe
2013-12-03 20:53 - 2013-12-03 20:53 - 00014008 _____ C:\Users\Munira\Desktop\FRST.txt
2013-12-03 20:50 - 2013-12-03 20:50 - 00000474 _____ C:\Users\Munira\Desktop\defogger_disable.log
2013-12-03 20:50 - 2013-12-03 20:50 - 00000000 _____ C:\Users\Munira\defogger_reenable
2013-12-03 20:49 - 2013-12-03 20:49 - 00050477 _____ C:\Users\Munira\Desktop\Defogger.exe
2013-12-02 20:53 - 2013-12-02 20:53 - 02347384 _____ (ESET) C:\Users\Munira\Desktop\esetsmartinstaller_enu.exe
2013-12-02 20:51 - 2013-12-02 20:51 - 00000000 ____D C:\Users\Munira\AppData\Local\adawarebp
2013-12-02 17:26 - 2013-12-02 17:26 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-02 17:26 - 2013-12-02 17:26 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Malwarebytes
2013-12-02 17:26 - 2013-12-02 17:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-02 17:26 - 2013-12-02 17:26 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-02 17:26 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-02 17:23 - 2013-12-02 17:24 - 00014363 _____ C:\Users\Munira\Desktop\Addition.txt
2013-12-02 17:22 - 2013-12-02 17:22 - 00000000 ____D C:\FRST
2013-12-02 17:18 - 2013-12-02 17:18 - 00002011 _____ C:\Users\Munira\Desktop\JRT.txt
2013-12-02 17:15 - 2013-12-02 17:15 - 01034531 _____ (Thisisu) C:\Users\Munira\Desktop\JRT.exe
2013-12-02 17:15 - 2013-12-02 17:15 - 00000000 ____D C:\Windows\ERUNT
2013-12-02 17:07 - 2013-12-02 17:08 - 00000000 ____D C:\AdwCleaner
2013-12-02 17:07 - 2013-12-02 17:07 - 01110034 _____ C:\Users\Munira\Desktop\adwcleaner.exe
2013-12-02 17:05 - 2013-12-02 17:05 - 00001131 _____ C:\Users\Munira\Desktop\Continue Zip Opener Installation.lnk
2013-12-02 15:43 - 2013-12-02 15:43 - 00016096 _____ C:\ComboFix.txt
2013-12-02 15:26 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-12-02 15:19 - 2013-12-02 15:19 - 00000000 ____D C:\Users\Munira\Documents\ProcAlyzer Dumps
2013-12-02 14:16 - 2006-09-29 05:56 - 00028248 ____R (Adobe Systems Incorporated.) C:\Windows\system32\AdobePDF.dll
2013-12-02 13:16 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-12-02 13:16 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-12-02 13:16 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-12-02 13:16 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-12-02 13:16 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-12-02 13:16 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-12-02 13:16 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-12-02 13:15 - 2013-12-02 15:43 - 00000000 ____D C:\Qoobox
2013-12-02 13:14 - 2013-12-02 15:41 - 00000000 ____D C:\Windows\erdnt
2013-12-02 13:12 - 2013-12-02 13:13 - 05151572 ____R (Swearware) C:\Users\Munira\Desktop\ComboFix.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-26 14:13 - 2013-11-26 14:13 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-26 14:13 - 2013-11-26 14:13 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-26 14:13 - 2013-11-26 14:13 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-26 14:13 - 2013-11-26 14:13 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-26 14:13 - 2013-11-26 14:13 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-26 14:11 - 2013-11-26 14:15 - 00010956 _____ C:\Windows\IE11_main.log
2013-11-24 11:08 - 2013-11-24 11:08 - 00000943 _____ C:\Users\Public\Desktop\SaalDesignSoftware.lnk
2013-11-24 11:08 - 2013-11-24 11:08 - 00000000 ____D C:\Program Files\SaalDesignSoftware
2013-11-22 09:18 - 2013-11-22 09:18 - 00155752 _____ C:\Users\Munira\Desktop\haekelschal.jpeg
2013-11-18 12:22 - 2013-11-18 12:22 - 00000000 ____D C:\ProgramData\Oracle
2013-11-18 12:22 - 2013-11-18 12:22 - 00000000 ____D C:\Program Files\Common Files\Java
2013-11-18 12:21 - 2013-11-18 12:21 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-11-18 12:21 - 2013-11-18 12:21 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-11-17 16:04 - 2013-11-17 16:04 - 104695876 _____ C:\Windows\system32\꼥d
2013-11-15 20:33 - 2013-11-15 20:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-15 18:42 - 2013-11-15 18:42 - 104464595 _____ C:\Windows\system32\츹풡b
2013-11-14 20:01 - 2013-11-14 20:01 - 104278918 _____ C:\Windows\system32\Ḹ샜j
2013-11-14 11:49 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 11:49 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 11:49 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 11:49 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 11:49 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 11:49 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 11:49 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 11:49 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 11:49 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 11:49 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 11:49 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 11:49 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 11:49 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 11:49 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 11:49 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 11:49 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 11:49 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 11:49 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-14 06:59 - 2013-11-14 06:59 - 104179408 _____ C:\Windows\system32\䎉駍]
2013-11-13 19:16 - 2013-11-13 19:16 - 104136834 _____ C:\Windows\system32\䖟g
2013-11-12 08:25 - 2013-09-04 02:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-11-12 08:25 - 2013-09-04 02:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-11-12 08:25 - 2013-09-04 02:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-11-12 08:25 - 2013-09-04 02:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-11-12 08:25 - 2013-09-04 02:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-11-12 08:25 - 2013-09-04 02:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-11-12 08:25 - 2013-09-04 02:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-11-11 10:38 - 2013-11-11 10:38 - 00001755 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-11 10:37 - 2013-11-11 10:38 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-11-11 10:37 - 2013-11-11 10:38 - 00000000 ____D C:\Program Files\iTunes
2013-11-11 10:37 - 2013-11-11 10:37 - 00000000 ____D C:\Program Files\iPod
2013-11-11 09:38 - 2013-11-11 09:38 - 00000680 _____ C:\Users\Munira\Desktop\wichteln.txt
2013-11-10 21:43 - 2013-11-10 21:43 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Lavasoft
2013-11-10 21:07 - 2009-06-10 22:39 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20131110-210708.backup
2013-11-10 21:04 - 2013-11-10 21:04 - 00000000 ____D C:\Users\Munira\AppData\Roaming\LavasoftStatistics
2013-11-10 20:26 - 2013-11-10 20:26 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-11-10 20:25 - 2013-11-10 20:26 - 00000000 ____D C:\Program Files\Lavasoft
2013-11-10 20:24 - 2013-11-10 20:24 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2013-11-10 20:22 - 2013-11-10 20:22 - 00000000 ____D C:\ProgramData\Lavasoft
2013-11-10 20:19 - 2013-12-02 15:23 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2
2013-11-10 20:19 - 2013-12-02 15:22 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-10 19:56 - 2013-11-10 19:56 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Roxio Log Files
2013-11-10 19:42 - 2013-11-10 19:42 - 00000000 ____D C:\Users\Munira\AppData\Local\Google
2013-11-09 19:37 - 2013-11-09 19:37 - 103387443 _____ C:\Windows\system32\Ꞥj
2013-11-05 07:31 - 2013-11-05 07:31 - 105017276 _____ C:\Windows\system32\濆詵`

==================== One Month Modified Files and Folders =======

2013-12-03 20:54 - 2013-12-03 20:53 - 00014008 _____ C:\Users\Munira\Desktop\FRST.txt
2013-12-03 20:53 - 2013-12-03 20:53 - 01092545 _____ (Farbar) C:\Users\Munira\Desktop\FRST.exe
2013-12-03 20:53 - 2009-07-14 05:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-03 20:53 - 2009-07-14 05:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-03 20:50 - 2013-12-03 20:50 - 00000474 _____ C:\Users\Munira\Desktop\defogger_disable.log
2013-12-03 20:50 - 2013-12-03 20:50 - 00000000 _____ C:\Users\Munira\defogger_reenable
2013-12-03 20:50 - 2010-06-04 21:59 - 00000000 ____D C:\Users\Munira
2013-12-03 20:49 - 2013-12-03 20:49 - 00050477 _____ C:\Users\Munira\Desktop\Defogger.exe
2013-12-03 20:31 - 2013-01-20 18:11 - 00000029 _____ C:\Windows\system32\TempWmicBatchFile.bat
2013-12-03 20:27 - 2010-06-11 17:07 - 00000000 ____D C:\Users\Munira\Documents\fofi
2013-12-03 20:23 - 2012-10-20 11:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-03 18:31 - 2010-06-07 15:08 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Skype
2013-12-03 17:35 - 2009-07-14 05:55 - 01725776 _____ C:\Windows\WindowsUpdate.log
2013-12-03 17:31 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-03 17:31 - 2009-07-14 05:39 - 00108132 _____ C:\Windows\setupact.log
2013-12-03 15:01 - 2013-03-26 16:07 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-03 07:00 - 2010-05-29 18:52 - 01658670 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-02 20:53 - 2013-12-02 20:53 - 02347384 _____ (ESET) C:\Users\Munira\Desktop\esetsmartinstaller_enu.exe
2013-12-02 20:51 - 2013-12-02 20:51 - 00000000 ____D C:\Users\Munira\AppData\Local\adawarebp
2013-12-02 20:50 - 2010-05-29 11:42 - 00143216 _____ C:\Windows\PFRO.log
2013-12-02 17:26 - 2013-12-02 17:26 - 00001069 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-02 17:26 - 2013-12-02 17:26 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Malwarebytes
2013-12-02 17:26 - 2013-12-02 17:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-02 17:26 - 2013-12-02 17:26 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-12-02 17:24 - 2013-12-02 17:23 - 00014363 _____ C:\Users\Munira\Desktop\Addition.txt
2013-12-02 17:22 - 2013-12-02 17:22 - 00000000 ____D C:\FRST
2013-12-02 17:18 - 2013-12-02 17:18 - 00002011 _____ C:\Users\Munira\Desktop\JRT.txt
2013-12-02 17:15 - 2013-12-02 17:15 - 01034531 _____ (Thisisu) C:\Users\Munira\Desktop\JRT.exe
2013-12-02 17:15 - 2013-12-02 17:15 - 00000000 ____D C:\Windows\ERUNT
2013-12-02 17:08 - 2013-12-02 17:07 - 00000000 ____D C:\AdwCleaner
2013-12-02 17:07 - 2013-12-02 17:07 - 01110034 _____ C:\Users\Munira\Desktop\adwcleaner.exe
2013-12-02 17:05 - 2013-12-02 17:05 - 00001131 _____ C:\Users\Munira\Desktop\Continue Zip Opener Installation.lnk
2013-12-02 15:43 - 2013-12-02 15:43 - 00016096 _____ C:\ComboFix.txt
2013-12-02 15:43 - 2013-12-02 13:15 - 00000000 ____D C:\Qoobox
2013-12-02 15:43 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default
2013-12-02 15:41 - 2013-12-02 13:14 - 00000000 ____D C:\Windows\erdnt
2013-12-02 15:40 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-12-02 15:23 - 2013-11-10 20:19 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2
2013-12-02 15:22 - 2013-11-10 20:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-12-02 15:19 - 2013-12-02 15:19 - 00000000 ____D C:\Users\Munira\Documents\ProcAlyzer Dumps
2013-12-02 13:13 - 2013-12-02 13:12 - 05151572 ____R (Swearware) C:\Users\Munira\Desktop\ComboFix.exe
2013-12-02 13:09 - 2010-06-07 14:31 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Adobe
2013-11-26 19:27 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-11-26 18:24 - 2010-06-07 15:07 - 00000000 ___RD C:\Program Files\Skype
2013-11-26 18:24 - 2010-06-07 15:07 - 00000000 ____D C:\ProgramData\Skype
2013-11-26 18:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-26 14:15 - 2013-11-26 14:11 - 00010956 _____ C:\Windows\IE11_main.log
2013-11-26 14:13 - 2013-11-26 14:13 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-26 14:13 - 2013-11-26 14:13 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-26 14:13 - 2013-11-26 14:13 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-26 14:13 - 2013-11-26 14:13 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-26 14:13 - 2013-11-26 14:13 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-26 14:13 - 2013-11-26 14:13 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-26 14:13 - 2013-11-26 14:13 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-26 14:13 - 2013-11-26 14:13 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-25 21:34 - 2010-06-07 15:01 - 00000000 ____D C:\Users\Munira\.gimp-2.6
2013-11-25 11:45 - 2010-07-30 16:50 - 00000000 ____D C:\Users\Munira\Documents\planung
2013-11-24 12:13 - 2010-07-30 16:14 - 00000000 ____D C:\Users\Munira\Documents\fotoszurentwicklung
2013-11-24 11:08 - 2013-11-24 11:08 - 00000943 _____ C:\Users\Public\Desktop\SaalDesignSoftware.lnk
2013-11-24 11:08 - 2013-11-24 11:08 - 00000000 ____D C:\Program Files\SaalDesignSoftware
2013-11-24 11:08 - 2011-10-03 12:25 - 00000000 ____D C:\Users\Munira\AppData\Roaming\SaalDesignSoftware
2013-11-24 11:07 - 2011-10-03 12:24 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2013-11-22 11:50 - 2013-04-03 11:35 - 00000000 ____D C:\Users\Munira\AppData\Local\DoNotTrackPlus
2013-11-22 09:18 - 2013-11-22 09:18 - 00155752 _____ C:\Users\Munira\Desktop\haekelschal.jpeg
2013-11-21 15:16 - 2012-04-25 07:30 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-11-21 07:26 - 2013-10-16 09:53 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-11-19 15:55 - 2013-05-07 13:31 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-19 15:55 - 2013-03-26 16:07 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-19 15:55 - 2013-03-26 16:07 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-18 14:25 - 2013-08-18 16:00 - 00000000 ____D C:\Users\Munira\Desktop\forestfinance
2013-11-18 12:25 - 2010-06-11 14:02 - 00000000 ____D C:\Users\Munira\AppData\Local\Adobe
2013-11-18 12:24 - 2011-05-23 07:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-18 12:22 - 2013-11-18 12:22 - 00000000 ____D C:\ProgramData\Oracle
2013-11-18 12:22 - 2013-11-18 12:22 - 00000000 ____D C:\Program Files\Common Files\Java
2013-11-18 12:21 - 2013-11-18 12:21 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-11-18 12:21 - 2013-11-18 12:21 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-11-18 12:21 - 2012-10-20 11:36 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-11-18 12:21 - 2012-10-20 11:36 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-11-18 10:59 - 2010-10-27 15:48 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Canon
2013-11-17 16:04 - 2013-11-17 16:04 - 104695876 _____ C:\Windows\system32\꼥d
2013-11-15 20:33 - 2013-11-15 20:33 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-15 18:42 - 2013-11-15 18:42 - 104464595 _____ C:\Windows\system32\츹풡b
2013-11-14 20:01 - 2013-11-14 20:01 - 104278918 _____ C:\Windows\system32\Ḹ샜j
2013-11-14 14:10 - 2010-05-29 18:53 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 14:07 - 2013-08-15 14:42 - 00000000 ____D C:\Windows\system32\MRT
2013-11-14 14:04 - 2010-08-02 20:38 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-14 06:59 - 2013-11-14 06:59 - 104179408 _____ C:\Windows\system32\䎉駍]
2013-11-13 19:16 - 2013-11-13 19:16 - 104136834 _____ C:\Windows\system32\䖟g
2013-11-11 10:38 - 2013-11-11 10:38 - 00001755 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-11-11 10:38 - 2013-11-11 10:37 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-11-11 10:38 - 2013-11-11 10:37 - 00000000 ____D C:\Program Files\iTunes
2013-11-11 10:37 - 2013-11-11 10:37 - 00000000 ____D C:\Program Files\iPod
2013-11-11 10:37 - 2010-11-26 10:17 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-11-11 09:38 - 2013-11-11 09:38 - 00000680 _____ C:\Users\Munira\Desktop\wichteln.txt
2013-11-11 05:50 - 2010-06-04 22:16 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-10 21:43 - 2013-11-10 21:43 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Lavasoft
2013-11-10 21:04 - 2013-11-10 21:04 - 00000000 ____D C:\Users\Munira\AppData\Roaming\LavasoftStatistics
2013-11-10 20:26 - 2013-11-10 20:26 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-11-10 20:26 - 2013-11-10 20:25 - 00000000 ____D C:\Program Files\Lavasoft
2013-11-10 20:24 - 2013-11-10 20:24 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2013-11-10 20:22 - 2013-11-10 20:22 - 00000000 ____D C:\ProgramData\Lavasoft
2013-11-10 20:00 - 2010-05-29 19:01 - 00000000 ____D C:\Program Files\Creative
2013-11-10 20:00 - 2010-05-29 18:49 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-10 19:58 - 2013-01-20 17:06 - 00000000 ____D C:\Program Files\HandyBits
2013-11-10 19:58 - 2012-05-03 08:03 - 00000000 ____D C:\ProgramData\Screentime
2013-11-10 19:57 - 2010-05-29 18:55 - 00000000 ____D C:\Program Files\Common Files\Roxio Shared
2013-11-10 19:57 - 2010-05-29 18:55 - 00000000 ____D C:\Program Files\Common Files\PX Storage Engine
2013-11-10 19:56 - 2013-11-10 19:56 - 00000000 ____D C:\Users\Munira\AppData\Roaming\Roxio Log Files
2013-11-10 19:56 - 2010-05-29 18:55 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2013-11-10 19:42 - 2013-11-10 19:42 - 00000000 ____D C:\Users\Munira\AppData\Local\Google
2013-11-09 19:37 - 2013-11-09 19:37 - 103387443 _____ C:\Windows\system32\Ꞥj
2013-11-05 07:31 - 2013-11-05 07:31 - 105017276 _____ C:\Windows\system32\濆詵`

Some content of TEMP:
====================
C:\Users\Munira\AppData\Local\Temp\avgnt.exe
C:\Users\Munira\AppData\Local\Temp\catchme.dll
C:\Users\Munira\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-30 12:34

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-03 21:19:52
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.01.0 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Munira\AppData\Local\Temp\pfloyaow.sys


---- System - GMER 2.1 ----

SSDT            8E740EAE                                                                                    ZwCreateSection
SSDT            8E740EB8                                                                                    ZwRequestWaitReplyPort
SSDT            8E740EB3                                                                                    ZwSetContextThread
SSDT            8E740EBD                                                                                    ZwSetSecurityObject
SSDT            8E740EC2                                                                                    ZwSystemDebugControl
SSDT            8E740E4F                                                                                    ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                    82C3EA15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                      82C78212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                         82C7F58C 4 Bytes  [AE, 0E, 74, 8E] {SCASB ; PUSH CS; JZ 0xffffff92}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                         82C7F92C 4 Bytes  [B3, 0E, 74, 8E] {MOV BL, 0xe; JZ 0xffffff92}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                         82C7F9A8 4 Bytes  [BD, 0E, 74, 8E]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 166F                                                         82C7FA04 4 Bytes  [4F, 0E, 74, 8E] {DEC EDI; PUSH CS; JZ 0xffffff92}

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] kernel32.dll!FindResourceW     75545517 5 Bytes  JMP 0042B700 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] kernel32.dll!FindResourceA     7554A4BD 5 Bytes  JMP 0042B6C0 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] user32.DLL!LoadStringA         76CA66A7 5 Bytes  JMP 0042B990 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] user32.DLL!LoadStringW         76CADFBA 5 Bytes  JMP 0042B8E0 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] user32.DLL!LoadMenuW           76CAF214 5 Bytes  JMP 0042B880 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] user32.DLL!LoadMenuA           76CBF92C 5 Bytes  JMP 0042B820 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] user32.DLL!CreateDialogParamA  76CC1F42 5 Bytes  JMP 0042B740 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text           C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[4040] user32.DLL!CreateDialogParamW  76CD5630 5 Bytes  JMP 0042B7B0 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                     Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                     Wdf01000.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                    fltmgr.sys

---- EOF - GMER 2.1 ----