Amazon, angeblich unbefugter Zugriff

# AdwCleaner v3.019 - Bericht erstellt am 21/02/2014 um 15:26:25
# Aktualisiert 17/02/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : windows - WINDOWS-PC
# Gestartet von : C:\Users\windows\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files\icqtoolbar
Ordner Gelöscht : C:\Users\windows\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\ICQToolbarData
Ordner Gelöscht : C:\Program Files\Mozilla Firefox\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
Datei Gelöscht : C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\icqplugin-4.xml
Datei Gelöscht : C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\icqplugin-5.xml

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3EDA540-A220-47EA-B2FD-5E0A51473F38}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v8.0.6001.18828


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\prefs.js ]

Zeile gelöscht : user_pref("extentions.y2layers.installId", "D00175A9-5FFA-C9EA-C6F0-75E4327A5AEC");
Zeile gelöscht : user_pref("extentions.y2layers.installId_backup", "D00175A9-5FFA-C9EA-C6F0-75E4327A5AEC");

*************************

AdwCleaner[R0].txt - [3201 octets] - [21/02/2014 15:24:44]
AdwCleaner[S0].txt - [3128 octets] - [21/02/2014 15:26:25]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3188 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by windows on 21.02.2014 at 15:53:35,21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1550ED1C-EDB3-46D7-A209-652B2EFD66A9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{312C3B88-6E86-4AFC-AEBD-14EFB011FC67}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B3D2E19F-A5B7-428A-99AE-4E8267852D6A}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{1550ED1C-EDB3-46D7-A209-652B2EFD66A9}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{312C3B88-6E86-4AFC-AEBD-14EFB011FC67}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"



~~~ FireFox

Successfully deleted the following from C:\Users\windows\AppData\Roaming\mozilla\firefox\profiles\7yxnk5jc.default\prefs.js

user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchBlogs\" t
user_pref("google.toolbar.button_option.cached.gtbSearchPhotos", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchPhotos\"
user_pref("google.toolbar.button_option.cached.gtbSearchScholar", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul\" id=\"gtbSearchScholar
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_CTK0Y7F4MTG6NKYH03WT-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
user_pref("google.toolbar.button_option.cached.gtbstoolbar-google-com_J66T77NJDBMW4FEUU7FA-xml", "<toolbarbutton xmlns=\"hxxp://www.mozilla.org/keymaster/gatekeeper/there.is.o
user_pref("google.toolbar.search-icon", "data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7PT7/3zF6/9Ptu//RbHx/
Emptied folder: C:\Users\windows\AppData\Roaming\mozilla\firefox\profiles\7yxnk5jc.default\minidumps [249 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.02.2014 at 15:57:34,25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-02-2014
Ran by windows (administrator) on WINDOWS-PC on 21-02-2014 16:05:49
Running from C:\Users\windows\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
() C:\Program Files\Browser Mouse\Mouse32V.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Apple Inc.) C:\Program Files\QuickTime\QTTask.exe
() C:\Program Files\Lexmark Pro200-S500 Series\lxebmon.exe
() C:\Program Files\Lexmark Pro200-S500 Series\ezprint.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Lexmark International, Inc.) C:\Windows\system32\spool\DRIVERS\W32X86\3\lxebserv.exe
( ) C:\Windows\system32\lxebcoms.exe
() C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
() C:\Users\windows\AppData\LocalLow\pdfEngine\IE\pdfEngineUpdater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4874240 2008-01-15] (Realtek Semiconductor)
HKLM\...\Run: [SunJavaUpdateReg] - C:\Windows\system32\jureg.exe [54936 2007-04-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [FLMOFFICE4DMOUSE] - C:\Program Files\Browser Mouse\Mouse32V.exe [465920 2008-03-26] ()
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [178712 2008-06-02] (Intel Corporation)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2010-03-17] (Apple Inc.)
HKLM\...\Run: [lxebmon.exe] - C:\Program Files\Lexmark Pro200-S500 Series\lxebmon.exe [770728 2011-01-23] ()
HKLM\...\Run: [EzPrint] - C:\Program Files\Lexmark Pro200-S500 Series\ezprint.exe [148280 2011-01-23] ()
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKU\.DEFAULT\...\Run: [InfoCockpit] - C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE [268800 2009-04-29] (Deutsche Telekom AG, T-Com)
HKU\S-1-5-21-3854617978-468262528-980198106-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3854617978-468262528-980198106-1000\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3854617978-468262528-980198106-1000\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2008-05-04] (Google Inc.)
HKU\S-1-5-21-3854617978-468262528-980198106-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3854617978-468262528-980198106-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3854617978-468262528-980198106-1000\...\Policies\Explorer: [NoLogoff] 0
Startup: C:\Users\windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zahlungserinnerung.lnk
ShortcutTarget: Zahlungserinnerung.lnk -> C:\Profi cash\wzed.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF734C481A2C3CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://de.msn.com/
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
BHO: pdfEngine - {435405E9-1E2A-447F-9930-652D5700BD55} - C:\Users\windows\AppData\LocalLow\pdfEngine\IE\pdfEngine.dll (Adobe Systems Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: Lexmark  - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll ()
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKLM - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: {80AEEC0E-A2BE-4B8D-985F-350FE869DC40} hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsVista.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF SearchEngineOrder.1: Ask Search
FF Homepage: hxxp://www.handelsblatt.com
FF NetworkProxy: "no_proxies_on", "*.local"
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\Extensions\nostmp [2011-08-16]
FF Extension: pdfEngine - C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\Extensions\pdfengine@adobe.com [2011-12-26]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-07-17]
FF Extension: GMX MailCheck - C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\Extensions\toolbar@gmx.net.xpi [2012-09-26]
FF Extension: Adobe DLM (powered by getPlus(R)) - C:\Users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\7yxnk5jc.default\Extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}.xpi [2010-10-04]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-02-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2014-02-18]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536 2007-09-19] (Hewlett-Packard)
R2 lxebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxebserv.exe [193192 2010-04-14] (Lexmark International, Inc.)
R2 lxeb_device; C:\Windows\system32\lxebcoms.exe [598696 2010-04-14] ( )
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 OMSI download service; C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 pdfEngineUpdater; C:\Users\windows\AppData\LocalLow\pdfEngine\IE\pdfEngineUpdater.exe [18432 2011-12-15] ()
S3 wbengine; "%systemroot%\system32\wbengine.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 a016bus; C:\Windows\System32\DRIVERS\a016bus.sys [83880 2008-01-18] (MCCI Corporation)
S3 a016mdfl; C:\Windows\System32\DRIVERS\a016mdfl.sys [15016 2008-01-18] (MCCI Corporation)
S3 a016mdm; C:\Windows\System32\DRIVERS\a016mdm.sys [110504 2008-01-18] (MCCI Corporation)
S3 a016mgmt; C:\Windows\System32\DRIVERS\a016mgmt.sys [104488 2008-01-18] (MCCI Corporation)
S3 a016obex; C:\Windows\System32\DRIVERS\a016obex.sys [100648 2008-01-18] (MCCI Corporation)
R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [277544 2009-01-19] (Protect Software GmbH)
R0 AFS; C:\Windows\system32\Drivers\AFS.sys [77004 2011-01-20] (Oak Technology Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 MDC8021X; C:\Windows\System32\DRIVERS\mdc8021x.sys [15781 2008-03-28] (Meetinghouse Data Communications)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
S3 MTOnlPktAlyX; C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys [17536 2006-10-09] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
S3 s116bus; C:\Windows\System32\DRIVERS\s116bus.sys [83336 2007-04-03] (MCCI Corporation)
S3 s116mdfl; C:\Windows\System32\DRIVERS\s116mdfl.sys [15112 2007-04-03] (MCCI Corporation)
S3 s116mdm; C:\Windows\System32\DRIVERS\s116mdm.sys [108680 2007-04-03] (MCCI Corporation)
S3 s116mgmt; C:\Windows\System32\DRIVERS\s116mgmt.sys [100488 2007-04-03] (MCCI Corporation)
S3 s116nd5; C:\Windows\System32\DRIVERS\s116nd5.sys [23176 2007-04-03] (MCCI Corporation)
S3 s116obex; C:\Windows\System32\DRIVERS\s116obex.sys [98696 2007-04-03] (MCCI Corporation)
S3 s116unic; C:\Windows\System32\DRIVERS\s116unic.sys [99080 2007-04-03] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2009-10-08] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-03-17] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\windows\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
R1 MpKsl88406ac7; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DC29A4B5-41BD-492E-8341-6C3F410FAE09}\MpKsl88406ac7.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PCD5SRVC{BD6912E3-AC9D80E8-05040000}; \??\C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [X]
S3 SymIMMP; system32\DRIVERS\SymIM.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-21 16:05 - 2014-02-21 16:05 - 00018396 _____ () C:\Users\windows\Desktop\FRST.txt
2014-02-21 16:04 - 2014-02-21 16:04 - 00000000 ____D () C:\Users\windows\Desktop\FRST-OlderVersion
2014-02-21 15:57 - 2014-02-21 15:57 - 00002860 _____ () C:\Users\windows\Desktop\JRT.txt
2014-02-21 15:52 - 2014-02-21 15:52 - 01037734 _____ (Thisisu) C:\Users\windows\Desktop\JRT.exe
2014-02-21 15:50 - 2014-02-21 15:50 - 00003268 _____ () C:\Users\windows\Desktop\AdwCleaner[S0].txt
2014-02-21 15:24 - 2014-02-21 15:33 - 00000000 ____D () C:\AdwCleaner
2014-02-21 15:24 - 2014-02-21 15:24 - 01241834 _____ () C:\Users\windows\Desktop\adwcleaner.exe
2014-02-20 19:09 - 2014-02-20 19:32 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-20 19:09 - 2014-02-20 19:09 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-20 19:08 - 2014-02-20 19:08 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-20 19:07 - 2014-02-20 19:33 - 00000000 ____D () C:\Users\windows\Desktop\mbar-1.07.0.1009
2014-02-20 19:05 - 2014-02-20 19:05 - 12589848 _____ (Malwarebytes Corp.) C:\Users\windows\Desktop\mbar-1.07.0.1009.exe
2014-02-19 19:32 - 2014-02-19 19:34 - 00037877 _____ () C:\Users\windows\Downloads\Addition.txt
2014-02-19 19:30 - 2014-02-21 16:05 - 00000000 ____D () C:\FRST
2014-02-19 19:30 - 2014-02-19 19:34 - 00029745 _____ () C:\Users\windows\Downloads\FRST.txt
2014-02-19 19:29 - 2014-02-21 16:04 - 01142784 _____ (Farbar) C:\Users\windows\Desktop\FRST.exe
2014-02-18 07:24 - 2014-02-18 07:25 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-12 16:16 - 2014-02-12 16:16 - 00002154 _____ () C:\Windows\epplauncher.mif
2014-02-12 16:16 - 2014-02-12 16:16 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-02-12 15:08 - 2014-02-12 15:08 - 00000000 ____D () C:\Windows\Profiles\Default
2014-02-11 18:54 - 2014-02-12 16:17 - 00043076 _____ () C:\Windows\wsusofflineupdate.log
2014-02-11 15:54 - 2014-02-12 18:43 - 00000000 ____D () C:\Users\windows\Downloads\wsusoffline89
2014-02-11 15:47 - 2014-02-11 15:47 - 02223602 _____ () C:\Users\windows\Downloads\wsusoffline89.zip
2014-02-08 09:50 - 2014-02-08 09:50 - 00141432 _____ () C:\Windows\Minidump\Mini020814-01.dmp
2014-01-28 17:11 - 2014-01-28 17:11 - 00000000 ____D () C:\Users\windows\AppData\Roaming\TeamViewer
2014-01-28 16:46 - 2014-01-28 16:46 - 00000000 ____D () C:\Users\windows\Documents\Forte
2014-01-28 16:46 - 2014-01-28 16:46 - 00000000 ____D () C:\Users\windows\AppData\Roaming\FORTE
2014-01-28 16:36 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-01-28 16:36 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-28 16:36 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-28 16:36 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-28 16:35 - 2014-01-28 16:45 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-28 16:34 - 2014-01-28 16:36 - 00005315 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log
2014-01-28 16:34 - 2008-12-11 16:15 - 00155648 _____ (Viscom Software www.viscomsoft.com) C:\Windows\system32\AudioCapture.ocx
2014-01-28 16:34 - 2008-12-08 00:19 - 00155648 _____ (Viscom Software www.viscomsoft.com) C:\Windows\system32\viscomwaveform.dll
2014-01-28 16:34 - 2004-08-04 07:00 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\msxml2.DLL
2014-01-28 16:34 - 2004-08-04 07:00 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\msxml.DLL
2014-01-28 16:34 - 2004-08-04 07:00 - 00037916 _____ (Microsoft Corporation) C:\Windows\system32\msxml2r.DLL
2014-01-28 16:34 - 2004-08-04 07:00 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\msxmlr.DLL
2014-01-28 16:34 - 2004-02-07 23:53 - 00856064 _____ (Essien Research & Development) C:\Windows\system32\mpgfiltr.ax
2014-01-28 16:34 - 2003-12-11 16:15 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\msxml4a.DLL
2014-01-28 16:34 - 2003-08-19 19:31 - 00081920 _____ (Viscom Software) C:\Windows\system32\viscomwave.dll
2014-01-24 18:18 - 2014-01-24 18:18 - 01069512 _____ (Solid State Networks) C:\Users\windows\Downloads\install_flashplayer12x32au_mssa_aaa_aih.exe

==================== One Month Modified Files and Folders =======

2014-02-21 16:06 - 2014-02-21 16:05 - 00018396 _____ () C:\Users\windows\Desktop\FRST.txt
2014-02-21 16:05 - 2014-02-19 19:30 - 00000000 ____D () C:\FRST
2014-02-21 16:04 - 2014-02-21 16:04 - 00000000 ____D () C:\Users\windows\Desktop\FRST-OlderVersion
2014-02-21 16:04 - 2014-02-19 19:29 - 01142784 _____ (Farbar) C:\Users\windows\Desktop\FRST.exe
2014-02-21 16:04 - 2008-03-26 16:36 - 00000000 ____D () C:\Users\windows
2014-02-21 16:01 - 2008-01-21 05:14 - 01914598 _____ () C:\Windows\WindowsUpdate.log
2014-02-21 15:57 - 2014-02-21 15:57 - 00002860 _____ () C:\Users\windows\Desktop\JRT.txt
2014-02-21 15:53 - 2013-04-01 11:32 - 00000000 ____D () C:\Windows\ERUNT
2014-02-21 15:52 - 2014-02-21 15:52 - 01037734 _____ (Thisisu) C:\Users\windows\Desktop\JRT.exe
2014-02-21 15:50 - 2014-02-21 15:50 - 00003268 _____ () C:\Users\windows\Desktop\AdwCleaner[S0].txt
2014-02-21 15:48 - 2012-04-24 15:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-21 15:40 - 2011-02-12 10:57 - 00181134 _____ () C:\ProgramData\lxebscan.log
2014-02-21 15:40 - 2009-12-25 20:26 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-21 15:40 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-21 15:40 - 2006-11-02 13:47 - 00003696 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-21 15:40 - 2006-11-02 13:47 - 00003696 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-21 15:40 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-02-21 15:37 - 2006-11-02 14:01 - 00032558 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-21 15:33 - 2014-02-21 15:24 - 00000000 ____D () C:\AdwCleaner
2014-02-21 15:26 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-02-21 15:24 - 2014-02-21 15:24 - 01241834 _____ () C:\Users\windows\Desktop\adwcleaner.exe
2014-02-21 15:24 - 2009-12-25 20:26 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-20 19:33 - 2014-02-20 19:07 - 00000000 ____D () C:\Users\windows\Desktop\mbar-1.07.0.1009
2014-02-20 19:32 - 2014-02-20 19:09 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-20 19:09 - 2014-02-20 19:09 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-02-20 19:08 - 2014-02-20 19:08 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-20 19:05 - 2014-02-20 19:05 - 12589848 _____ (Malwarebytes Corp.) C:\Users\windows\Desktop\mbar-1.07.0.1009.exe
2014-02-19 19:34 - 2014-02-19 19:32 - 00037877 _____ () C:\Users\windows\Downloads\Addition.txt
2014-02-19 19:34 - 2014-02-19 19:30 - 00029745 _____ () C:\Users\windows\Downloads\FRST.txt
2014-02-19 18:38 - 2011-02-12 12:09 - 00105391 _____ () C:\ProgramData\lxebJSW.log
2014-02-19 18:38 - 2011-02-12 11:28 - 00000000 ____D () C:\ProgramData\Lx_cats
2014-02-18 07:25 - 2014-02-18 07:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-12 19:44 - 2008-03-26 16:42 - 00000910 _____ () C:\Users\windows\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-02-12 18:43 - 2014-02-11 15:54 - 00000000 ____D () C:\Users\windows\Downloads\wsusoffline89
2014-02-12 16:31 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-12 16:27 - 2008-01-09 11:49 - 00000000 ____D () C:\Windows\system32\RTCOM
2014-02-12 16:26 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-02-12 16:26 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Windows Journal
2014-02-12 16:17 - 2014-02-11 18:54 - 00043076 _____ () C:\Windows\wsusofflineupdate.log
2014-02-12 16:16 - 2014-02-12 16:16 - 00002154 _____ () C:\Windows\epplauncher.mif
2014-02-12 16:16 - 2014-02-12 16:16 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-02-12 15:42 - 2006-11-02 13:37 - 00000000 ____D () C:\Program Files\Movie Maker
2014-02-12 15:25 - 2008-03-26 16:28 - 00360324 _____ () C:\Windows\PFRO.log
2014-02-12 15:24 - 2006-11-02 11:33 - 01569852 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 15:11 - 2011-05-07 19:42 - 00036865 _____ () C:\Windows\IE9_main.log
2014-02-12 15:10 - 2011-02-12 12:03 - 00000504 _____ () C:\ProgramData\FastPics.log
2014-02-12 15:08 - 2014-02-12 15:08 - 00000000 ____D () C:\Windows\Profiles\Default
2014-02-12 15:05 - 2008-01-09 19:54 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE
2014-02-11 19:11 - 2008-03-26 17:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-11 15:47 - 2014-02-11 15:47 - 02223602 _____ () C:\Users\windows\Downloads\wsusoffline89.zip
2014-02-09 10:11 - 2009-03-25 18:38 - 00001052 _____ () C:\Windows\Tasks\Google Software Updater.job
2014-02-08 10:48 - 2012-04-24 15:59 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-08 10:48 - 2011-10-01 09:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-08 10:05 - 2008-03-27 20:28 - 00002591 _____ () C:\Users\windows\Desktop\Microsoft Office Word 2007.lnk
2014-02-08 09:50 - 2014-02-08 09:50 - 00141432 _____ () C:\Windows\Minidump\Mini020814-01.dmp
2014-02-08 09:50 - 2008-05-26 17:56 - 00000000 ____D () C:\Windows\Minidump
2014-02-08 09:50 - 2008-05-26 17:55 - 201594099 _____ () C:\Windows\MEMORY.DMP
2014-02-01 09:44 - 2011-02-23 09:46 - 00000000 ____D () C:\Users\windows\Documents\PrivatBank
2014-02-01 08:30 - 2008-03-26 16:43 - 00074384 _____ () C:\Users\windows\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-28 17:24 - 2009-01-23 15:10 - 00000000 ____D () C:\Profi cash
2014-01-28 17:11 - 2014-01-28 17:11 - 00000000 ____D () C:\Users\windows\AppData\Roaming\TeamViewer
2014-01-28 16:46 - 2014-01-28 16:46 - 00000000 ____D () C:\Users\windows\Documents\Forte
2014-01-28 16:46 - 2014-01-28 16:46 - 00000000 ____D () C:\Users\windows\AppData\Roaming\FORTE
2014-01-28 16:45 - 2014-01-28 16:35 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-28 16:41 - 2006-11-02 13:47 - 00309672 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-28 16:36 - 2014-01-28 16:34 - 00005315 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log
2014-01-28 16:36 - 2008-01-09 12:05 - 00000000 ____D () C:\Program Files\Java
2014-01-24 18:18 - 2014-01-24 18:18 - 01069512 _____ (Solid State Networks) C:\Users\windows\Downloads\install_flashplayer12x32au_mssa_aaa_aih.exe
2014-01-23 18:38 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\nap

Some content of TEMP:
====================
C:\Users\windows\AppData\Local\temp\APNSetup.exe
C:\Users\windows\AppData\Local\temp\AskSLib.dll
C:\Users\windows\AppData\Local\temp\avgnt.exe
C:\Users\windows\AppData\Local\temp\ForteDependencies.exe
C:\Users\windows\AppData\Local\temp\jre-7u21-windows-i586-iftw.exe
C:\Users\windows\AppData\Local\temp\jre-7u25-windows-i586-iftw.exe
C:\Users\windows\AppData\Local\temp\jre-7u51-windows-i586-iftw.exe
C:\Users\windows\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-21 15:45

==================== End Of Log ============================