Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by Sofie at 2014-03-19 20:09:36 Run:2
Running from C:\Users\Sofie\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
FF Extension: PursuePoint - C:\Users\Sofie\AppData\Roaming\Mozilla\Firefox\Profiles\cyrqb4s0.default\Extensions\{e844e171-0702-480a-abc8-39f79c8c6126}.xpi [2014-03-07]
Task: {C70E7BCF-4494-4BD0-8826-B2521F465D20} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files (x86)\avira\Internet Explorer\swu.vbs"
C:\Program Files (x86)\avira\Internet Explorer\swu.vbs
Task: {EB02381F-D652-4B1C-894A-712498C62C51} - \Microsoft\Windows\MUI\LPRemove No Task File

*****************

C:\Users\Sofie\AppData\Roaming\Mozilla\Firefox\Profiles\cyrqb4s0.default\Extensions\{e844e171-0702-480a-abc8-39f79c8c6126}.xpi not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C70E7BCF-4494-4BD0-8826-B2521F465D20} => Key not found.
C:\Windows\System32\Tasks\aviraSWU not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\aviraSWU => Key not found.
"C:\Program Files (x86)\avira\Internet Explorer\swu.vbs" => File/Directory not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EB02381F-D652-4B1C-894A-712498C62C51} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MUI\LPRemove => Key not found.

==== End of Fixlog ====
         

Um Frische Logs bat ich. Nicht den Fix nochmal.

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Sofie at 2014-03-20 10:07:04
Running from C:\Users\Sofie\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira)
Canon iP2700 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP2700_series) (Version:  - )
Dropbox (HKCU\...\Dropbox) (Version: 2.6.2 - Dropbox, Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Lenovo Fingerprint Manager (HKLM\...\{26821A01-AE55-4B1A-807A-6EF888C4ACC2}) (Version: 4.5.240.0 - Validity Sensors, Inc.)
Lenovo Fingerprint Manager (HKLM\...\{F7AB2C19-6A27-4C75-A92A-8CC7C59E5FA2}) (Version: 4.5.240.0 - )
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.0 - Tracker Software Products Ltd)
PursuePoint (HKLM\...\PursuePoint) (Version: 2014.03.07.195803 - PursuePoint) <==== ATTENTION
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)

==================== Restore Points  =========================

11-03-2014 12:50:38 Removed Microsoft Office Enterprise 2007
11-03-2014 13:24:57 Installed Microsoft Office Professional Plus 2010
11-03-2014 13:50:52 OpenOffice 4.0.1 wird entfernt
15-03-2014 08:08:18 Windows Update
18-03-2014 20:23:48 Malwarebytes Anti-Rootkit Restore Point
18-03-2014 22:16:33 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {260FDA87-0DC0-4B0D-A9D5-B0DC75C37663} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {29E80C3F-2F64-4A87-9942-489D35F64810} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-01-30 02:40 - 2010-01-30 02:40 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2000-01-16 20:48 - 2000-01-16 20:48 - 00347136 _____ () C:\Users\Sofie\Downloads\desknote\desktopnotes.exe
2014-03-09 15:33 - 2014-02-25 11:41 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-03-20 10:04 - 2014-03-20 10:04 - 00041984 _____ () c:\users\sofie\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpu9xf4y.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\Sofie\AppData\Roaming\Dropbox\bin\libcef.dll
2014-03-07 23:47 - 2014-03-07 23:47 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-03-13 19:59 - 2014-03-13 19:59 - 16276872 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI-Gerät
Description: PCI-Gerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/20/2014 09:45:55 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/19/2014 10:17:20 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/19/2014 01:35:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/18/2014 11:37:31 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (03/20/2014 09:52:04 AM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/19/2014 10:19:10 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/19/2014 10:19:10 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/19/2014 10:09:02 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/19/2014 09:10:42 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/19/2014 02:49:52 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/19/2014 02:20:18 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/18/2014 06:00:12 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/18/2014 05:44:43 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.

Error: (03/17/2014 10:45:06 PM) (Source: atapi) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort1 gefunden.


Microsoft Office Sessions:
=========================
Error: (03/20/2014 09:45:55 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/19/2014 10:17:20 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/19/2014 01:35:33 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/18/2014 11:37:31 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 39%
Total physical RAM: 3816.57 MB
Available physical RAM: 2318.76 MB
Total Pagefile: 7631.31 MB
Available Pagefile: 5919.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:414.32 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: D3EB885B)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Sofie (administrator) on PREMSO on 20-03-2014 10:06:42
Running from C:\Users\Sofie\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Lenovo.) C:\Windows\system32\ibmpmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe
(Validity Sensors, Inc.) C:\Windows\system32\valWBFPolicyService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\SwipeMonitor.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
() C:\Users\Sofie\Downloads\desknote\desktopnotes.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Dropbox, Inc.) C:\Users\Sofie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2300210221-4292620252-1487165455-1000\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2300210221-4292620252-1487165455-1000\...\MountPoints2: {b5cda4ea-927c-11e3-9164-7c7a911e910e} - E:\SETUP.EXE
Startup: C:\Users\Sofie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopnotes.lnk
ShortcutTarget: Desktopnotes.lnk -> C:\Users\Sofie\Downloads\desknote\desktopnotes.exe ()
Startup: C:\Users\Sofie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sofie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBB03CFDBFF24CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
SearchScopes: HKCU - {21681651-28C5-4354-8633-979AE3D8E825} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10871
SearchScopes: HKCU - {4BE4DD24-D8C9-4F27-A705-85F28F788433} URL = hxxp://search.findwide.com/serp?guid={5C9ED2DF-5885-418F-AF81-869C04B7E5B2}&action=default_search&serpv=22&k={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Avira Savings Advisor BHO - {A18A516C-AA41-46A9-92DB-60208917E442} - C:\Program Files (x86)\avira\Internet Explorer\avira32.dll ()
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKCU - No Name - {1A78A3AA-45A4-4662-8118-B8022A26F1C7} -  No File
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF ProfilePath: C:\Users\Sofie\AppData\Roaming\Mozilla\Firefox\Profiles\cyrqb4s0.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: FindWide
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Savings Advisor - C:\Users\Sofie\AppData\Roaming\Mozilla\Firefox\Profiles\cyrqb4s0.default\Extensions\ciuvo-extension@avira.de [2014-03-09]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 ValBioService; C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe [22872 2013-10-28] (Validity Sensors, Inc.)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [40848 2013-10-28] (Validity Sensors, Inc.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 NETwNs64; C:\Windows\System32\DRIVERS\NETwsw02.sys [3599840 2013-10-14] (Intel Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-20 10:06 - 2014-03-20 10:06 - 00008437 _____ () C:\Users\Sofie\Desktop\FRST.txt
2014-03-18 22:10 - 2014-03-18 22:10 - 00000000 ____D () C:\Windows\ERUNT
2014-03-18 22:09 - 2014-03-18 22:09 - 01037734 _____ (Thisisu) C:\Users\Sofie\Downloads\JRT.exe
2014-03-18 22:01 - 2014-03-18 22:01 - 01950720 _____ () C:\Users\Sofie\Downloads\adwcleaner.exe
2014-03-18 21:56 - 2014-03-18 21:56 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\Malwarebytes
2014-03-18 21:56 - 2014-03-18 21:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-18 21:56 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-18 18:31 - 2014-03-18 21:38 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-18 18:31 - 2014-03-18 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-18 18:31 - 2014-03-18 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-18 17:51 - 2014-03-18 17:51 - 00001083 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-03-18 17:51 - 2014-03-18 17:51 - 00000000 ____D () C:\Users\Sofie\AppData\Local\PDF24
2014-03-18 17:50 - 2014-03-18 17:51 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-03-18 17:46 - 2014-03-18 17:47 - 16204160 _____ (Geek Software GmbH ) C:\Users\Sofie\Downloads\pdf24-creator-6.3.2.exe
2014-03-18 16:58 - 2014-03-20 10:06 - 00000000 ____D () C:\FRST
2014-03-18 15:30 - 2014-03-18 16:58 - 02157056 _____ (Farbar) C:\Users\Sofie\Desktop\FRST64.exe
2014-03-18 13:15 - 2014-03-18 22:06 - 00000000 ____D () C:\AdwCleaner
2014-03-17 11:13 - 2014-03-17 11:13 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\IrfanView
2014-03-17 11:13 - 2014-03-17 11:13 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-03-17 11:10 - 2014-03-17 11:10 - 02179728 _____ (Irfan Skiljan) C:\Users\Sofie\Downloads\iview437g_setup.exe
2014-03-14 09:46 - 2014-03-14 09:46 - 00004096 ____H () C:\Users\Sofie\AppData\Local\keyfile3.drm
2014-03-14 08:53 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 08:53 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 08:53 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 08:53 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 08:53 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 08:53 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 08:53 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 08:53 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 08:53 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 08:53 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 08:53 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 08:53 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 08:53 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 08:53 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 08:53 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 08:53 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 08:53 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 08:53 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 08:53 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 08:53 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 08:53 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 08:53 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 08:53 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 08:53 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 08:53 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 08:53 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 08:53 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 08:53 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 08:53 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 08:53 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 08:53 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 08:53 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 08:53 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 08:53 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 08:53 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 08:53 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 08:53 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 08:53 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 08:53 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 08:53 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 08:53 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-14 08:53 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-14 08:53 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-14 08:53 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-14 08:52 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-14 08:52 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 08:52 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-14 08:52 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-12 19:27 - 2014-03-12 19:27 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-03-12 19:27 - 2014-03-12 19:27 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-03-12 19:27 - 2012-03-14 05:00 - 00385024 _____ (CANON INC.) C:\Windows\system32\CNMLMA4.DLL
2014-03-12 11:28 - 2014-03-12 11:27 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-03-11 21:53 - 2014-03-11 21:53 - 00001253 _____ () C:\Users\Sofie\Desktop\GIW.lnk
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Windows\PCHEALTH
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-03-11 14:27 - 2014-03-11 14:27 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-03-11 14:26 - 2014-03-11 14:26 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-03-11 14:26 - 2014-03-11 14:26 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-03-11 14:25 - 2014-03-11 14:25 - 00000000 __RHD () C:\MSOCache
2014-03-11 14:25 - 2014-03-11 14:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-03-11 14:23 - 2014-03-11 14:23 - 00003086 _____ () C:\Windows\System32\Tasks\{BCAD09BB-5F56-4744-B340-28BA6B88E0C8}
2014-03-11 10:30 - 2014-03-11 10:30 - 374346597 _____ () C:\Windows\MEMORY.DMP
2014-03-11 10:30 - 2014-03-11 10:30 - 00656968 _____ () C:\Windows\Minidump\031114-38407-01.dmp
2014-03-11 10:30 - 2014-03-11 10:30 - 00000000 ____D () C:\Windows\Minidump
2014-03-11 09:55 - 2014-03-11 09:55 - 00001380 _____ () C:\Users\Sofie\Desktop\INDIVIDUAL.lnk
2014-03-10 23:53 - 2014-03-10 23:53 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\OpenOffice
2014-03-10 23:43 - 2014-03-10 23:43 - 00613200 _____ (Chip Digital GmbH) C:\Users\Sofie\Downloads\OpenOffice - CHIP-Downloader.exe
2014-03-10 11:18 - 2014-03-10 11:18 - 00000000 ____D () C:\Program Files\Intel
2014-03-10 11:18 - 2014-03-10 11:18 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-03-10 11:18 - 2014-03-10 11:18 - 00000000 ____D () C:\Intel
2014-03-10 11:18 - 2014-01-25 02:23 - 00064000 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL
2014-03-10 11:18 - 2014-01-25 02:23 - 00060416 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.DLL
2014-03-09 23:51 - 2014-03-09 23:51 - 00001252 _____ () C:\Users\Sofie\Desktop\BA.lnk
2014-03-09 23:51 - 2014-03-09 23:51 - 00001157 _____ () C:\Users\Sofie\Desktop\(6) FINAL SEM.lnk
2014-03-09 22:43 - 2014-03-09 22:43 - 00287220 _____ () C:\Users\Sofie\Downloads\KeyTweak_install.exe
2014-03-09 22:40 - 2014-03-09 22:40 - 01212224 _____ () C:\Users\Sofie\Downloads\keytweak-setup.exe
2014-03-09 15:34 - 2014-03-09 15:34 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\Avira
2014-03-09 15:33 - 2014-03-09 15:34 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-03-09 15:33 - 2014-03-09 15:33 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-03-09 15:33 - 2014-03-09 15:33 - 00000000 ____D () C:\ProgramData\Avira
2014-03-09 15:33 - 2014-02-25 11:41 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-03-09 15:33 - 2014-02-25 11:41 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-03-09 15:33 - 2014-02-25 11:41 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-03-09 15:25 - 2014-03-09 15:26 - 138607664 _____ () C:\Users\Sofie\Downloads\avira_free_antivirus_de_14.0.3.350.exe
2014-03-09 14:22 - 2014-03-17 22:35 - 01648454 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-09 14:10 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-09 14:10 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-03-07 23:47 - 2014-03-18 23:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-07 23:47 - 2014-03-18 23:16 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-07 23:47 - 2014-03-07 23:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-27 02:52 - 2014-02-27 02:52 - 00068440 _____ (Lenovo.) C:\Windows\system32\ibmpmsvc.exe
2014-02-27 02:52 - 2014-02-27 02:52 - 00060760 _____ (Lenovo.) C:\Windows\system32\ibmpmctl.exe
2014-02-27 02:52 - 2014-02-27 02:52 - 00057144 _____ (Lenovo.) C:\Windows\system32\Drivers\ibmpmdrv.sys
2014-02-27 02:52 - 2014-02-27 02:52 - 00040280 _____ (Lenovo.) C:\Windows\system32\tpinspm.dll
2014-02-20 19:45 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-20 19:45 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-20 19:45 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-20 19:45 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-20 19:45 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-20 19:45 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-20 19:45 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-20 19:45 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-20 19:45 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-20 19:45 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-20 19:44 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-20 19:44 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-20 19:44 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-20 19:44 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-20 19:44 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-20 19:44 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-20 19:44 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-20 19:44 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-20 19:44 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-20 19:44 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-20 19:44 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-20 19:44 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-20 19:44 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-20 19:44 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-20 19:44 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-20 19:44 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-20 19:44 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-20 19:44 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

==================== One Month Modified Files and Folders =======

2014-03-20 10:06 - 2014-03-20 10:06 - 00008437 _____ () C:\Users\Sofie\Desktop\FRST.txt
2014-03-20 10:06 - 2014-03-18 16:58 - 00000000 ____D () C:\FRST
2014-03-20 10:04 - 2014-02-08 20:12 - 00000000 ___RD () C:\Users\Sofie\Dropbox
2014-03-20 10:04 - 2014-02-08 20:09 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\Dropbox
2014-03-20 09:59 - 2014-02-08 20:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-20 09:51 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-20 09:51 - 2009-07-14 05:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-20 09:48 - 2014-02-07 21:57 - 00702890 _____ () C:\Windows\system32\perfh007.dat
2014-03-20 09:48 - 2014-02-07 21:57 - 00150498 _____ () C:\Windows\system32\perfc007.dat
2014-03-20 09:48 - 2014-02-07 21:42 - 01802681 _____ () C:\Windows\WindowsUpdate.log
2014-03-20 09:48 - 2009-07-14 06:13 - 01628044 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-20 09:44 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-20 09:44 - 2009-07-14 05:51 - 00026352 _____ () C:\Windows\setupact.log
2014-03-20 00:09 - 2014-02-07 22:06 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{0EF1B442-55C9-4738-8D39-B7A6D6301DE5}
2014-03-18 23:17 - 2014-03-07 23:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-18 23:16 - 2014-03-07 23:47 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-18 22:10 - 2014-03-18 22:10 - 00000000 ____D () C:\Windows\ERUNT
2014-03-18 22:09 - 2014-03-18 22:09 - 01037734 _____ (Thisisu) C:\Users\Sofie\Downloads\JRT.exe
2014-03-18 22:06 - 2014-03-18 13:15 - 00000000 ____D () C:\AdwCleaner
2014-03-18 22:04 - 2010-11-21 04:47 - 00200022 _____ () C:\Windows\PFRO.log
2014-03-18 22:01 - 2014-03-18 22:01 - 01950720 _____ () C:\Users\Sofie\Downloads\adwcleaner.exe
2014-03-18 21:56 - 2014-03-18 21:56 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\Malwarebytes
2014-03-18 21:56 - 2014-03-18 21:56 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-18 21:38 - 2014-03-18 18:31 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-18 21:36 - 2014-03-18 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-18 18:31 - 2014-03-18 18:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-18 17:51 - 2014-03-18 17:51 - 00001083 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-03-18 17:51 - 2014-03-18 17:51 - 00000000 ____D () C:\Users\Sofie\AppData\Local\PDF24
2014-03-18 17:51 - 2014-03-18 17:50 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-03-18 17:47 - 2014-03-18 17:46 - 16204160 _____ (Geek Software GmbH ) C:\Users\Sofie\Downloads\pdf24-creator-6.3.2.exe
2014-03-18 16:58 - 2014-03-18 15:30 - 02157056 _____ (Farbar) C:\Users\Sofie\Desktop\FRST64.exe
2014-03-17 22:35 - 2014-03-09 14:22 - 01648454 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-17 11:13 - 2014-03-17 11:13 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\IrfanView
2014-03-17 11:13 - 2014-03-17 11:13 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-03-17 11:10 - 2014-03-17 11:10 - 02179728 _____ (Irfan Skiljan) C:\Users\Sofie\Downloads\iview437g_setup.exe
2014-03-15 14:52 - 2009-07-14 05:45 - 00414096 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 09:46 - 2014-03-14 09:46 - 00004096 ____H () C:\Users\Sofie\AppData\Local\keyfile3.drm
2014-03-13 19:59 - 2014-02-08 20:42 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-13 19:59 - 2014-02-08 20:42 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-13 19:59 - 2014-02-08 20:42 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 19:27 - 2014-03-12 19:27 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-03-12 19:27 - 2014-03-12 19:27 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-03-12 11:27 - 2014-03-12 11:28 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-03-11 21:53 - 2014-03-11 21:53 - 00001253 _____ () C:\Users\Sofie\Desktop\GIW.lnk
2014-03-11 17:47 - 2014-02-10 00:00 - 00109296 _____ () C:\Users\Sofie\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-11 17:18 - 2014-02-10 19:01 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-11 14:29 - 2011-04-12 09:28 - 00000000 ____D () C:\Windows\ShellNew
2014-03-11 14:29 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Windows\PCHEALTH
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft Synchronization Services
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft Sync Framework
2014-03-11 14:28 - 2014-03-11 14:28 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-03-11 14:28 - 2014-02-10 19:01 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-03-11 14:27 - 2014-03-11 14:27 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2014-03-11 14:26 - 2014-03-11 14:26 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-03-11 14:26 - 2014-03-11 14:26 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
2014-03-11 14:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-03-11 14:26 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2014-03-11 14:25 - 2014-03-11 14:25 - 00000000 __RHD () C:\MSOCache
2014-03-11 14:25 - 2014-03-11 14:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
2014-03-11 14:23 - 2014-03-11 14:23 - 00003086 _____ () C:\Windows\System32\Tasks\{BCAD09BB-5F56-4744-B340-28BA6B88E0C8}
2014-03-11 10:30 - 2014-03-11 10:30 - 374346597 _____ () C:\Windows\MEMORY.DMP
2014-03-11 10:30 - 2014-03-11 10:30 - 00656968 _____ () C:\Windows\Minidump\031114-38407-01.dmp
2014-03-11 10:30 - 2014-03-11 10:30 - 00000000 ____D () C:\Windows\Minidump
2014-03-11 10:00 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-03-11 09:55 - 2014-03-11 09:55 - 00001380 _____ () C:\Users\Sofie\Desktop\INDIVIDUAL.lnk
2014-03-11 01:05 - 2014-02-10 00:04 - 00000000 ____D () C:\Users\Sofie\Downloads\desknote
2014-03-10 23:53 - 2014-03-10 23:53 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\OpenOffice
2014-03-10 23:43 - 2014-03-10 23:43 - 00613200 _____ (Chip Digital GmbH) C:\Users\Sofie\Downloads\OpenOffice - CHIP-Downloader.exe
2014-03-10 11:18 - 2014-03-10 11:18 - 00000000 ____D () C:\Program Files\Intel
2014-03-10 11:18 - 2014-03-10 11:18 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-03-10 11:18 - 2014-03-10 11:18 - 00000000 ____D () C:\Intel
2014-03-09 23:51 - 2014-03-09 23:51 - 00001252 _____ () C:\Users\Sofie\Desktop\BA.lnk
2014-03-09 23:51 - 2014-03-09 23:51 - 00001157 _____ () C:\Users\Sofie\Desktop\(6) FINAL SEM.lnk
2014-03-09 22:58 - 2014-02-08 20:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-09 22:43 - 2014-03-09 22:43 - 00287220 _____ () C:\Users\Sofie\Downloads\KeyTweak_install.exe
2014-03-09 22:40 - 2014-03-09 22:40 - 01212224 _____ () C:\Users\Sofie\Downloads\keytweak-setup.exe
2014-03-09 22:40 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Resources
2014-03-09 15:34 - 2014-03-09 15:34 - 00000000 ____D () C:\Users\Sofie\AppData\Roaming\Avira
2014-03-09 15:34 - 2014-03-09 15:33 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-03-09 15:33 - 2014-03-09 15:33 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-03-09 15:33 - 2014-03-09 15:33 - 00000000 ____D () C:\ProgramData\Avira
2014-03-09 15:26 - 2014-03-09 15:25 - 138607664 _____ () C:\Users\Sofie\Downloads\avira_free_antivirus_de_14.0.3.350.exe
2014-03-07 23:47 - 2014-03-07 23:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-01 07:05 - 2014-03-14 08:53 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-01 06:17 - 2014-03-14 08:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-01 06:16 - 2014-03-14 08:53 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-01 05:58 - 2014-03-14 08:53 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-01 05:52 - 2014-03-14 08:53 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-01 05:51 - 2014-03-14 08:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-01 05:42 - 2014-03-14 08:53 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-01 05:40 - 2014-03-14 08:53 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-01 05:37 - 2014-03-14 08:53 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-01 05:33 - 2014-03-14 08:53 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-01 05:33 - 2014-03-14 08:53 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-01 05:32 - 2014-03-14 08:53 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-01 05:30 - 2014-03-14 08:53 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-01 05:23 - 2014-03-14 08:53 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-01 05:17 - 2014-03-14 08:53 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-01 05:11 - 2014-03-14 08:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-01 05:02 - 2014-03-14 08:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-01 04:54 - 2014-03-14 08:53 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-01 04:52 - 2014-03-14 08:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-01 04:51 - 2014-03-14 08:53 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-01 04:47 - 2014-03-14 08:53 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-01 04:43 - 2014-03-14 08:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-01 04:43 - 2014-03-14 08:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-01 04:42 - 2014-03-14 08:53 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-01 04:40 - 2014-03-14 08:53 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-01 04:38 - 2014-03-14 08:53 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-01 04:37 - 2014-03-14 08:53 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-01 04:35 - 2014-03-14 08:53 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-01 04:18 - 2014-03-14 08:53 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-01 04:16 - 2014-03-14 08:53 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-01 04:14 - 2014-03-14 08:53 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-01 04:10 - 2014-03-14 08:53 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-01 04:03 - 2014-03-14 08:53 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-01 04:00 - 2014-03-14 08:53 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-01 03:57 - 2014-03-14 08:53 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-01 03:38 - 2014-03-14 08:53 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-01 03:32 - 2014-03-14 08:53 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-01 03:27 - 2014-03-14 08:53 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-01 03:25 - 2014-03-14 08:53 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-01 03:25 - 2014-03-14 08:53 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-27 02:52 - 2014-02-27 02:52 - 00068440 _____ (Lenovo.) C:\Windows\system32\ibmpmsvc.exe
2014-02-27 02:52 - 2014-02-27 02:52 - 00060760 _____ (Lenovo.) C:\Windows\system32\ibmpmctl.exe
2014-02-27 02:52 - 2014-02-27 02:52 - 00057144 _____ (Lenovo.) C:\Windows\system32\Drivers\ibmpmdrv.sys
2014-02-27 02:52 - 2014-02-27 02:52 - 00040280 _____ (Lenovo.) C:\Windows\system32\tpinspm.dll
2014-02-25 11:41 - 2014-03-09 15:33 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-25 11:41 - 2014-03-09 15:33 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-25 11:41 - 2014-03-09 15:33 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

Files to move or delete:
====================
C:\Users\PNotesPortable\PNotesPortable.exe


Some content of TEMP:
====================
C:\Users\Sofie\AppData\Local\Temp\avgnt.exe
C:\Users\Sofie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpu9xf4y.dll
C:\Users\Sofie\AppData\Local\Temp\ose00000.exe
C:\Users\Sofie\AppData\Local\Temp\Quarantine.exe
C:\Users\Sofie\AppData\Local\Temp\setup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-11 12:15

==================== End Of Log ============================
         

--- --- ---