|
Plagegeister aller Art und deren Bekämpfung: Probleme mit dem Browser > MalwareWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
18.05.2014, 14:21 | #1 |
| Probleme mit dem Browser > Malware Hallo, ich habe Probleme mit meinem Browser. Einige Videos bei dailymotion habe ich geschaut. Plötzlich passiert, dass sich die Seite ändert und eine andere Seite erscheint (ein Gameseite). Manchmal wird eine Software (flash player) automatisch heruntergeladen. Ich habe es zwar nicht installiert und gelöscht aber mein Browser hat sich geändert z..B., obwohl ich als Startseite Google habe, erscheint automatisch eine andere Seite (search.conduit.com). Ich habe es mehrmals geändert aber es hat nichts gefruchtet. Das Problem habe ich bei Mozilla und Google Chrome. Von Avast erhalte ich häufige einige Meldungen (siehe unten) aber Avast und Spybot haben nichts gefunden. Kann jmd mir bitte helfen? Vielen Dank Viele Grüße |
18.05.2014, 15:36 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit dem Browser > Malware Hallo und
__________________Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
18.05.2014, 20:35 | #3 |
| Probleme mit dem Browser > Malware Hallo, wie finde ich den Addition.txt noch mal?
__________________Anbei die FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014 Ran by nerobyrn (administrator) on NEROBYRN-HP on 18-05-2014 21:25:18 Running from C:\Users\nerobyrn\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Microsoft Corporation) C:\Windows\splwow64.exe (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\EXCEL.EXE (Microsoft Corporation) C:\Windows\System32\calc.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company) HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NPSStartup] => [X] HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0 AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194 FireFox: ======== FF ProfilePath: C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB FF DefaultSearchEngine: Trovi search FF SelectedSearchEngine: Trovi search FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml FF Extension: Test Pilot - C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07] FF Extension: NoScript - C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22] Chrome: ======= CHR HomePage: hxxp://www.google.de/ CHR StartupUrls: "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=55&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&SSPV=", "hxxp://www.google.de/" CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs CHR DefaultNewTabURL: CHR Extension: (Google Docs) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18] CHR Extension: (Google Drive) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18] CHR Extension: (YouTube) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18] CHR Extension: (Google-Suche) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18] CHR Extension: (avast! Online Security) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18] CHR Extension: (Google Wallet) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18] CHR Extension: (Google Mail) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12] ==================== Services (Whitelisted) ================= R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software) R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [X] ==================== Drivers (Whitelisted) ==================== R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] () R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software) R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software) S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] () S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\nerobyrn\Downloads\FRST.txt 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\nerobyrn\Downloads\FRST64.exe 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:56 - 2014-05-18 21:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-18 12:56 - 2014-05-18 20:52 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\nerobyrn\Downloads\ChromeSetup.exe 2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\nerobyrn\Downloads\spybot-2.3.exe 2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleFornerobyrn 2014-05-05 21:40 - 2014-05-18 20:57 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleFornerobyrn.job 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:44 - 2014-05-17 13:55 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\SearchProtect 2014-05-03 23:44 - 2014-05-17 13:36 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\OpenCandy 2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\DVDVideoSoft 2014-04-18 11:35 - 2014-04-27 20:00 - 00000000 ____D () C:\Users\nerobyrn\Documents\Ebay ==================== One Month Modified Files and Folders ======= 2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\nerobyrn\Downloads\FRST.txt 2014-05-18 21:25 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\nerobyrn\Downloads\FRST64.exe 2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\nerobyrn\Documents\Budget 2014-05-18 21:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-18 21:06 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\nerobyrn\Desktop\ccntis2.xls 2014-05-18 21:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleFornerobyrn 2014-05-18 20:57 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleFornerobyrn.job 2014-05-18 20:52 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-18 20:52 - 2013-04-30 20:38 - 00261490 _____ () C:\Windows\PFRO.log 2014-05-18 20:52 - 2013-01-04 11:28 - 00088689 _____ () C:\Windows\setupact.log 2014-05-18 20:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-18 19:34 - 2010-09-23 11:48 - 01390146 _____ () C:\Windows\WindowsUpdate.log 2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0659.tmp 2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL1677.tmp 2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0365.tmp 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\Google 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\nerobyrn\Downloads\ChromeSetup.exe 2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0288.tmp 2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2318.tmp 2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2233.tmp 2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL3087.tmp 2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0740.tmp 2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2460.tmp 2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0595.tmp 2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0301.tmp 2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2149.tmp 2014-05-17 13:55 - 2014-05-03 23:44 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\SearchProtect 2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 13:36 - 2014-05-03 23:44 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\nerobyrn\Documents\Bookmarks 2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\nerobyrn\Downloads\spybot-2.3.exe 2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\nerobyrn\Desktop\~WRL0012.tmp 2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\nerobyrn\Documents\Jokes 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-15 14:28 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-05-14 16:10 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 16:10 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 16:10 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\nerobyrn\Documents\Bewerbung 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java 2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997 2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997 2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\Skype 2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\nerobyrn 2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\nerobyrn\Documents\Deko 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\OpenCandy 2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0011.tmp 2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\nerobyrn\Documents\a_Misc 2014-04-28 16:49 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\nerobyrn\Documents\Artes_artesanato 2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\nerobyrn\Documents\Ebay 2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\nerobyrn\Dropbox 2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNEROBYRN-HP$ 2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNEROBYRN-HP$.job 2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\nerobyrn\Documents\Briefe 2014-04-18 23:10 - 2012-01-14 11:26 - 00000000 ____D () C:\Users\nerobyrn\Documents\Dieta Some content of TEMP: ==================== C:\Users\nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll C:\Users\nerobyrn\AppData\Local\Temp\DseShExt-x64.dll C:\Users\nerobyrn\AppData\Local\Temp\DseShExt-x86.dll C:\Users\nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\nerobyrn\AppData\Local\Temp\nse5A5B.exe C:\Users\nerobyrn\AppData\Local\Temp\nse996.exe C:\Users\nerobyrn\AppData\Local\Temp\nsk5F5C.exe C:\Users\nerobyrn\AppData\Local\Temp\nsp5481.exe C:\Users\nerobyrn\AppData\Local\Temp\nspEB6.exe C:\Users\nerobyrn\AppData\Local\Temp\nsu14A0.exe C:\Users\nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\nerobyrn\AppData\Local\Temp\sp-downloader.exe C:\Users\nerobyrn\AppData\Local\Temp\sp64126.exe C:\Users\nerobyrn\AppData\Local\Temp\SPSetup.exe C:\Users\nerobyrn\AppData\Local\Temp\UninstallHPSA.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe [2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-12 19:26 ==================== End Of Log ============================ |
19.05.2014, 00:13 | #4 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit dem Browser > Malware Du findest die Logs an den erwähnten Stellen, wenn du die Anleitungen richtig umsetzt: Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
19.05.2014, 16:40 | #5 |
| Probleme mit dem Browser > Malware Hallo, ich habe nur die Fehlermeldungen v. Avast, die ich bereits angehängt habe. Der Avast Virusscanner hat nichts gefunden aber meine Browser-Einstellungen haben sich geändert und obwohl ich die Settings wiederhergestellt habe, funktionieren sie nicht, wie gewünscht. Es erscheint immer wieder als erste Seite search.conduit.com obwohl ich Google gewählt habe. Ich habe conduit sogar aus der Suchmaschinenliste gelöscht. Es hat aber nichts genutzt. Ich befürchte, dass mein Browser nicht mehr sicher ist. FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014 Ran by Nerobyrn (administrator) on Nerobyrn-HP on 18-05-2014 21:25:18 Running from C:\Users\Nerobyrn\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Microsoft Corporation) C:\Windows\splwow64.exe (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\EXCEL.EXE (Microsoft Corporation) C:\Windows\System32\calc.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company) HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NPSStartup] => [X] HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0 AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194 FireFox: ======== FF ProfilePath: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB FF DefaultSearchEngine: Trovi search FF SelectedSearchEngine: Trovi search FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml FF Extension: Test Pilot - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07] FF Extension: NoScript - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22] Chrome: ======= CHR HomePage: hxxp://www.google.de/ CHR StartupUrls: "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=55&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&SSPV=", "hxxp://www.google.de/" CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs CHR DefaultNewTabURL: CHR Extension: (Google Docs) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18] CHR Extension: (Google Drive) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18] CHR Extension: (YouTube) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18] CHR Extension: (Google-Suche) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18] CHR Extension: (avast! Online Security) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18] CHR Extension: (Google Wallet) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18] CHR Extension: (Google Mail) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12] ==================== Services (Whitelisted) ================= R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software) R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [X] ==================== Drivers (Whitelisted) ==================== R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] () R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software) R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software) S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] () S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:56 - 2014-05-18 21:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-18 12:56 - 2014-05-18 20:52 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\Nerobyrn\Downloads\ChromeSetup.exe 2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe 2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn 2014-05-05 21:40 - 2014-05-18 20:57 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:44 - 2014-05-17 13:55 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect 2014-05-03 23:44 - 2014-05-17 13:36 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy 2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft 2014-04-18 11:35 - 2014-04-27 20:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay ==================== One Month Modified Files and Folders ======= 2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt 2014-05-18 21:25 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe 2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Budget 2014-05-18 21:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-18 21:06 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\Nerobyrn\Desktop\ccntis2.xls 2014-05-18 21:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn 2014-05-18 20:57 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job 2014-05-18 20:52 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-18 20:52 - 2013-04-30 20:38 - 00261490 _____ () C:\Windows\PFRO.log 2014-05-18 20:52 - 2013-01-04 11:28 - 00088689 _____ () C:\Windows\setupact.log 2014-05-18 20:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-18 19:34 - 2010-09-23 11:48 - 01390146 _____ () C:\Windows\WindowsUpdate.log 2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0659.tmp 2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL1677.tmp 2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0365.tmp 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Google 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\Nerobyrn\Downloads\ChromeSetup.exe 2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0288.tmp 2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2318.tmp 2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2233.tmp 2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL3087.tmp 2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0740.tmp 2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2460.tmp 2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0595.tmp 2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0301.tmp 2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2149.tmp 2014-05-17 13:55 - 2014-05-03 23:44 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect 2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 13:36 - 2014-05-03 23:44 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bookmarks 2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe 2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0012.tmp 2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Jokes 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-15 14:28 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-05-14 16:10 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 16:10 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 16:10 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bewerbung 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java 2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997 2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997 2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\Skype 2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\Nerobyrn 2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Deko 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy 2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0011.tmp 2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\Nerobyrn\Documents\a_Misc 2014-04-28 16:49 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Artes_artesanato 2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay 2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\Nerobyrn\Dropbox 2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn-HP$ 2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job 2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Briefe 2014-04-18 23:10 - 2012-01-14 11:26 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Dieta Some content of TEMP: ==================== C:\Users\Nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x64.dll C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Nerobyrn\AppData\Local\Temp\nse5A5B.exe C:\Users\Nerobyrn\AppData\Local\Temp\nse996.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsk5F5C.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsp5481.exe C:\Users\Nerobyrn\AppData\Local\Temp\nspEB6.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsu14A0.exe C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\Nerobyrn\AppData\Local\Temp\sp-downloader.exe C:\Users\Nerobyrn\AppData\Local\Temp\sp64126.exe C:\Users\Nerobyrn\AppData\Local\Temp\SPSetup.exe C:\Users\Nerobyrn\AppData\Local\Temp\UninstallHPSA.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe [2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-12 19:26 ==================== End Of Log ============================ |
20.05.2014, 00:13 | #6 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit dem Browser > Malware Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken
__________________ --> Probleme mit dem Browser > Malware |
20.05.2014, 11:46 | #7 |
| Probleme mit dem Browser > MalwareFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014 Ran by Nerobyrn (administrator) on Nerobyrn-HP on 20-05-2014 12:40:13 Running from C:\Users\Nerobyrn\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (Microsoft Corporation) C:\Windows\splwow64.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company) HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NPSStartup] => [X] HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0 AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194 FireFox: ======== FF ProfilePath: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB FF DefaultSearchEngine: Trovi search FF SelectedSearchEngine: Trovi search FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml FF Extension: Test Pilot - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07] FF Extension: NoScript - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22] Chrome: ======= CHR HomePage: hxxp://www.google.de/ CHR StartupUrls: "hxxp://www.google.de/" CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs CHR DefaultNewTabURL: CHR Extension: (Google Docs) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18] CHR Extension: (Google Drive) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18] CHR Extension: (YouTube) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18] CHR Extension: (Google-Suche) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18] CHR Extension: (avast! Online Security) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18] CHR Extension: (Google Wallet) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18] CHR Extension: (Google Mail) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12] ==================== Services (Whitelisted) ================= R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software) R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR) S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [X] ==================== Drivers (Whitelisted) ==================== R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] () R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software) R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software) S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] () S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-20 12:40 - 2014-05-20 12:40 - 00022288 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt 2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx 2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee 2014-05-18 21:25 - 2014-05-18 21:25 - 00047303 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:56 - 2014-05-20 12:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-18 12:56 - 2014-05-20 11:21 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe 2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-05 21:40 - 2014-05-19 08:45 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job 2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:44 - 2014-05-17 13:55 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect 2014-05-03 23:44 - 2014-05-17 13:36 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy 2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft ==================== One Month Modified Files and Folders ======= 2014-05-20 12:40 - 2014-05-20 12:40 - 00022288 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt 2014-05-20 12:40 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST 2014-05-20 12:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-20 12:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-20 11:28 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-20 11:28 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-20 11:25 - 2010-09-23 11:48 - 01434238 _____ () C:\Windows\WindowsUpdate.log 2014-05-20 11:23 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-05-20 11:21 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-20 11:20 - 2013-01-04 11:28 - 00089361 _____ () C:\Windows\setupact.log 2014-05-20 11:20 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-19 23:42 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL1805.tmp 2014-05-19 20:29 - 2012-02-12 20:56 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Listen_Lesezeichen 2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx 2014-05-19 14:49 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0013.tmp 2014-05-19 14:10 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Artes_artesanato 2014-05-19 09:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-19 09:44 - 2013-11-15 14:08 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Arzt_Zahnarzt 2014-05-19 09:32 - 2011-03-15 23:15 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Adobe 2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee 2014-05-19 09:31 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-19 09:31 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-19 09:31 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-19 08:45 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job 2014-05-19 00:17 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\Nerobyrn\Desktop\ccntis2.xls 2014-05-18 23:34 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL1601.tmp 2014-05-18 23:04 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3166.tmp 2014-05-18 21:57 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3656.tmp 2014-05-18 21:25 - 2014-05-18 21:25 - 00047303 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe 2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Budget 2014-05-18 21:02 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2412.tmp 2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn 2014-05-18 20:52 - 2013-04-30 20:38 - 00261490 _____ () C:\Windows\PFRO.log 2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0659.tmp 2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL1677.tmp 2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0365.tmp 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Google 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0288.tmp 2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2318.tmp 2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2233.tmp 2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL3087.tmp 2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0740.tmp 2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2460.tmp 2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0595.tmp 2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0301.tmp 2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2149.tmp 2014-05-17 13:55 - 2014-05-03 23:44 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect 2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 13:36 - 2014-05-03 23:44 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bookmarks 2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe 2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0012.tmp 2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Jokes 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bewerbung 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java 2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997 2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997 2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\Skype 2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\Nerobyrn 2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Deko 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy 2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0011.tmp 2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\Nerobyrn\Documents\a_Misc 2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay 2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\Nerobyrn\Dropbox 2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn-HP$ 2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job 2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Briefe Some content of TEMP: ==================== C:\Users\Nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x64.dll C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Nerobyrn\AppData\Local\Temp\nse5A5B.exe C:\Users\Nerobyrn\AppData\Local\Temp\nse996.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsk5F5C.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsp5481.exe C:\Users\Nerobyrn\AppData\Local\Temp\nspEB6.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsu14A0.exe C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\Nerobyrn\AppData\Local\Temp\sp-downloader.exe C:\Users\Nerobyrn\AppData\Local\Temp\sp64126.exe C:\Users\Nerobyrn\AppData\Local\Temp\SPSetup.exe C:\Users\Nerobyrn\AppData\Local\Temp\UninstallHPSA.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe [2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-19 12:43 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014 Ran by Nerobyrn at 2014-05-20 12:40:55 Running from C:\Users\Nerobyrn\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0} ==================== Installed Programs ====================== 7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov) AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH) Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 13.0.0.111 - Adobe Systems Incorporated) Hidden Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated) Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.) Amazon MP3-Downloader 1.0.15 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.15 - Amazon Services LLC) avast! Internet Security (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software) Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation) Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - ) Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - ) Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - ) Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: - ) Canon MG3100 series Benutzerregistrierung (HKLM-x32\...\Canon MG3100 series Benutzerregistrierung) (Version: - ) Canon MG3100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3100_series) (Version: - ) Canon MG3100 series On-screen Manual (HKLM-x32\...\Canon MG3100 series On-screen Manual) (Version: - ) Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version: - ) Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - ) Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - ) CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.) CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1.4217 - CyberLink Corp.) CyberLink PowerDVD 9 (x32 Version: 9.0.1.4217 - CyberLink Corp.) Hidden CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2511 - CyberLink Corp.) CyberLink YouCam (x32 Version: 3.0.2511 - CyberLink Corp.) Hidden Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard) ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard) Free YouTube Download version 3.2.33.424 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.33.424 - DVDVideoSoft Ltd.) FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.) Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.) Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard) HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden HP Documentation (HKLM-x32\...\{B360E24A-BF25-4353-AA79-1B54F509024A}) (Version: 1.0.0.0 - Hewlett-Packard) HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company) HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company) HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard) HP Software Framework (HKLM-x32\...\{AF6EB833-D48A-49AC-9394-4C57489FDFF2}) (Version: 4.1.13.1 - Hewlett-Packard Company) HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company) HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2131 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan) Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle) Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416045FF}) (Version: 6.0.450 - Oracle) Java(TM) 6 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216045FF}) (Version: 6.0.450 - Oracle) Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2907 - CyberLink Corp.) LabelPrint (x32 Version: 2.5.2907 - CyberLink Corp.) Hidden LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft Office 2000 Professional (HKLM-x32\...\{00010407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation) Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge) PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge) PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.212.0 - Tracker Software Products Ltd) PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.) PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4204 - CyberLink Corp.) Power2Go (x32 Version: 6.1.4204 - CyberLink Corp.) Hidden PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3003 - CyberLink Corp.) PowerDirector (x32 Version: 8.0.3003 - CyberLink Corp.) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.25.824.2010 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.) Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - ) RtVOsd (HKLM\...\{091A0130-A82F-4A6D-9C61-3BBBB3289030}) (Version: 1.0.6 - Realtek Semiconductor Corp.) Samsung New PC Studio (HKLM-x32\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Samsung New PC Studio (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.650.0 - SAMSUNG Electronics Co., Ltd.) Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.) Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.0 - Synaptics Incorporated) Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler) waterMark V2 (HKLM-x32\...\waterMark V2) (Version: - ) Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation) Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation) Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation) Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) ==================== Restore Points ========================= 02-05-2014 10:27:47 Windows Update 02-05-2014 22:31:24 Windows Update 03-05-2014 23:18:09 TuneUp Utilities 2014 wird entfernt 03-05-2014 23:19:02 TuneUp Utilities 2014 (de-DE) wird entfernt 04-05-2014 17:33:43 Windows-Sicherung 10-05-2014 17:41:39 Windows Update 10-05-2014 22:08:09 Windows Update 11-05-2014 18:51:31 Windows-Sicherung 12-05-2014 08:41:38 avast! antivirus system restore point 15-05-2014 20:23:20 Windows Update 17-05-2014 11:54:28 Säuberung (Spybot - Search & Destroy 2.3, Administratorrechte) 18-05-2014 17:00:12 Windows-Sicherung ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {00621FE6-97B0-453C-904E-297740F769B6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company) Task: {0AB49A2C-3AAB-483B-8E5D-3841FFFF6267} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-19] (Adobe Systems Incorporated) Task: {18D8F90E-1E99-418B-9C1E-2CBB4B717FC8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard) Task: {4AC7713C-B642-4A37-9AB8-3D3BBEE9A53B} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-05-12] (AVAST Software) Task: {4BB2EEEE-8399-47DF-8F13-734111D4206A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company) Task: {5DC1314E-E966-4978-8851-29B9C4E72F13} - System32\Tasks\HPCeeScheduleForNerobyrn-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard) Task: {724589F9-0A4F-4271-B6A6-AB19ABDC5C85} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {77D2A8AE-EE4C-4A09-A6A7-E4FBCF023B8A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {7D69B46C-12D8-4805-B5D6-C43B34887787} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company) Task: {86271439-898E-4D0F-BDEF-BA4F04156C7C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {A06276EA-B0B4-40FE-9560-95B334CA9ED4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.) Task: {C84D2EE0-A35D-4EB5-9BBB-93204A6F493D} - System32\Tasks\HPCeeScheduleForNerobyrn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard) Task: {E73BC00E-0FEF-4EF3-AC0B-17E4D7A6138A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {F4BA29A6-F96B-41F9-ABC7-6C55FCCB2115} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe ==================== Loaded Modules (whitelisted) ============= 2012-01-12 22:13 - 2010-06-17 22:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll 2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe 2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll 2010-06-18 16:26 - 2010-06-18 16:26 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll 2010-06-18 16:26 - 2010-06-18 16:26 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll 2014-05-19 17:56 - 2014-05-19 17:56 - 02253312 _____ () C:\Program Files\Alwil Software\Avast5\defs\14051901\algo.dll 2014-05-20 11:22 - 2014-05-20 11:22 - 02253312 _____ () C:\Program Files\Alwil Software\Avast5\defs\14052000\algo.dll 2014-05-17 12:50 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2014-05-17 12:50 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2014-05-17 12:50 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2010-05-19 10:05 - 2010-05-19 10:05 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll 2010-05-19 10:05 - 2010-05-19 10:05 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll 2010-05-19 10:05 - 2010-05-19 10:05 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll 2013-12-03 10:35 - 2013-12-03 10:35 - 19336120 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll 2014-02-13 22:44 - 2014-02-13 22:44 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\29335dc88d799664dcd97362bcb687e9\IsdiInterop.ni.dll 2010-09-23 11:52 - 2010-04-13 09:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libglesv2.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libegl.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 13695816 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= Name: avast! SecureLine TAP Adapter v3 Description: avast! SecureLine TAP Adapter v3 Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: TAP-Windows Provider V9 Service: aswTap Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: avast! Firewall NDIS Filter Miniport Description: avast! Firewall NDIS Filter Miniport Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: ALWIL Software Service: aswNdis Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19) Resolution: A registry problem was detected. This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options: On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver. ==================== Event log errors: ========================= Application errors: ================== Error: (05/20/2014 11:24:29 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: fe0 Startzeit: 01cf740d11af2a1a Endzeit: 9 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (05/19/2014 09:50:50 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: f90 Startzeit: 01cf739b6c53fe78 Endzeit: 8 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (05/19/2014 05:35:10 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: ca8 Startzeit: 01cf7377cec17644 Endzeit: 9 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (05/19/2014 00:45:58 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (05/19/2014 08:47:08 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: c3c Startzeit: 01cf732e010e2b60 Endzeit: 8 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (05/18/2014 08:55:34 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: e7c Startzeit: 01cf72ca7f65373b Endzeit: 8 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (05/18/2014 01:03:32 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: e6c Startzeit: 01cf7288a9d83e79 Endzeit: 8 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (05/18/2014 09:44:34 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: d24 Startzeit: 01cf726cb35c1d1b Endzeit: 5 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: Error: (05/18/2014 02:35:21 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm WINWORD.EXE, Version 9.0.0.2823 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1154 Startzeit: 01cf71c929838b4e Endzeit: 12 Anwendungspfad: C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE Berichts-ID: 45cb4098-de24-11e3-8da8-90fba6b18e40 Error: (05/17/2014 05:27:44 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: a8c Startzeit: 01cf71c72e85cfee Endzeit: 7 Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe Berichts-ID: System errors: ============= Error: (05/20/2014 11:23:45 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Search Protect Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (05/20/2014 11:22:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (05/20/2014 11:22:13 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht. Error: (05/20/2014 11:21:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (05/20/2014 11:21:29 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht. Error: (05/19/2014 09:50:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Search Protect Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (05/19/2014 09:48:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (05/19/2014 09:48:41 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht. Error: (05/19/2014 09:47:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (05/19/2014 09:47:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht. Microsoft Office Sessions: ========================= Error: (05/20/2014 11:24:29 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102fe001cf740d11af2a1a9C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (05/19/2014 09:50:50 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102f9001cf739b6c53fe788C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (05/19/2014 05:35:10 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102ca801cf7377cec176449C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (05/19/2014 00:45:58 PM) (Source: SideBySide) (EventID: 35) (User: ) Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8 Error: (05/19/2014 08:47:08 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102c3c01cf732e010e2b608C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (05/18/2014 08:55:34 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102e7c01cf72ca7f65373b8C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (05/18/2014 01:03:32 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102e6c01cf7288a9d83e798C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (05/18/2014 09:44:34 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102d2401cf726cb35c1d1b5C:\Program Files (x86)\Skype\Phone\Skype.exe Error: (05/18/2014 02:35:21 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: WINWORD.EXE9.0.0.2823115401cf71c929838b4e12C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE45cb4098-de24-11e3-8da8-90fba6b18e40 Error: (05/17/2014 05:27:44 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Skype.exe6.11.0.102a8c01cf71c72e85cfee7C:\Program Files (x86)\Skype\Phone\Skype.exe ==================== Memory info =========================== Percentage of memory in use: 55% Total physical RAM: 3893.86 MB Available physical RAM: 1750.59 MB Total Pagefile: 7785.9 MB Available Pagefile: 5060.18 MB Total Virtual: 8192 MB Available Virtual: 8191.85 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:282.09 GB) (Free:226 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:15.7 GB) (Free:2.23 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298 GB) (Disk ID: CB9E9924) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=103 MB) - (Type=0C) ==================== End Of Log ============================ |
20.05.2014, 14:58 | #8 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit dem Browser > Malware Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
20.05.2014, 14:58 | #9 |
| Probleme mit dem Browser > Malware Hallo, ich schaue mir bei Dailymotion Videos an und habe das Gefühl, dass die Probleme damit angefangen haben. Leider finde ich diese Videos nur bei Dailymotion. Avast schlägt die ganze Zeit Alarm, blockiert irgendetwas und ich weiß nicht, ob die Meldungen ernst zu nehmend sind oder nicht. |
20.05.2014, 15:01 | #10 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit dem Browser > Malware Schön, und welchen Bezug hat das jetzt auf meine letzte Antwort zu Junkware entfernen? Außerdem sind Angaben wie "blockiert irgendwas" nicht hilfreich, wenn musst du schon mal die Logs dazu posten.
__________________ Logfiles bitte immer in CODE-Tags posten |
20.05.2014, 15:21 | #11 |
| Probleme mit dem Browser > Malware Sei nicht gleich so schnippisch! Wir haben gleichzeitig gepostet. Deinen Anweisungen muss ich noch folgen. Anbei die Meldungen: |
20.05.2014, 15:29 | #12 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit dem Browser > Malware Ist ja schon gut, hab mich nur über den fehlenden Bezug und die genaue fehlende Info zum Fund gewundert. Aus dem Screenshot geht nur hervor, dass der Avast-Webschutz Chrome daran gehindert hat eine offensichtliche Adware-URL zu laden.
__________________ Logfiles bitte immer in CODE-Tags posten |
20.05.2014, 19:13 | #13 |
| Probleme mit dem Browser > Malware AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.010 - Bericht erstellt am 03/11/2013 um 01:59:14 # Updated 20/10/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Nerobyrn - Nerobyrn-HP # Gestartet von : C:\Users\Nerobyrn\Downloads\adwcleaner.exe # Option : Suchen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Datei Gefunden : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage Datei Gefunden : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage-journal Ordner Gefunden : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\125 ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\keaillmajpeodnbelalgeffidfcdgiem ***** [ Browser ] ***** -\\ Internet Explorer v10.0.9200.16720 -\\ Mozilla Firefox v23.0 (de) [ Datei : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\prefs.js ] Zeile gefunden : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*"); -\\ Google Chrome v30.0.1599.101 [ Datei : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [1452 octets] - [03/11/2013 01:59:14] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1512 octets] ########## [/CODE] AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 20/05/2014 um 19:02:31 # Aktualisiert 19/05/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Nerobyrn - Nerobyrn-HP # Gestartet von : C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe # Option : Suchen ***** [ Dienste ] ***** Dienst Gefunden : CltMngSvc ***** [ Dateien / Ordner ] ***** Ordner Gefunden : C:\Program Files (x86)\SearchProtect Ordner Gefunden : C:\Users\Nerobyrn\AppData\Local\SearchProtect Ordner Gefunden : C:\Users\Nerobyrn\AppData\Roaming\OpenCandy ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Daten Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll Daten Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17041 -\\ Mozilla Firefox v [ Datei : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\prefs.js ] Zeile gefunden : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0[...] -\\ Google Chrome v34.0.1847.137 [ Datei : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gefunden [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= Gefunden [Search Provider] : hxxp://www.foxnews.com/search-results/search?q={searchTerms}&submit=Search Gefunden [Search Provider] : hxxp://www.softonic.de/s/{searchTerms} ************************* AdwCleaner[R0].txt - [1592 octets] - [03/11/2013 02:59:14] AdwCleaner[R1].txt - [2457 octets] - [20/05/2014 19:02:31] AdwCleaner[S0].txt - [1653 octets] - [03/11/2013 03:16:39] ########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [2577 octets] ########## [/CODE] Code:
ATTFilter AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 20/05/2014 um 19:05:27 # Aktualisiert 19/05/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Nerobyrn - Nerobyrn-HP # Gestartet von : C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : CltMngSvc ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Program Files (x86)\SearchProtect Ordner Gelöscht : C:\Users\Nerobyrn\AppData\Local\SearchProtect Ordner Gelöscht : C:\Users\Nerobyrn\AppData\Roaming\OpenCandy ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17041 -\\ Mozilla Firefox v [ Datei : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\prefs.js ] Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0[...] -\\ Google Chrome v34.0.1847.137 [ Datei : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV= Gelöscht [Search Provider] : hxxp://www.foxnews.com/search-results/search?q={searchTerms}&submit=Search Gelöscht [Search Provider] : hxxp://www.softonic.de/s/{searchTerms} ************************* AdwCleaner[R0].txt - [1592 octets] - [03/11/2013 02:59:14] AdwCleaner[R1].txt - [2669 octets] - [20/05/2014 19:02:31] AdwCleaner[S0].txt - [1653 octets] - [03/11/2013 03:16:39] AdwCleaner[S1].txt - [2464 octets] - [20/05/2014 19:05:27] ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2524 octets] ########## [/CODE] Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x64 Ran by Nerobyrn on 20.05.2014 at 19:16:00,15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 20.05.2014 at 19:25:56,98 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014 Ran by Nerobyrn (administrator) on Nerobyrn-HP on 20-05-2014 19:40:34 Running from C:\Users\Nerobyrn\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Windows\splwow64.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company) HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NPSStartup] => [X] HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.) HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0 Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194 FireFox: ======== FF ProfilePath: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default FF DefaultSearchEngine: Trovi search FF SelectedSearchEngine: Trovi search FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml FF Extension: Test Pilot - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07] FF Extension: NoScript - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22] Chrome: ======= CHR HomePage: hxxp://www.google.de/ CHR StartupUrls: "hxxp://www.google.de/" CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs CHR DefaultNewTabURL: CHR Extension: (Google Docs) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18] CHR Extension: (Google Drive) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18] CHR Extension: (YouTube) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18] CHR Extension: (Google-Suche) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18] CHR Extension: (avast! Online Security) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18] CHR Extension: (Google Wallet) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18] CHR Extension: (Google Mail) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12] ==================== Services (Whitelisted) ================= R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] () R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software) R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] () R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software) R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software) S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] () S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-20 19:36 - 2014-05-20 19:36 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe 2014-05-20 19:25 - 2014-05-20 19:25 - 00000628 _____ () C:\Users\Nerobyrn\Desktop\JRT.txt 2014-05-20 19:15 - 2014-05-20 19:15 - 01016261 _____ (Thisisu) C:\Users\Nerobyrn\Downloads\JRT.exe 2014-05-20 19:02 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-05-20 19:01 - 2014-05-20 19:01 - 01326389 _____ () C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe 2014-05-20 12:40 - 2014-05-20 12:41 - 00048618 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt 2014-05-20 12:40 - 2014-05-20 12:41 - 00032898 _____ () C:\Users\Nerobyrn\Desktop\Addition.txt 2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx 2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee 2014-05-18 21:25 - 2014-05-20 19:40 - 00020628 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:56 - 2014-05-20 19:33 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-18 12:56 - 2014-05-20 19:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe 2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-05 21:40 - 2014-05-19 08:45 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job 2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft ==================== One Month Modified Files and Folders ======= 2014-05-20 19:40 - 2014-05-18 21:25 - 00020628 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt 2014-05-20 19:40 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST 2014-05-20 19:37 - 2010-09-23 11:48 - 01448293 _____ () C:\Windows\WindowsUpdate.log 2014-05-20 19:36 - 2014-05-20 19:36 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe 2014-05-20 19:33 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-20 19:33 - 2013-01-04 11:28 - 00089641 _____ () C:\Windows\setupact.log 2014-05-20 19:33 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-20 19:25 - 2014-05-20 19:25 - 00000628 _____ () C:\Users\Nerobyrn\Desktop\JRT.txt 2014-05-20 19:16 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-20 19:16 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-20 19:15 - 2014-05-20 19:15 - 01016261 _____ (Thisisu) C:\Users\Nerobyrn\Downloads\JRT.exe 2014-05-20 19:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-20 19:08 - 2013-04-30 20:38 - 00261796 _____ () C:\Windows\PFRO.log 2014-05-20 19:06 - 2013-11-03 02:58 - 00000000 ____D () C:\AdwCleaner 2014-05-20 19:01 - 2014-05-20 19:01 - 01326389 _____ () C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe 2014-05-20 19:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-20 12:41 - 2014-05-20 12:40 - 00048618 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt 2014-05-20 12:41 - 2014-05-20 12:40 - 00032898 _____ () C:\Users\Nerobyrn\Desktop\Addition.txt 2014-05-20 11:23 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-05-19 20:29 - 2012-02-12 20:56 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Listen_Lesezeichen 2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx 2014-05-19 14:49 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0013.tmp 2014-05-19 14:10 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Artes_artesanato 2014-05-19 09:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-19 09:44 - 2013-11-15 14:08 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Arzt_Zahnarzt 2014-05-19 09:32 - 2011-03-15 23:15 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Adobe 2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee 2014-05-19 09:31 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-19 09:31 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-19 09:31 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-19 08:45 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job 2014-05-19 00:17 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\Nerobyrn\Desktop\ccntis2.xls 2014-05-18 23:34 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL1601.tmp 2014-05-18 23:04 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3166.tmp 2014-05-18 21:57 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3656.tmp 2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe 2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Budget 2014-05-18 21:02 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2412.tmp 2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn 2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0659.tmp 2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL1677.tmp 2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0365.tmp 2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Google 2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google 2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0288.tmp 2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2318.tmp 2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2233.tmp 2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL3087.tmp 2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0740.tmp 2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2460.tmp 2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0595.tmp 2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0301.tmp 2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2149.tmp 2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini 2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bookmarks 2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe 2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0012.tmp 2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Jokes 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys 2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bewerbung 2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java 2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java 2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk 2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997 2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997 2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997 2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\Skype 2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\Nerobyrn 2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Deko 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList 2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList 2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software 2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft 2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft 2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0011.tmp 2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\Nerobyrn\Documents\a_Misc 2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay 2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\Nerobyrn\Dropbox 2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn-HP$ 2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job 2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Briefe Some content of TEMP: ==================== C:\Users\Nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x64.dll C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x86.dll C:\Users\Nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Nerobyrn\AppData\Local\Temp\nse5A5B.exe C:\Users\Nerobyrn\AppData\Local\Temp\nse996.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsk5F5C.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsp5481.exe C:\Users\Nerobyrn\AppData\Local\Temp\nspEB6.exe C:\Users\Nerobyrn\AppData\Local\Temp\nsu14A0.exe C:\Users\Nerobyrn\AppData\Local\Temp\Quarantine.exe C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\Nerobyrn\AppData\Local\Temp\sp-downloader.exe C:\Users\Nerobyrn\AppData\Local\Temp\sp64126.exe C:\Users\Nerobyrn\AppData\Local\Temp\SPSetup.exe C:\Users\Nerobyrn\AppData\Local\Temp\UninstallHPSA.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe [2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-19 12:43 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014 Ran by Nerobyrn at 2014-05-20 19:40:59 Running from C:\Users\Nerobyrn\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0} ==================== Installed Programs ====================== 7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov) AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH) Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 13.0.0.111 - Adobe Systems Incorporated) Hidden Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated) Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.) Amazon MP3-Downloader 1.0.15 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.15 - Amazon Services LLC) avast! Internet Security (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software) Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation) Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - ) Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - ) Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - ) Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: - ) Canon MG3100 series Benutzerregistrierung (HKLM-x32\...\Canon MG3100 series Benutzerregistrierung) (Version: - ) Canon MG3100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3100_series) (Version: - ) Canon MG3100 series On-screen Manual (HKLM-x32\...\Canon MG3100 series On-screen Manual) (Version: - ) Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version: - ) Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - ) Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - ) CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.) CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1.4217 - CyberLink Corp.) CyberLink PowerDVD 9 (x32 Version: 9.0.1.4217 - CyberLink Corp.) Hidden CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2511 - CyberLink Corp.) CyberLink YouCam (x32 Version: 3.0.2511 - CyberLink Corp.) Hidden Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard) ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard) Free YouTube Download version 3.2.33.424 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.33.424 - DVDVideoSoft Ltd.) FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.) Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.) Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard) HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden HP Documentation (HKLM-x32\...\{B360E24A-BF25-4353-AA79-1B54F509024A}) (Version: 1.0.0.0 - Hewlett-Packard) HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company) HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company) HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard) HP Software Framework (HKLM-x32\...\{AF6EB833-D48A-49AC-9394-4C57489FDFF2}) (Version: 4.1.13.1 - Hewlett-Packard Company) HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company) HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2131 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan) Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle) Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416045FF}) (Version: 6.0.450 - Oracle) Java(TM) 6 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216045FF}) (Version: 6.0.450 - Oracle) Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2907 - CyberLink Corp.) LabelPrint (x32 Version: 2.5.2907 - CyberLink Corp.) Hidden LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft Office 2000 Professional (HKLM-x32\...\{00010407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation) Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge) PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge) PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.212.0 - Tracker Software Products Ltd) PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.) PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4204 - CyberLink Corp.) Power2Go (x32 Version: 6.1.4204 - CyberLink Corp.) Hidden PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3003 - CyberLink Corp.) PowerDirector (x32 Version: 8.0.3003 - CyberLink Corp.) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.25.824.2010 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.) Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - ) RtVOsd (HKLM\...\{091A0130-A82F-4A6D-9C61-3BBBB3289030}) (Version: 1.0.6 - Realtek Semiconductor Corp.) Samsung New PC Studio (HKLM-x32\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Samsung New PC Studio (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.650.0 - SAMSUNG Electronics Co., Ltd.) Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.) Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.0 - Synaptics Incorporated) Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler) waterMark V2 (HKLM-x32\...\waterMark V2) (Version: - ) Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation) Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation) Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation) Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) ==================== Restore Points ========================= 02-05-2014 10:27:47 Windows Update 02-05-2014 22:31:24 Windows Update 03-05-2014 23:18:09 TuneUp Utilities 2014 wird entfernt 03-05-2014 23:19:02 TuneUp Utilities 2014 (de-DE) wird entfernt 04-05-2014 17:33:43 Windows-Sicherung 10-05-2014 17:41:39 Windows Update 10-05-2014 22:08:09 Windows Update 11-05-2014 18:51:31 Windows-Sicherung 12-05-2014 08:41:38 avast! antivirus system restore point 15-05-2014 20:23:20 Windows Update 17-05-2014 11:54:28 Säuberung (Spybot - Search & Destroy 2.3, Administratorrechte) 18-05-2014 17:00:12 Windows-Sicherung ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {00621FE6-97B0-453C-904E-297740F769B6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company) Task: {0AB49A2C-3AAB-483B-8E5D-3841FFFF6267} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-19] (Adobe Systems Incorporated) Task: {18D8F90E-1E99-418B-9C1E-2CBB4B717FC8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard) Task: {4AC7713C-B642-4A37-9AB8-3D3BBEE9A53B} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-05-12] (AVAST Software) Task: {4BB2EEEE-8399-47DF-8F13-734111D4206A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company) Task: {5DC1314E-E966-4978-8851-29B9C4E72F13} - System32\Tasks\HPCeeScheduleForNerobyrn-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard) Task: {724589F9-0A4F-4271-B6A6-AB19ABDC5C85} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {77D2A8AE-EE4C-4A09-A6A7-E4FBCF023B8A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {7D69B46C-12D8-4805-B5D6-C43B34887787} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company) Task: {86271439-898E-4D0F-BDEF-BA4F04156C7C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {A06276EA-B0B4-40FE-9560-95B334CA9ED4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.) Task: {C84D2EE0-A35D-4EB5-9BBB-93204A6F493D} - System32\Tasks\HPCeeScheduleForNerobyrn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard) Task: {E73BC00E-0FEF-4EF3-AC0B-17E4D7A6138A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {F4BA29A6-F96B-41F9-ABC7-6C55FCCB2115} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe ==================== Loaded Modules (whitelisted) ============= 2012-01-12 22:13 - 2010-06-17 22:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll 2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe 2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll 2010-06-18 16:26 - 2010-06-18 16:26 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll 2010-06-18 16:26 - 2010-06-18 16:26 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll 2014-05-20 11:22 - 2014-05-20 11:22 - 02253312 _____ () C:\Program Files\Alwil Software\Avast5\defs\14052000\algo.dll 2014-05-17 12:50 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2014-05-17 12:50 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2014-05-17 12:50 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2014-05-17 12:50 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2014-05-17 12:50 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2010-05-19 10:05 - 2010-05-19 10:05 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll 2010-05-19 10:05 - 2010-05-19 10:05 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll 2010-05-19 10:05 - 2010-05-19 10:05 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll 2013-12-03 10:35 - 2013-12-03 10:35 - 19336120 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libglesv2.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libegl.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll 2014-05-18 12:57 - 2014-05-08 01:29 - 13695816 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll 2014-02-13 22:44 - 2014-02-13 22:44 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\29335dc88d799664dcd97362bcb687e9\IsdiInterop.ni.dll 2010-09-23 11:52 - 2010-04-13 09:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= Name: avast! SecureLine TAP Adapter v3 Description: avast! SecureLine TAP Adapter v3 Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: TAP-Windows Provider V9 Service: aswTap Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: avast! Firewall NDIS Filter Miniport Description: avast! Firewall NDIS Filter Miniport Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: ALWIL Software Service: aswNdis Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19) Resolution: A registry problem was detected. This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options: On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver. ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 45% Total physical RAM: 3893.86 MB Available physical RAM: 2106.18 MB Total Pagefile: 7785.9 MB Available Pagefile: 5667.48 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:282.09 GB) (Free:225.84 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:15.7 GB) (Free:2.23 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298 GB) (Disk ID: CB9E9924) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=103 MB) - (Type=0C) ==================== End Of Log ============================ |
20.05.2014, 22:29 | #14 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Probleme mit dem Browser > Malware Okay, dann bitte Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
23.05.2014, 00:21 | #15 |
| Probleme mit dem Browser > MalwareCode:
ATTFilter <?xml version="1.0" encoding="UTF-16"?> -<mbam-log> -<header> <date>2014/05/22 23:05:27 +0200</date> <logfile>mbam-log-2014-05-22 (23-05-25).xml</logfile> <isadmin>yes</isadmin> </header> -<engine> <version>2.00.2.1012</version> <malware-database>v2014.05.22.12</malware-database> <rootkit-database>v2014.05.21.01</rootkit-database> <license>trial</license> <file-protection>enabled</file-protection> <web-protection>enabled</web-protection> <self-protection>disabled</self-protection> </engine> -<system> <osversion>Windows 7 Service Pack 1</osversion> <arch>x64</arch> <username>NEROBYRN</username> <filesys>NTFS</filesys> </system> -<summary> <type>threat</type> <result>completed</result> <objects>268002</objects> <time>584</time> <processes>0</processes> <modules>0</modules> <keys>0</keys> <values>0</values> <datas>0</datas> <folders>0</folders> <files>9</files> <sectors>0</sectors> </summary> -<options> <memory>enabled</memory> <startup>enabled</startup> <filesystem>enabled</filesystem> <archives>enabled</archives> <rootkits>disabled</rootkits> <deeprootkit>disabled</deeprootkit> <heuristics>enabled</heuristics> <pup>enabled</pup> <pum>enabled</pum> </options> -<items> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\nse5A5B.exe</path> <vendor>PUP.Optional.SearchProtect.A</vendor> <action>success</action> <hash>95df9db7dc9f191d3873f43520e1de22</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\nse996.exe</path> <vendor>PUP.Optional.SearchProtect.A</vendor> <action>success</action> <hash>bdb7db798fec290df2b9df4ad62bbd43</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\nsk5F5C.exe</path> <vendor>PUP.Optional.SearchProtect.A</vendor> <action>success</action> <hash>1c58084cee8d26104467e84135cc649c</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\nsp5481.exe</path> <vendor>PUP.Optional.SearchProtect.A</vendor> <action>success</action> <hash>3d37aba909726acc3972d1585ea3a858</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\nspEB6.exe</path> <vendor>PUP.Optional.SearchProtect.A</vendor> <action>success</action> <hash>0173a4b04932f343802bd059d928ef11</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\nsu14A0.exe</path> <vendor>PUP.Optional.SearchProtect.A</vendor> <action>success</action> <hash>4e26450f730854e2d2d938f138c9ee12</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\sp-downloader.exe</path> <vendor>PUP.Optional.Conduit.A</vendor> <action>success</action> <hash>a1d365efc0bb2016b027bf5da1609d63</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Local\Temp\nseD839\SpSetup.exe</path> <vendor>PUP.Optional.Conduit.A</vendor> <action>success</action> <hash>b6bee371413ae452a1fa72acaa5741bf</hash> </file> -<file> <path>C:\Users\NEROBYRN\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml</path> <vendor>PUP.Optional.Trovi.A</vendor> <action>success</action> <hash>443084d0b9c2a5914eb76a21fd055aa6</hash> </file> </items> </mbam-log> <?xml version="1.0" encoding="UTF-8"?> -<logs> <record subtype="Malware Protection" result="Starting" last_modified_tag="644b0f66-520d-4165-9397-d170cbfa46ee" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:31.204128+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malware Protection" result="Started" last_modified_tag="1e9a658a-976f-48b3-abd9-5ffb46dfd5cd" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:31.221129+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Starting" last_modified_tag="86ff5491-7bee-4e57-bc8b-626f6719f31f" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:31.261132+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Started" last_modified_tag="3fb54c18-bd8e-4ba9-b3ed-b4ae1f515ddc" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:35.034347+02:00" LoggingEventType="2" severity="debug"/> <record last_modified_tag="514db02e-5759-4193-a028-765fe93ed1cb" systemname="NEROBYRN-HP" username="SYSTEM" type="Update" source="Manual" datetime="2014-05-22T23:04:36.867452+02:00" LoggingEventType="1" severity="debug" toVersion="2014.5.21.1" name="Rootkit Database" fromVersion="2014.2.20.1"/> <record last_modified_tag="58f72d65-2d8d-4207-8539-b4d7bc794a3d" systemname="NEROBYRN-HP" username="SYSTEM" type="Update" source="Manual" datetime="2014-05-22T23:04:43.970858+02:00" LoggingEventType="1" severity="debug" toVersion="2014.5.22.12" name="Malware Database" fromVersion="2014.3.4.9"/> <record subtype="Refresh" result="Starting" last_modified_tag="36ee7bbd-bfe0-4aa6-8a64-0e58fbea687a" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:45.107924+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Stopping" last_modified_tag="a1416317-5680-4e19-9424-04718df078ba" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:45.112924+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Stopped" last_modified_tag="affde5f4-c02f-4428-ab80-20bd2bef9e95" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:45.149926+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Refresh" result="Success" last_modified_tag="0f8b91cb-3ed1-43a7-a1bf-83faa5f031f7" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:49.850195+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Starting" last_modified_tag="8d9a2f22-1e76-4321-b7bd-bb04055bd804" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:49.874196+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Started" last_modified_tag="55e7b22c-5209-47d7-a381-5beceb16993f" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:50.120210+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malware Protection" result="Starting" last_modified_tag="34babcaa-5a4c-43ec-a983-f1720d926263" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:18:50.523709+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malware Protection" result="Started" last_modified_tag="bdda5f08-0f0b-4f41-bc09-7a97ba9212b4" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:18:50.601709+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Starting" last_modified_tag="5bbf3d5e-eae0-4046-a318-4a95cb45c3a5" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:18:50.617309+02:00" LoggingEventType="2" severity="debug"/> <record subtype="Malicious Website Protection" result="Started" last_modified_tag="091cb075-12c0-451d-b766-078fc266aeeb" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:20:44.513109+02:00" LoggingEventType="2" severity="debug"/> </logs> Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=0a8fe4f326ffd04bb15721ac3172180a # engine=18372 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-05-22 11:15:54 # local_time=2014-05-23 01:15:54 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776573 100 94 124494 152430404 0 0 # scanned=212901 # found=2 # cleaned=0 # scan_time=4732 sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\babyrose\AppData\Roaming\OpenCandy\03B1B1E072A64E1CA01CCC8B46D54048\search_protect_global.exe.vir" sh=08ADA5974AE4CDE0E1A2610F48486C71833811B7 ft=1 fh=39a4b8e5163e42ce vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\babyrose\AppData\Local\Temp\SPSetup.exe" |
Themen zu Probleme mit dem Browser > Malware |
.com, andere, automatisch, avast, browser, erhalte, flash, flash player, gelöscht, gen, geändert, google, installiert, malware, meldungen, mozilla, nichts, player, plötzlich, probleme, seite, software, spybot, startseite, videos |