buzzsearch, medfos, nextlive, isafe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by leventselin on 14.02.2014 at 21:05:10,83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Failed to stop: [Service] update buzzsearch 
Failed to stop: [Service] util buzzsearch 



~~~ Registry Values

Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B?

    Value Name          Type                             Value Data                     
========================================================================================
    NextLive    REG_SZ    C:\Windows\system32\rundll32.exe "C:\Users\leventselin\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l




~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\leventselin\AppData\Roaming\isafe"
Failed to delete: [Folder] "C:\Program Files\buzzsearch"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.02.2014 at 21:09:02,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by leventselin (administrator) on LEVENTSELIN-PC on 14-02-2014 21:15:32
Running from C:\Users\leventselin\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor Corp.) C:\Users\leventselin\AppData\Local\Temp\RtkBtMnt.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
(ALWIL Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
() C:\Program Files\BuzzSearch\updateBuzzSearch.exe
() C:\Program Files\BuzzSearch\bin\utilBuzzSearch.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
() C:\Users\leventselin\Desktop\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ArcadeDeluxeAgent] - C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [156968 2009-01-21] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] - C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [202024 2009-01-21] (CyberLink)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-06-02] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6793760 2009-02-19] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2009-07-25] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.)
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1069576 2009-06-25] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] - C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-07-18] (Google)
HKLM\...\Run: [avast5] - C:\Program Files\Alwil Software\Avast5\AvastUI.exe [2654512 2009-11-30] (ALWIL Software)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [mobilegeni daemon] - C:\Program Files\Mobogenie\DaemonProcess.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [HP Officejet 4620 series (NET)] - C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [1837672 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2009-09-25] (Google Inc.)
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Run: [NextLive] - C:\Windows\system32\rundll32.exe "C:\Users\leventselin\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\MountPoints2: E - E:\Startme.exe
HKU\S-1-5-21-4267556834-3036584347-456527383-1000\...\MountPoints2: {de80fdd9-74ef-11e0-ba2a-001f16b73885} - E:\Startme.exe
Startup: C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop_01031103.lnk
ShortcutTarget: lollipop_01031103.lnk -> C:\Users\leventselin\AppData\Local\Lollipop\lollipop_01031103.exe (No File)
Startup: C:\Users\leventselin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x209D56E0FE40CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com.tr/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE346DE346
SearchScopes: HKCU - {96AEF64D-9E1E-4F83-9964-2B721427C3A0} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {A00E8FBF-6496-4412-B6DA-5BE71196B00E} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {B919971D-9DEC-4C69-89A0-3757257566A3} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F91BE375-4164-4484-99E2-EEEC62D609B0} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: No Name - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -  No File
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} -  No File
BHO: No Name - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -  No File
Toolbar: HKLM - No Name - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll No File
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 36 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\leventselin\AppData\Roaming\Mozilla\Firefox\Profiles\t7xl4zj4.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll No File
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll No File
FF Plugin: @microsoft.com/OfficeLive,version=1.3 - C:\Program Files\Microsoft\Office Live\npOLW.dll No File
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll No File
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll No File
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

Chrome: 
=======
CHR HomePage: hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874
CHR RestoreOnStartup: "hxxp://www.nationzoom.com/?type=hp&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874"
CHR DefaultSearchKeyword: nationzoom
CHR DefaultSearchProvider: nationzoom
CHR DefaultSearchURL: hxxp://www.nationzoom.com/web/?type=ds&ts=1388696590&from=adks&uid=WDCXWD5000BEVT-22ZAT0_WD-WX30A691287412874&q={searchTerms}
CHR Extension: (Widget context) - C:\Users\leventselin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-08]
CHR HKLM\...\Chrome\Extension: [jhjjdgbhohaallcimgcmakfiobacimkm] - C:\Program Files\BuzzSearch\jhjjdgbhohaallcimgcmakfiobacimkm.crx [2014-01-08]
CHR HKLM\...\Chrome\Extension: [lkemddiljapcmhicklfpcbpfffahfbja] - C:\Users\leventselin\AppData\Local\Google\Chrome\User Data\Default\extensions\WebNavigation.crx [2012-12-13]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2009-11-30] (ALWIL Software)
R3 avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384 2009-11-30] (ALWIL Software)
S3 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-07-18] (Google)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
R2 Update BuzzSearch; C:\Program Files\BuzzSearch\updateBuzzSearch.exe [80672 2014-02-13] ()
R2 Util BuzzSearch; C:\Program Files\BuzzSearch\bin\utilBuzzSearch.exe [80672 2014-02-13] ()

==================== Drivers (Whitelisted) ====================

R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.)
R2 aswFsBlk; C:\Windows\system32\Drivers\aswFsBlk.sys [19024 2009-11-30] (ALWIL Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [51792 2009-11-30] (ALWIL Software)
R1 aswRdr; C:\Windows\system32\Drivers\aswRdr.sys [23248 2009-11-30] (ALWIL Software)
R1 aswSP; C:\Windows\system32\Drivers\aswSP.sys [149840 2009-11-30] (ALWIL Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [46544 2009-11-30] (ALWIL Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-19] (Avira Operations GmbH & Co. KG)
S3 DCamUSBEMPIA; C:\Windows\System32\DRIVERS\emDevice.sys [171136 2007-06-21] (eMPIA Technology, Inc.)
S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [24448 2007-10-26] (eMPIA Technology, Inc.)
S3 FiltUSBEMPIA; C:\Windows\System32\DRIVERS\emFilter.sys [5248 2007-06-21] (eMPIA Technology, Inc.)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [154272 2008-11-12] (Realtek Semiconductor Corp.)
S3 ScanUSBEMPIA; C:\Windows\System32\DRIVERS\emScan.sys [5120 2007-06-21] (eMPIA Technology, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-16] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [87536 2008-12-26] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S1 iSafeNetFilter; \??\C:\Program Files\iSafe\iSafeNetFilter.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-14 21:15 - 2014-02-14 21:15 - 00020226 _____ () C:\Users\leventselin\Desktop\FRST.txt
2014-02-14 21:15 - 2014-02-14 21:15 - 00000000 ____D () C:\FRST
2014-02-14 21:14 - 2014-02-14 21:14 - 01141248 _____ (Farbar) C:\Users\leventselin\Desktop\FRST.exe
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setupact.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000484 _____ () C:\Users\leventselin\Desktop\defogger_disable.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000000 _____ () C:\Users\leventselin\defogger_reenable
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe
2014-02-14 21:09 - 2014-02-14 21:09 - 00001474 _____ () C:\Users\leventselin\Desktop\JRT.txt
2014-02-14 20:57 - 2014-02-14 20:57 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-14 20:57 - 2014-02-14 20:57 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-14 20:47 - 2014-02-14 20:47 - 00014378 _____ () C:\Windows\PFRO.log
2014-02-14 12:10 - 2014-02-14 12:10 - 01037530 _____ (Thisisu) C:\Users\leventselin\Desktop\JRT.exe
2014-02-14 12:10 - 2014-02-14 12:10 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 12:02 - 2014-02-14 21:00 - 00000000 ____D () C:\AdwCleaner
2014-02-14 12:01 - 2014-02-14 12:01 - 01166132 _____ () C:\Users\leventselin\Desktop\adwcleaner.exe
2014-02-14 10:43 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 10:43 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 10:43 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 10:43 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 10:43 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 10:43 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 10:43 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 10:43 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 10:43 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 10:43 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 10:43 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 10:43 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-14 10:43 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 00:56 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\eCyber
2014-01-30 00:47 - 2014-01-30 00:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-01-24 12:49 - 2014-01-24 12:49 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-01-24 12:49 - 2014-01-24 12:49 - 00000000 ____D () C:\ProgramData\Oracle

==================== One Month Modified Files and Folders =======

2014-02-14 21:15 - 2014-02-14 21:15 - 00020226 _____ () C:\Users\leventselin\Desktop\FRST.txt
2014-02-14 21:15 - 2014-02-14 21:15 - 00000000 ____D () C:\FRST
2014-02-14 21:14 - 2014-02-14 21:14 - 01141248 _____ (Farbar) C:\Users\leventselin\Desktop\FRST.exe
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-14 21:14 - 2014-02-14 21:14 - 00000000 _____ () C:\Windows\setupact.log
2014-02-14 21:14 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-14 21:14 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-14 21:13 - 2014-02-14 21:13 - 00000484 _____ () C:\Users\leventselin\Desktop\defogger_disable.log
2014-02-14 21:13 - 2014-02-14 21:13 - 00000000 _____ () C:\Users\leventselin\defogger_reenable
2014-02-14 21:13 - 2009-09-25 16:50 - 00000000 ____D () C:\Users\leventselin
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe
2014-02-14 21:09 - 2014-02-14 21:09 - 00001474 _____ () C:\Users\leventselin\Desktop\JRT.txt
2014-02-14 21:07 - 2011-11-01 20:06 - 01356469 _____ () C:\Windows\WindowsUpdate.log
2014-02-14 21:06 - 2013-11-20 21:21 - 00000000 ____D () C:\Program Files\BuzzSearch
2014-02-14 21:04 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\newnext.me
2014-02-14 21:02 - 2009-12-11 21:20 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-14 21:02 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-14 21:01 - 2006-11-02 14:01 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-14 21:00 - 2014-02-14 12:02 - 00000000 ____D () C:\AdwCleaner
2014-02-14 20:58 - 2009-10-25 11:56 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Mozilla
2014-02-14 20:57 - 2014-02-14 20:57 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-14 20:57 - 2014-02-14 20:57 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-14 20:57 - 2014-01-02 22:38 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-14 20:53 - 2012-04-22 21:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-14 20:47 - 2014-02-14 20:47 - 00014378 _____ () C:\Windows\PFRO.log
2014-02-14 20:43 - 2011-05-26 13:14 - 00000000 ____D () C:\Program Files\Samsung
2014-02-14 20:42 - 2009-02-11 21:16 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-02-14 20:39 - 2014-01-02 22:03 - 00000000 ____D () C:\ProgramData\WPM
2014-02-14 20:37 - 2011-09-15 18:15 - 00000000 ____D () C:\ProgramData\Norton
2014-02-14 20:35 - 2014-01-02 21:35 - 00000000 ____D () C:\Users\leventselin\AppData\Local\Mobogenie
2014-02-14 20:33 - 2011-05-26 13:16 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\Samsung
2014-02-14 20:33 - 2011-05-26 13:16 - 00000000 ____D () C:\Program Files\PC Connectivity Solution
2014-02-14 20:15 - 2012-12-13 14:38 - 00000000 ____D () C:\ProgramData\Zbshareware Lab
2014-02-14 20:13 - 2009-03-12 03:59 - 00000000 ____D () C:\Program Files\Acer GameZone
2014-02-14 19:47 - 2009-12-11 21:20 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-14 14:43 - 2011-01-22 22:32 - 00001022 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-02-14 12:30 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-14 12:11 - 2014-01-02 21:35 - 00008713 _____ () C:\Users\leventselin\daemonprocess.txt
2014-02-14 12:10 - 2014-02-14 12:10 - 01037530 _____ (Thisisu) C:\Users\leventselin\Desktop\JRT.exe
2014-02-14 12:10 - 2014-02-14 12:10 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 12:04 - 2009-10-25 11:56 - 00000000 ____D () C:\ProgramData\ICQ
2014-02-14 12:01 - 2014-02-14 12:01 - 01166132 _____ () C:\Users\leventselin\Desktop\adwcleaner.exe
2014-02-14 11:03 - 2006-11-02 11:33 - 01469650 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-14 10:59 - 2013-08-15 14:56 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 10:53 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-13 22:39 - 2014-01-02 21:36 - 00000000 ____D () C:\Users\leventselin\AppData\Local\cache
2014-02-13 22:38 - 2014-01-02 21:35 - 00000000 ____D () C:\Users\leventselin\AppData\Local\genienext
2014-02-13 22:27 - 2012-04-22 21:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-13 22:27 - 2011-09-16 13:48 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-13 22:25 - 2009-12-03 22:04 - 00000000 ____D () C:\Users\leventselin\AppData\Local\Adobe
2014-02-10 19:31 - 2012-10-21 14:32 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 19:30 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-02-10 19:13 - 2014-02-10 19:13 - 00000000 ____D () C:\Users\leventselin\AppData\Roaming\eCyber
2014-02-10 18:55 - 2009-09-29 13:13 - 00000000 ____D () C:\Users\leventselin\Tracing
2014-02-09 21:58 - 2009-10-05 14:52 - 00007160 _____ () C:\Users\leventselin\AppData\Local\d3d9caps.dat
2014-02-05 09:58 - 2014-02-14 10:43 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-14 10:43 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-14 10:43 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-14 10:43 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-14 10:43 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-14 10:43 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-14 10:43 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-14 10:43 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-14 10:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-14 10:43 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-14 10:43 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-14 10:43 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-14 10:43 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-01-30 00:47 - 2014-01-30 00:47 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-01-30 00:46 - 2006-11-02 12:18 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-01-24 12:49 - 2014-01-24 12:49 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-24 12:49 - 2014-01-24 12:49 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-01-24 12:49 - 2014-01-24 12:49 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-24 12:49 - 2009-09-29 11:56 - 00000000 ____D () C:\Program Files\Java
2014-01-16 22:44 - 2009-03-12 04:11 - 00000000 ____D () C:\ProgramData\Microsoft Help

Files to move or delete:
====================
C:\Users\leventselin\SkypeSetupFull.exe
C:\Users\Public\AlexaNSISPlugin.4744.dll


Some content of TEMP:
====================
C:\Users\leventselin\AppData\Local\Temp\avgnt.exe
C:\Users\leventselin\AppData\Local\Temp\Quarantine.exe
C:\Users\leventselin\AppData\Local\Temp\RtkBtMnt.exe
C:\Users\leventselin\AppData\Local\Temp\SPSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-14 21:08

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2014 01
Ran by leventselin at 2014-02-14 21:15:55
Running from C:\Users\leventselin\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Out of date) {C37D8F93-0602-E43C-40AA-47DAD597F308}
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: avast! Antivirus (Enabled - Out of date) {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (Version:  - Microsoft)
Acer Arcade Deluxe (Version: 2.5.6121 - CyberLink Corp.)
Acer Arcade Deluxe (Version: 2.5.6121 - CyberLink Corp.) Hidden
Acer Backup Manager (Version: 1.0.0.58 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.74.216 (Version: 1.1.74.216 - Chicony Electronics Co.,Ltd.)
Acer eRecovery Management (Version: 4.00.3008 - Acer Incorporated)
Acer GridVista (Version: 2.72.317 - )
Acer PowerSmart Manager (Version: 4.01.3016 - Acer Incorporated)
Acer Product Registration (Version: 3.0.0.10 - Acer Incorporated)
Acer ScreenSaver (Version: 1.0.0.0226 - Acer)
Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8 - Adobe Systems Incorporated)
Airport Mania First Flight (Version:  - Oberon Media)
Amazon Browser Settings (Version: 3.0 - Amazon)
Apple Application Support (Version: 2.2.2 - Apple Inc.)
Apple Mobile Device Support (Version: 6.0.0.59 - Apple Inc.)
Apple Software Update (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (Version: 3.0.728.0 - ATI Technologies, Inc.)
avast! Free Antivirus (Version: 5.0.259.0 - Alwil Software)
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Backup Manager Basic (Version: 1.0.0.58 - NewTech Infosystems) Hidden
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Broadcom Gigabit NetLink Controller (Version: 11.34.02 - Broadcom Corporation)
C:\Program Files\Acer GameZone\GameConsole (Version: 2.0.1.6 - Oberon Media, Inc.)
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Full New (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Light (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (Version: 2009.0602.2224.38408 - ATI) Hidden
Catalyst Control Center Localization All (Version: 2009.0602.2224.38408 - ATI) Hidden
CCC Help Chinese Standard (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Czech (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Danish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Dutch (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help English (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Finnish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help French (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help German (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Greek (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Hungarian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Italian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Japanese (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Korean (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Norwegian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Polish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Portuguese (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Russian (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Spanish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Swedish (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Thai (Version: 2009.0602.2223.38408 - ATI) Hidden
CCC Help Turkish (Version: 2009.0602.2223.38408 - ATI) Hidden
ccc-core-static (Version: 2009.0602.2224.38408 - Ihr Firmenname) Hidden
ccc-utility (Version: 2009.0602.2224.38408 - ATI) Hidden
CCleaner (Version: 2.32 - Piriform)
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000 - Microsoft Corporation)
Cooking Dash (Version:  - Oberon Media)
Cradle of Rome (Version:  - Oberon Media)
CVE-2012-4969 (Version:  - )
Dairy Dash (Version:  - Oberon Media)
eSobi v2 (Version: 2.0.3.000223 - esobi Inc.)
eSobi v2 (Version: 2.0.3.000223 - esobi Inc.) Hidden
Galapago (Version:  - Oberon Media)
Google Apps (Version: 1.2.279.2381 - Google Inc.)
Google Chrome (Version: 32.0.1700.107 - Google Inc.)
Google Desktop (Version: 5.9.1005.12335 - Google)
Google Earth (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
Google Updater (Version: 2.4.2432.1652 - Google Inc.)
HDAUDIO Soft Data Fax Modem with SmartCP (Version: 7.80.2.53 - Conexant Systems)
HP Officejet 4620 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (Version: 6.0.0 - Hewlett Packard)
HP Photo Creations (Version: 1.0.0.9572 - HP)
HP Update (Version: 5.003.003.001 - Hewlett-Packard)
I.R.I.S. OCR (Version: 12.3.4.0 - HP)
iTunes (Version: 10.7.0.21 - Apple Inc.)
Jewel Quest Solitaire (Version:  - Oberon Media)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Launch Manager (Version: 2.0.10 - Acer Inc.)
Luxor 2 (Version:  - Oberon Media)
Mahjong Escape Ancient China (Version:  - Oberon Media)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (Version: 27.0.1 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
NTI Backup Now 5 (Version: 5.1.2.616 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.616 - NewTech Infosystems) Hidden
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems) Hidden
Ocean Express (Version:  - Oberon Media)
Orion (Version: 2.5.0 - Convesoft)
Parking Dash (Version:  - Oberon Media)
PC Connectivity Solution (Version: 8.15.0.0 - Nokia)
Picasa 3 (Version: 3.9 - Google, Inc.)
Playway 3 Rainbow Edition - Lernsoftware zum Arbeitsheft (Version: 1.00.0000 - Ernst Klett Grundschulverlag GmbH)
Puzzle Express (Version:  - Oberon Media)
QuickTime (Version: 7.72.80.56 - Apple Inc.)
Realtek High Definition Audio Driver (Version: 6.0.1.5794 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (Version: 6.0.6000.20113 - Realtek Semiconductor Corp.)
Skins (Version: 2009.0602.2224.38408 - ATI) Hidden
Studie zur Verbesserung von HP Officejet 4620 series Produkten (Version: 28.0.1315.0 - Hewlett-Packard Co.)
SweetIM for Messenger 2.8 (Version: 2.8.0012 - SweetIM Technologies Ltd.) <==== ATTENTION
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (Version: 12.1.0.0 - Synaptics)
Tradewinds 2 (Version:  - Oberon Media)
Update for 2007 Microsoft Office System (KB967642) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (Version:  - Microsoft)
WAS IST WAS - Wissen von A-Z (Version:  - )
Windows Live Call (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8118.427 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (Version: 10/12/2007 6.85.4.0 - Nokia)
WinRAR 4.20 (32-Bit) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

11-12-2013 11:24:23 Windows Update
11-12-2013 23:52:42 Geplanter Prüfpunkt
14-12-2013 01:14:07 Geplanter Prüfpunkt
15-12-2013 19:45:17 Geplanter Prüfpunkt
19-12-2013 13:03:33 Geplanter Prüfpunkt
21-12-2013 00:17:39 Geplanter Prüfpunkt
24-12-2013 20:05:51 Geplanter Prüfpunkt
26-12-2013 22:02:32 Geplanter Prüfpunkt
28-12-2013 20:39:16 Geplanter Prüfpunkt
29-12-2013 12:01:20 Windows Update
30-12-2013 01:21:53 Removed Bing Bar
30-12-2013 01:28:53 Microsoft Works wird entfernt
30-12-2013 01:31:43 Windows Live ID-Anmelde-Assistent wird entfernt
30-12-2013 01:32:36 Removed Skype™ 6.1
30-12-2013 20:38:09 Windows Update
02-01-2014 13:16:38 Geplanter Prüfpunkt
05-01-2014 12:26:15 Windows Update
16-01-2014 21:21:56 Windows Update
19-01-2014 21:43:22 Windows Update
24-01-2014 11:47:15 Installed Java 7 Update 51
31-01-2014 01:07:03 Geplanter Prüfpunkt
02-02-2014 02:51:12 Geplanter Prüfpunkt
05-02-2014 13:25:06 Geplanter Prüfpunkt
12-02-2014 10:52:00 Windows Update
14-02-2014 09:42:13 Windows Update
14-02-2014 19:05:28 TuneUp Utilities 2009 wird entfernt
14-02-2014 19:15:53 Removed SweetIM Toolbar for Internet Explorer 3.6
14-02-2014 19:16:23 Removed SweetIM for Messenger 2.8
14-02-2014 19:31:20 Entfernt Samsung New PC Studio
14-02-2014 19:38:00 Removed Shopop
14-02-2014 19:42:23 Entfernt Samsung New PC Studio USB Driver Installer
14-02-2014 19:43:05 SamsungConnectivityCableDriver wird entfernt
14-02-2014 19:44:42 Konfiguriert USB Video/Audio Driver

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {190B42EA-EBD0-4938-95BD-EA953E34521B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-11] (Google Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {6286A21F-42DB-4C26-AD1E-F51CE7E55A67} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-11] (Google Inc.)
Task: {63B37A96-3CE3-4CC9-B73F-95BAEC4ECD15} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {843D5E54-A220-44CB-A1E7-B18ED7CE416C} - System32\Tasks\Java Update Scheduler => C:\Program Files\Java\jre6\bin\jusched.exe
Task: {8A62FE54-7D15-45C0-B4C4-59C29D668007} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-13] (Adobe Systems Incorporated)
Task: {904277F9-3992-4EB0-A332-52EB187234DF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {C334543B-471D-4537-8FFF-468AD3680E1F} - System32\Tasks\HPCustParticipation HP Officejet 4620 series => C:\Program Files\HP\HP Officejet 4620 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {CBD12794-AD90-4585-A6D5-052C62D9C0EA} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-08-11] (Google)
Task: {DD1E151E-E422-45C4-9DD4-C804AC7637F4} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-04-20] (Acer)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2009-07-25 16:03 - 2009-06-03 08:42 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2009-01-21 00:41 - 2009-01-21 00:41 - 00872448 _____ () C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMediaLibrary.dll
2009-01-21 00:41 - 2009-01-21 00:41 - 00007680 _____ () C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvcPS.dll
2009-07-25 07:31 - 2009-07-25 07:31 - 00200704 _____ () C:\Windows\PLFSetI.exe
2009-07-25 16:05 - 2003-06-07 22:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll
2009-02-02 16:33 - 2009-02-02 16:33 - 00460199 _____ () C:\Program Files\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2012-08-27 20:33 - 2012-08-27 20:33 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 20:33 - 2012-08-27 20:33 - 01242512 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-07-25 07:29 - 2009-07-25 07:29 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2009-03-31 16:45 - 2009-03-31 16:45 - 00016384 ____R () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-07-25 07:29 - 2009-07-25 07:29 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-02-14 20:57 - 2014-02-13 01:36 - 03578992 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-02-14 21:12 - 2014-02-14 21:12 - 00050477 _____ () C:\Users\leventselin\Desktop\Defogger.exe

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:3064D21D
AlternateDataStreams: C:\ProgramData\Temp:35759C73
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:798A3728
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:B203B914
AlternateDataStreams: C:\ProgramData\Temp:B623B5B8
AlternateDataStreams: C:\ProgramData\Temp:BB24555F
AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE
AlternateDataStreams: C:\ProgramData\Temp:CE0A077E

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-12-22 14:03:06.424
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\aswSP.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-06 11:51:49.719
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-06 11:51:49.143
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 39%
Total physical RAM: 3065.9 MB
Available physical RAM: 1851.39 MB
Total Pagefile: 6362.09 MB
Available Pagefile: 4892.28 MB
Total Virtual: 2047.88 MB
Available Virtual: 1899 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:455.99 GB) (Free:329.47 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 127688D2)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=456 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-14 21:45:39
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: q9lldqdo.exe; Driver: C:\Users\LEVENT~1\AppData\Local\Temp\kxryipog.sys


---- System - GMER 2.1 ----

SSDT            8D06DE56                                                           ZwCreateSection
SSDT            8D06DE60                                                           ZwRequestWaitReplyPort
SSDT            8D06DE5B                                                           ZwSetContextThread
SSDT            8D06DE65                                                           ZwSetSecurityObject
SSDT            8D06DE6A                                                           ZwSystemDebugControl
SSDT            8D06DDF7                                                           ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 215                                      828C4860 4 Bytes  [56, DE, 06, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 539                                      828C4B84 4 Bytes  [60, DE, 06, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 56D                                      828C4BB8 4 Bytes  [5B, DE, 06, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 5D1                                      828C4C1C 4 Bytes  [65, DE, 06, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 619                                      828C4C64 4 Bytes  [6A, DE, 06, 8D]
.text           ...                                                                
.text           C:\Windows\system32\DRIVERS\atikmdag.sys                           section is writeable [0x8E80C000, 0x2C81C4, 0xE8000020]
.text           C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl              section is writeable [0xA1EFF000, 0x2892, 0xE8000020]
.vmp2           C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl              entry point in ".vmp2" section [0xA1F22050]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                            Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                            Wdf01000.sys
AttachedDevice  \Driver\tdx \Device\Tcp                                            aswTdi.SYS
AttachedDevice  \Driver\tdx \Device\Udp                                            aswTdi.SYS
AttachedDevice  \FileSystem\fastfat \Fat                                           fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Antivirus@Sources  ?avas
Reg             HKLM\SYSTEM\ControlSet003\Services\Eventlog\Antivirus@Sources      ?avas

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                              unknown MBR code

---- EOF - GMER 2.1 ----