searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner

Katty · 18.06.2014, 21:12

Guten Tag,

vor einigen Tagen ärgerten uns massiv Einblendungen im Browser (keine Popups), dabei war der Begriff "raving reyven" zu lesen. Der Rechner wurde sehr langsam und war kaum noch zu gebrauchen.
Nach Löschen von 2-3 Programmen, die sich unterschwellig in der Zeit installiert hatten und nach Scan durch avira, mbam, adwcleaner, sc-cleaner, JRT und avast-browser-cleanup scheint ein Großteil der Ärgernisse entfernt. Im mbam scan tauchen nur noch wenige Funde auf, die jedoch sind hartnäckig ...

Hier kommen die gewünschten log.dateien:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-06-2014
Ran by Angelique (ATTENTION: The logged in user is not administrator) on ANGELIQUE-PC on 18-06-2014 20:02:12
Running from C:\Users\Angelique\Desktop
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Dropbox, Inc.) C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Runonce: [SPUpdSentinel] - "C:\Program Files\Common Files\Umbrella\Umbrella_bkp.exe" -SERVICEARGS=c -HKLMRunOnce=1
HKLM\...\RunOnce: [*Restore] - C:\windows\System32\rstrui.exe /runonce [262656 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Mobile Partner] => C:\Program Files\Mobile Partner\Mobile Partner.exe [540672 2010-01-08] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Facebook Update] => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-16] (Facebook Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [IncrediMail] => C:\Program Files\IncrediMail\bin\IncMail.exe [366576 2012-12-01] (IncrediMail, Ltd.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {32a285c4-0323-11e1-9b96-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba709-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba72a-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba786-fd98-11e0-bd08-001e101faa49} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk
ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
SearchScopes: HKCU - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de
SearchScopes: HKCU - {913EFC05-49A2-46C4-8CF1-7B5C8AB004D2} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {9F269F2D-4B93-4149-AAD9-88148B946E08} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_fs
SearchScopes: HKCU - {EAF954B9-B349-4A20-BFB1-674445DE695B} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {F1386E8E-9EBB-4FE8-B14A-B55DF1F18DD0} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F4428DA7-6596-44EC-8987-7FA604AB46DD} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{029509DA-91DB-45AF-9F70-4D08C7407C19}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{516F3F00-D2D0-4057-AF58-1EB4A6F30C9B}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Angelique\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03]
FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]
FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi
FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Google Docs) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-02]
CHR Extension: (Google Drive) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-02]
CHR Extension: (YouTube) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-02]
CHR Extension: (Google Cast) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-05-12]
CHR Extension: (Google Search) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-02]
CHR Extension: (Google Wallet) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Gmail) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-02]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-18] (SurfRight B.V.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 lmhosts; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NlaSvc; C:\windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek )
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation)
S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed]
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X]
S3 XDva389; \??\C:\windows\system32\XDva389.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-06-18 20:02 - 2014-06-18 20:02 - 00020939 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-18 20:01 - 2014-06-18 20:02 - 00000000 ____D () C:\FRST
2014-06-18 20:01 - 2014-06-18 20:01 - 01072640 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable
2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:38 - 2014-06-18 18:39 - 00001796 _____ () C:\sc-cleaner.txt
2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:22 - 2014-06-18 18:34 - 00000628 _____ () C:\windows\PFRO.log
2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-18 17:10 - 2014-06-18 18:33 - 00000000 ____D () C:\AdwCleaner
2014-06-18 16:26 - 2014-06-18 16:29 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-15 11:20 - 2014-06-18 19:18 - 00000392 _____ () C:\windows\setupact.log
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-14 06:55 - 2014-06-14 06:56 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList

==================== One Month Modified Files and Folders =======

2014-06-18 20:02 - 2014-06-18 20:02 - 00020939 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-18 20:02 - 2014-06-18 20:01 - 00000000 ____D () C:\FRST
2014-06-18 20:02 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique\AppData\Local\Temp
2014-06-18 20:01 - 2014-06-18 20:01 - 01072640 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable
2014-06-18 19:57 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin
2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera
2014-06-18 19:52 - 2012-04-02 08:16 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 19:28 - 2010-03-05 06:29 - 01396407 _____ () C:\windows\WindowsUpdate.log
2014-06-18 19:25 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-18 19:25 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-18 19:22 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-18 19:21 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM
2014-06-18 19:20 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM
2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2014-06-18 19:19 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox
2014-06-18 19:19 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster
2014-06-18 19:19 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox
2014-06-18 19:19 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-18 19:18 - 2014-06-15 11:20 - 00000392 _____ () C:\windows\setupact.log
2014-06-18 19:18 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-18 19:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job
2014-06-18 19:07 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja
2014-06-18 18:53 - 2014-05-13 08:19 - 00000000 ____D () C:\Program Files\PSHD-9.9
2014-06-18 18:39 - 2014-06-18 18:38 - 00001796 _____ () C:\sc-cleaner.txt
2014-06-18 18:34 - 2014-06-18 18:22 - 00000628 _____ () C:\windows\PFRO.log
2014-06-18 18:33 - 2014-06-18 17:10 - 00000000 ____D () C:\AdwCleaner
2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk
2014-06-18 16:53 - 2014-05-17 08:18 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-18 16:29 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini
2014-06-17 23:07 - 2012-04-02 08:16 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-06-17 23:07 - 2011-08-15 19:31 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique
2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp
2014-06-17 19:23 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin
2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-17 10:13 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin
2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer
2014-06-16 06:42 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-14 06:56 - 2014-06-14 06:55 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-06-03 12:26 - 2012-11-30 22:59 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
2014-05-23 06:37 - 2014-05-17 09:01 - 00001033 _____ () C:\Users\Angelique\Desktop\Dropbox.lnk
2014-05-23 06:37 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList

Some content of TEMP:
====================
C:\Users\Angelique\AppData\Local\Temp\avgnt.exe
C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppfhejy.dll

==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version:16-06-2014
Ran by Angelique at 2014-06-18 20:02:46
Running from C:\Users\Angelique\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1210 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.9.0.1210 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AIO_CDB_ProductContext (Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_CDB_Software (Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_Scan (Version: 130.0.421.000 - Hewlett-Packard) Hidden
Alice Greenfingers (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version: - Oberon Media)
Amazon Music Importer (HKLM\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC)
Amazon Music Importer (Version: 2.1.0 - Amazon Services LLC) Hidden
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft ShowBiz (HKLM\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version: - ArcSoft)
Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.2.1119 - Atheros)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
AVS Update Manager 1.0 (HKLM\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (HKLM\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.)
BatteryLifeExtender (HKLM\...\{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}) (Version: 1.0.1 - Samsung)
Biet-O-Matic v2.14.12 (HKLM\...\Biet-O-Matic v2.14.12) (Version: 2.14.12 - BOM Development Team)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
ChargeableUSB (HKLM\...\{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}) (Version: 1.0.0.0 - SAMSUNG)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant Polaris Unused CIR Function (HKLM\...\Uninstaller52bc73a10) (Version: 1.0.0.0 - Conexant Systems)
Copy (Version: 130.0.428.000 - Hewlett-Packard) Hidden
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.)
CyberLink DVD Suite (Version: 6.0.2806 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink LabelPrint (Version: 2.5.1916 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108a - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.3108a - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3213 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.3213 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815b - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2815b - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1812 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1812 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3625 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.3625 - CyberLink Corp.) Hidden
Dairy Dash (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version: - Oberon Media)
DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden
Die Sims™ 3 (HKLM\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.57.62 - Electronic Arts)
DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{34B76DCB-BF7C-440F-B058-C84172C1E338}) (Version: 4.2.8 - Samsung)
EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.3 - Samsung)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.0.13587 - Landesfinanzdirektion Thüringen)
eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
F300 (Version: 130.0.365.000 - Hewlett-Packard) Hidden
F300_Help (Version: 82.0.242.000 - Hewlett-Packard) Hidden
F300Trb (Version: 82.0.242.000 - Hewlett-Packard) Hidden
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Farm Frenzy 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version: - Oberon Media)
Fax (Version: 130.0.418.000 - Hewlett-Packard) Hidden
Game Pack (HKLM\...\{63eafc52-b963-4297-a7eb-d412944e7065}_is1) (Version: 5.3.0.10 - Oberon Media, Inc.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
GMX Desktop Icons (HKLM\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)
GMX MailCheck für Internet Explorer (HKLM\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.4.0.0 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google SketchUp 8 (HKLM\...\{15F02176-0D12-4FAF-B2CD-2767C7781427}) (Version: 3.0.4993 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.0 - Google Inc.) Hidden
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.216 - SurfRight B.V.)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (HKLM\...\{B61ED343-0B14-4241-999C-490CB1A20DA4}) (Version: 13.0 - HP)
HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.001 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
IcoFX 1.6.4 (HKLM\...\IcoFX_is1) (Version: - )
IncrediMail (Version: 6.3.9.5248 - IncrediMail) Hidden
IncrediMail 2.0 (HKLM\...\IncrediMail) (Version: 6.3.9.5248 - IncrediMail Ltd.)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.3.1001 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1003 - Intel Corporation)
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 29 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216026FF}) (Version: 6.0.290 - Oracle)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mobile Partner (HKLM\...\Mobile Partner) (Version: 16.002.03.01.40 - Huawei Technologies Co.,Ltd)
MobileMe Control Panel (HKLM\...\{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}) (Version: 3.1.8.0 - Apple Inc.)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Network (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Nur Deinstallierung der CopyTrans Suite möglich. (HKCU\...\CopyTrans Suite) (Version: 2.27 - WindSolutions)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Opera 12.17 (HKLM\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
Origin (HKLM\...\Origin) (Version: 9.3.2.2730 - Electronic Arts, Inc.)
Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.3.5.6 - Pando Networks Inc.)
phase-6 2.3.3 (HKLM\...\phase-6) (Version: 2.3.3 - phase-6)
PhotoScape (HKLM\...\PhotoScape) (Version: - )
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6003 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Software (HKLM\...\{F2BC3383-F000-410C-A038-3846ADBE8D90}) (Version: 1.01.0088 - REALTEK Semiconductor Corp.)
Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung)
Samsung R-Series (HKLM\...\{3EED7541-55F8-4DC6-B9CD-28762D71310E}) (Version: 1.0 - Samsung)
Samsung Support Center (HKLM\...\{0A353130-D22C-41DD-8C67-1B02A05F2CE0}) (Version: 1.1.0 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.10.0 - Synaptics Incorporated)
System Requirements Lab (HKLM\...\SystemRequirementsLab) (Version: - )
TeamViewer 7 (HKLM\...\TeamViewer 7) (Version: 7.0.15723 - TeamViewer)
Tinypic 3.18 (HKLM\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
TippKönigin 5.5 (HKLM\...\TippKönigin_is1) (Version: - Giletech e.K.)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden
TrueCrypt (HKLM\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
TuneAid 3.76 (HKLM\...\TuneAid_is1) (Version: 3.76 - DigiDNA)
UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden
USB PnP Sound Device (HKLM\...\C-Media CM108 Like Sound Driver) (Version: - )
USB PnP Sound Device (HKLM\...\Generic USB 108 Sound) (Version: - )
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
Video Grabber (HKLM\...\Uninstaller52bc73a00) (Version: 1.0.0.0 - Conexant Systems)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinZip 14.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}) (Version: 14.5.9095 - WinZip Computing, S.L. )

==================== Restore Points =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

==================== Loaded Modules (whitelisted) =============

2010-03-05 06:38 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-06-03 13:59 - 2009-06-03 13:59 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-06-03 13:59 - 2009-06-03 13:59 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2011-11-02 00:26 - 2011-11-02 00:26 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-11-02 00:26 - 2011-11-02 00:26 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-06-18 19:19 - 2014-06-18 19:19 - 00043008 _____ () C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppfhejy.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Angelique\AppData\Roaming\Dropbox\bin\libcef.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
AlternateDataStreams: C:\ProgramData\Temp:A42A9F39
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============

==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Angelique^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk => C:\windows\pss\OpenOffice.org 3.2.lnk.Startup
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: IncrediMail => C:\Program Files\IncrediMail\bin\IncMail.exe /c
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: PDVD8LanguageShortcut => "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RemoteControl8 => "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (06/18/2014 06:52:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/18/2014 06:36:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IncMail.exe, Version: 6.3.9.5248, Zeitstempel: 0x50a8f106
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe06d7363
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xe04
Startzeit der fehlerhaften Anwendung: 0xIncMail.exe0
Pfad der fehlerhaften Anwendung: IncMail.exe1
Pfad des fehlerhaften Moduls: IncMail.exe2
Berichtskennung: IncMail.exe3

Error: (06/18/2014 06:36:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IncMail.exe, Version: 6.3.9.5248, Zeitstempel: 0x50a8f106
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xe04
Startzeit der fehlerhaften Anwendung: 0xIncMail.exe0
Pfad der fehlerhaften Anwendung: IncMail.exe1
Pfad des fehlerhaften Moduls: IncMail.exe2
Berichtskennung: IncMail.exe3

Error: (06/18/2014 06:35:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ImApp.exe, Version: 6.3.9.5248, Zeitstempel: 0x50a8eb91
Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.6195, Zeitstempel: 0x4dcddbf3
Ausnahmecode: 0xc000000d
Fehleroffset: 0x00045d67
ID des fehlerhaften Prozesses: 0x69c
Startzeit der fehlerhaften Anwendung: 0xImApp.exe0
Pfad der fehlerhaften Anwendung: ImApp.exe1
Pfad des fehlerhaften Moduls: ImApp.exe2
Berichtskennung: ImApp.exe3

System errors:
=============

Microsoft Office Sessions:
=========================
Error: (06/18/2014 06:52:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Users\Angelique\AppData\Lo cal\Opera\Opera\temporary_downloads\hitmanpro379\hitmanpro_x64.exe

Error: (06/18/2014 06:36:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IncMail.exe6.3.9.524850a8f106KERNELBASE.dll6.1.7601.18409531599f6e06d73630000812fe0401cf8b133fd0346bC:\Program Files\IncrediMail\Bin\IncMail.exeC:\windows\system32\KERNELBASE.dllab644363-f706-11e3-9cd4-0024548754ef

Error: (06/18/2014 06:36:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IncMail.exe6.3.9.524850a8f106unknown0.0.0.000000000c000000500000000e0401cf8b133fd0346bC:\Program Files\IncrediMail\Bin\IncMail.exeunknowna8f49adb-f706-11e3-9cd4-0024548754ef

Error: (06/18/2014 06:35:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ImApp.exe6.3.9.524850a8eb91MSVCR80.dll8.0.50727.61954dcddbf3c000000d00045d6769c01cf8b13441f1ca4C:\Program Files\IncrediMail\Bin\ImApp.exeC:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.dll9d4d6a34-f706-11e3-9cd4-0024548754ef

==================== Memory info ===========================

Percentage of memory in use: 39%
Total physical RAM: 3565.61 MB
Available physical RAM: 2158.88 MB
Total Pagefile: 7129.52 MB
Available Pagefile: 5554.95 MB
Total Virtual: 2047.88 MB
Available Virtual: 1895.5 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:141.49 GB) (Free:82.04 GB) NTFS
Drive d: (Volume) (Fixed) (Total:141.5 GB) (Free:42.62 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:58 on 18/06/2014 (Armin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 18.06.2014
Suchlauf-Zeit: 19:23:00
Logdatei: Malwarebytes.txt
Administrator: Nein

Version: 2.00.2.1012
Malware Datenbank: v2014.06.18.07
Rootkit Datenbank: v2014.06.02.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Angelique

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 209728
Verstrichene Zeit: 9 Min, 46 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 14
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4B62762D-AA67-4312-A5BF-91BCB7A4720A}, Löschen bei Neustart, [935cde9b601bd561d77992e8eb17cc34],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\TypeLib\{105F25A9-C42F-48A6-998D-0494E8AE336A}, In Quarantäne, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{506DD7C6-B05D-43CE-81FF-AA05E11DBDFD}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6D3C9858-2674-46E1-9112-107340758481}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{79C9FA6C-352A-49BA-89BA-85077BC35DC3}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{909112FE-C4A2-4990-A499-E58867D55B15}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{9BEEB5A2-8B02-465A-904D-FE5A447F59EB}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B618C19D-A418-4586-80C6-09DBDA9C748E}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B68B00A0-95B9-4162-BA45-7A1113317DA9}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{BFE45A8B-650C-4E99-A3F4-CC6A2874893B}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E413D78F-283C-45F1-9992-8EF7D55A4933}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E7C2FDF1-1635-41B4-8207-C1684B6807D7}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F9F5A267-FA5A-4CA3-8BE5-4C1EEAD01011}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749],
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\PSHD-9.9, Löschen bei Neustart, [19d697e21368f73fa69f3579f210e917],

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 1
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],

Dateien: 7
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\1293297481.mxaddon, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\360-52916.crx, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\52916.crx, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\52916.xpi, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\background.html, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\bgNova.html, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\PSHD-9.9.ico, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de],

Physische Sektoren: 0
(No malicious items detected)

(end)

..... im ersten mbam-Scan tauchten noch viele andere "Plagegeister" auf .. dieser Scan hat hier leider nicht reingepasst .. kann auf Wunsch gern als Anhang nachgereicht werden.

Herzlichen Dank im Voraus für die Mühe!

Katty

schrauber · 18.06.2014, 22:09

Hi,

unsere Tools brauchen immer Adminrechte!

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Katty · 19.06.2014, 06:55

DANKE, dass Du Dich des Problems annimmst!

Hier kommt die log-Datei des adwcleaner:

Code:

ATTFilter

# AdwCleaner v3.212 - Bericht erstellt am 19/06/2014 um 07:23:20
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Armin - ANGELIQUE-PC
# Gestartet von : C:\Users\Angelique\Desktop\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126


-\\ Google Chrome v35.0.1916.153

[ Datei : C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ Datei : C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [37527 octets] - [18/06/2014 17:12:25]
AdwCleaner[R1].txt - [1312 octets] - [18/06/2014 18:26:46]
AdwCleaner[R2].txt - [1145 octets] - [19/06/2014 07:18:31]
AdwCleaner[S0].txt - [36038 octets] - [18/06/2014 18:21:09]
AdwCleaner[S1].txt - [1249 octets] - [18/06/2014 18:33:36]
AdwCleaner[S2].txt - [1069 octets] - [19/06/2014 07:23:20]

########## EOF - \AdwCleaner\AdwCleaner[S2].txt - [1129 octets] ##########

JRT:
als Laie mitgedacht ... während der Prüfung checkt er den IE und auch den Chrome-Browser, wir benutzen hauptsächlich jedoch Opera ?!

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x86
Ran by Armin on 19.06.2014 at  7:43:10,25
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.06.2014 at  7:45:14,72
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-06-2014
Ran by Angelique (ATTENTION: The logged in user is not administrator) on ANGELIQUE-PC on 19-06-2014 07:52:27
Running from C:\Users\Angelique\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(IncrediMail, Ltd.) C:\Program Files\IncrediMail\Bin\IncMail.exe
(Dropbox, Inc.) C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe
(IncrediMail, Ltd.) C:\Program Files\IncrediMail\Bin\ImApp.exe
(Opera Software) C:\Program Files\Opera\opera.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Runonce: [SPUpdSentinel] - "C:\Program Files\Common Files\Umbrella\Umbrella_bkp.exe"  -SERVICEARGS=c -HKLMRunOnce=1
HKLM\...\RunOnce: [*Restore] - C:\windows\System32\rstrui.exe /runonce [262656 2010-11-20] (Microsoft Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [360448 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Mobile Partner] => C:\Program Files\Mobile Partner\Mobile Partner.exe [540672 2010-01-08] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Facebook Update] => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-16] (Facebook Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [IncrediMail] => C:\Program Files\IncrediMail\bin\IncMail.exe [366576 2012-12-01] (IncrediMail, Ltd.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {32a285c4-0323-11e1-9b96-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba709-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba72a-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba786-fd98-11e0-bd08-001e101faa49} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk
ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
SearchScopes: HKCU - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de
SearchScopes: HKCU - {913EFC05-49A2-46C4-8CF1-7B5C8AB004D2} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {9F269F2D-4B93-4149-AAD9-88148B946E08} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_fs
SearchScopes: HKCU - {EAF954B9-B349-4A20-BFB1-674445DE695B} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {F1386E8E-9EBB-4FE8-B14A-B55DF1F18DD0} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F4428DA7-6596-44EC-8987-7FA604AB46DD} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{029509DA-91DB-45AF-9F70-4D08C7407C19}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{516F3F00-D2D0-4057-AF58-1EB4A6F30C9B}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Angelique\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03]
FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]
FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi
FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Google Docs) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-02]
CHR Extension: (Google Drive) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-02]
CHR Extension: (YouTube) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-02]
CHR Extension: (Google Cast) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-05-12]
CHR Extension: (Google Search) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-02]
CHR Extension: (Google Wallet) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Gmail) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-02]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-18] (SurfRight B.V.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 lmhosts; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NlaSvc; C:\windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek )
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation)
S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed]
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X]
S3 XDva389; \??\C:\windows\system32\XDva389.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-19 07:42 - 2014-06-19 07:42 - 01016261 _____ (Thisisu) C:\Users\Angelique\Desktop\JRT.exe
2014-06-19 07:16 - 2014-06-19 07:16 - 01333465 _____ () C:\Users\Angelique\Desktop\adwcleaner_3.212.exe
2014-06-18 20:58 - 2014-06-18 20:58 - 00000472 _____ () C:\Users\Angelique\Desktop\defogger_disable.log
2014-06-18 20:57 - 2014-06-18 20:57 - 00050477 _____ () C:\Users\Angelique\Desktop\Defogger.exe
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:10 - 2014-06-18 20:10 - 00380416 _____ () C:\Users\Angelique\Desktop\Gmer-19357.exe
2014-06-18 20:02 - 2014-06-19 07:52 - 00020947 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-18 20:02 - 2014-06-18 20:02 - 00025610 _____ () C:\Users\Angelique\Desktop\Addition.txt
2014-06-18 20:01 - 2014-06-19 07:52 - 00000000 ____D () C:\FRST
2014-06-18 20:01 - 2014-06-19 07:51 - 01072128 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable
2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:38 - 2014-06-18 18:39 - 00001796 _____ () C:\sc-cleaner.txt
2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:22 - 2014-06-19 07:24 - 00000938 _____ () C:\windows\PFRO.log
2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-18 17:10 - 2014-06-19 07:23 - 00000000 ____D () C:\AdwCleaner
2014-06-18 16:26 - 2014-06-18 16:29 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-15 11:20 - 2014-06-19 07:24 - 00000616 _____ () C:\windows\setupact.log
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-14 06:55 - 2014-06-14 06:56 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList

==================== One Month Modified Files and Folders =======

2014-06-19 07:52 - 2014-06-18 20:02 - 00020947 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-19 07:52 - 2014-06-18 20:01 - 00000000 ____D () C:\FRST
2014-06-19 07:52 - 2012-04-02 08:16 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-19 07:51 - 2014-06-18 20:01 - 01072128 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-19 07:42 - 2014-06-19 07:42 - 01016261 _____ (Thisisu) C:\Users\Angelique\Desktop\JRT.exe
2014-06-19 07:31 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-19 07:31 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-19 07:29 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox
2014-06-19 07:29 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster
2014-06-19 07:29 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox
2014-06-19 07:29 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM
2014-06-19 07:29 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-19 07:24 - 2014-06-18 18:22 - 00000938 _____ () C:\windows\PFRO.log
2014-06-19 07:24 - 2014-06-15 11:20 - 00000616 _____ () C:\windows\setupact.log
2014-06-19 07:24 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-19 07:23 - 2014-06-18 17:10 - 00000000 ____D () C:\AdwCleaner
2014-06-19 07:23 - 2010-03-05 06:29 - 01417394 _____ () C:\windows\WindowsUpdate.log
2014-06-19 07:16 - 2014-06-19 07:16 - 01333465 _____ () C:\Users\Angelique\Desktop\adwcleaner_3.212.exe
2014-06-19 07:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job
2014-06-19 07:07 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-18 20:58 - 2014-06-18 20:58 - 00000472 _____ () C:\Users\Angelique\Desktop\defogger_disable.log
2014-06-18 20:57 - 2014-06-18 20:57 - 00050477 _____ () C:\Users\Angelique\Desktop\Defogger.exe
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:19 - 2013-11-18 10:24 - 00000000 ____D () C:\windows\Minidump
2014-06-18 20:10 - 2014-06-18 20:10 - 00380416 _____ () C:\Users\Angelique\Desktop\Gmer-19357.exe
2014-06-18 20:02 - 2014-06-18 20:02 - 00025610 _____ () C:\Users\Angelique\Desktop\Addition.txt
2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable
2014-06-18 19:57 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin
2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera
2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 19:22 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-18 19:21 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM
2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja
2014-06-18 18:53 - 2014-05-13 08:19 - 00000000 ____D () C:\Program Files\PSHD-9.9
2014-06-18 18:39 - 2014-06-18 18:38 - 00001796 _____ () C:\sc-cleaner.txt
2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk
2014-06-18 16:53 - 2014-05-17 08:18 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-18 16:29 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini
2014-06-17 23:07 - 2012-04-02 08:16 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-06-17 23:07 - 2011-08-15 19:31 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique
2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp
2014-06-17 19:23 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin
2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-17 10:13 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin
2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer
2014-06-16 06:42 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-14 06:56 - 2014-06-14 06:55 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-06-03 12:26 - 2012-11-30 22:59 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
2014-05-23 06:37 - 2014-05-17 09:01 - 00001033 _____ () C:\Users\Angelique\Desktop\Dropbox.lnk
2014-05-23 06:37 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList

Some content of TEMP:
====================
C:\Users\Angelique\AppData\Local\Temp\avgnt.exe
C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpegjyng.dll


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

schrauber · 19.06.2014, 20:40

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Katty · 20.06.2014, 05:18

Und weiter gehts ...

Um Deine Frage zu beantworten: Nein, ich bemerke keine Beeinträchtigungen mehr, Rechner läuft relativ schnell und stabil, keine komischen Einblendungen mehr.

Ich sehe aber auch im eset-log wieder reichlich Zeugs, was da wohl nicht hingehört.
Mache mir Sorgen um Identitätsklau, Passwörter, Zugangsdaten etc.

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=f87e335b7de83842969161a3f4fe678d
# engine=18789
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-20 12:45:14
# local_time=2014-06-20 02:45:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 11934 268648404 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 82 199316 154856305 0 0
# scanned=231688
# found=29
# cleaned=0
# scan_time=10548
sh=1F2C0A5D4CB1B47D1DDC86E3516F06B3ECA63A56 ft=1 fh=94049be6457143fb vn="möglicherweise Variante von MSIL/DomaIQ.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\DomaIQ Uninstaller\DomaIQUninstall.exe.vir"
sh=D8F10BDFCF1D7203A10EDD44BFA91E63429F7509 ft=1 fh=125879de58b34aa1 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Armin\AppData\Roaming\BabSolution\Shared\BabMaint.exe.vir"
sh=87FA5B4C8866515E9646F78D03F8A141DB131BD6 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\PSHD-9.9\360-52916.crx"
sh=516610810C717DF04F5BEDC9C655DB28C72F116F ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\PSHD-9.9\52916.crx"
sh=3C0673139E9852F1227BD78AA8AC6B241D819CF4 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\PSHD-9.9\52916.xpi"
sh=E7F1EF395106B99D0D92742C374974DA46F34359 ft=1 fh=bbabeb6ad532c5bf vn="Variante von Win32/DomaIQ.BF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000"
sh=088064B6073242CEDEA418D03764E16A08711AE0 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.PTS Trojaner" ac=I fn="C:\Users\Angelique\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\78d2642-4b2933b1"
sh=1C4E66B27D660260C533B2D6C8EC565673AB7C6E ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Angelique\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\6ad6143f-1d9f39a3"
sh=1C4E66B27D660260C533B2D6C8EC565673AB7C6E ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Angelique\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\6ad6143f-2bf9d6f0"
sh=1C4E66B27D660260C533B2D6C8EC565673AB7C6E ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Angelique\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\6ad6143f-582f5d8c"
sh=4358795A933FBFF53678EA7212229DC8A9BC3901 ft=1 fh=72f4d4862e1e1b28 vn="Variante von Win32/InstallBrain.BH evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Angelique\Documents\77ZipSetup.exe"
sh=3DB7BB697799AD6AD83D9F5E44595703E12C2515 ft=1 fh=663ad855f9f35e47 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Angelique\Documents\Paint NET - CHIP-Downloader.exe"
sh=DBF8091E8DEE39B477B44121BE750FB99257D177 ft=1 fh=aed6a518cc0a547e vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Angelique\Documents\phase6 - Lerninhalte\Biet O Matic - CHIP-Downloader.exe"
sh=23D0D215029CC1572F44B02AD347866A2E829068 ft=1 fh=9b3854cf185d8120 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Angelique\Pictures\2014-04-16\SoftonicDownloader_fuer_photoscape.exe"
sh=7F1D6F73773DC1259EF5B2F4E565BE1FDFE65D04 ft=1 fh=b9aa859122368835 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Angelique\Pictures\2014-04-16\TinyPic - CHIP-Downloader.exe"
sh=2F8BF1566D8E6F6697A8594A03BDFB1EA2B61025 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallBrain.O evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2012-11-30 174239\Backup Files 2013-01-06 190001\Backup files 2.zip"
sh=AD62E1A2F1855057B60096945063742333D5282E ft=0 fh=0000000000000000 vn="Variante von Win32/InstallBrain.O evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2013-02-17 201440\Backup Files 2013-02-17 201440\Backup files 8.zip"
sh=3524FB632520591B7BC06627C5FBF1DA173848C1 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallBrain.O evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2013-05-26 190002\Backup Files 2013-05-26 190002\Backup files 9.zip"
sh=0CD130FAB857F4D1A73148C4011849D092A5B4AC ft=0 fh=0000000000000000 vn="Variante von Win32/InstallBrain.O evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2013-08-18 190002\Backup Files 2013-08-18 190002\Backup files 10.zip"
sh=0319CC902475CF64043263D30043FBD3FCD38694 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2013-08-18 190002\Backup Files 2013-09-08 190002\Backup files 1.zip"
sh=5F9B4E0109A27DC4178C5A6D02028655120790D9 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2013-11-03 190002\Backup Files 2013-11-03 190002\Backup files 1.zip"
sh=E5888332EC75A022C4F395CA8E4DCEC4681EF965 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2013-11-03 190002\Backup Files 2013-11-03 190002\Backup files 10.zip"
sh=4309825A4B84F7DA6C22AEF4FE0A5BB6412C79F7 ft=0 fh=0000000000000000 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2013-11-03 190002\Backup Files 2014-02-23 190002\Backup files 1.zip"
sh=7E5D92B524030FC20786F46787839109BCD4B217 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallBrain.BH evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2014-04-21 210046\Backup Files 2014-04-21 210046\Backup files 1.zip"
sh=FC94E163C52912328BBC3A1238A35E43ACAFD8B6 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2014-04-21 210046\Backup Files 2014-04-21 210046\Backup files 10.zip"
sh=EC12CFCB1A637734C64ED94A9F1CFE7F67A212DE ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2014-04-21 210046\Backup Files 2014-04-21 210046\Backup files 2.zip"
sh=3A1737A27E9D76082BB12A4800C4A3F7340FC6B1 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2014-04-21 210046\Backup Files 2014-05-04 190002\Backup files 1.zip"
sh=F1140423BD2AD0CD7C4C7F0BA759D8906A7CF98C ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2014-04-21 210046\Backup Files 2014-05-18 190002\Backup files 1.zip"
sh=50F440491B576D2BF68810877C6F56FE27A2C0D7 ft=0 fh=0000000000000000 vn="Variante von Win32/DomaIQ.BF evtl. unerwünschte Anwendung" ac=I fn="D:\ANGELIQUE-PC\Backup Set 2014-04-21 210046\Backup Files 2014-05-25 190002\Backup files 1.zip"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.83  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 CCleaner     
 Java(TM) 6 Update 29  
 Java 7 Update 55  
 Adobe Flash Player 	14.0.0.125  
 Adobe Reader XI  
 Google Chrome 35.0.1916.114  
 Google Chrome 35.0.1916.153  
 Google Chrome wtsapi32.dll..  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-06-2014
Ran by Angelique (ATTENTION: The logged in user is not administrator) on ANGELIQUE-PC on 20-06-2014 06:16:18
Running from C:\Users\Angelique\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Dropbox, Inc.) C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Opera Software) C:\Program Files\Opera\opera.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Runonce: [SPUpdSentinel] - "C:\Program Files\Common Files\Umbrella\Umbrella_bkp.exe"  -SERVICEARGS=c -HKLMRunOnce=1
HKLM\...\RunOnce: [*Restore] - C:\windows\System32\rstrui.exe /runonce [262656 2010-11-20] (Microsoft Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [360448 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Mobile Partner] => C:\Program Files\Mobile Partner\Mobile Partner.exe [540672 2010-01-08] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Facebook Update] => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-16] (Facebook Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [IncrediMail] => C:\Program Files\IncrediMail\bin\IncMail.exe [366576 2012-12-01] (IncrediMail, Ltd.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {32a285c4-0323-11e1-9b96-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba709-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba72a-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba786-fd98-11e0-bd08-001e101faa49} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk
ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
SearchScopes: HKCU - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de
SearchScopes: HKCU - {913EFC05-49A2-46C4-8CF1-7B5C8AB004D2} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {9F269F2D-4B93-4149-AAD9-88148B946E08} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_fs
SearchScopes: HKCU - {EAF954B9-B349-4A20-BFB1-674445DE695B} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {F1386E8E-9EBB-4FE8-B14A-B55DF1F18DD0} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F4428DA7-6596-44EC-8987-7FA604AB46DD} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{029509DA-91DB-45AF-9F70-4D08C7407C19}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{516F3F00-D2D0-4057-AF58-1EB4A6F30C9B}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Angelique\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03]
FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]
FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi
FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Google Docs) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-02]
CHR Extension: (Google Drive) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-02]
CHR Extension: (YouTube) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-02]
CHR Extension: (Google Cast) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-05-12]
CHR Extension: (Google Search) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-02]
CHR Extension: (Google Wallet) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Gmail) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-02]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-18] (SurfRight B.V.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 lmhosts; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NlaSvc; C:\windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek )
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation)
S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed]
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X]
S3 XDva389; \??\C:\windows\system32\XDva389.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-20 06:16 - 2014-06-20 06:16 - 00020875 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-20 06:09 - 2014-06-20 06:09 - 00854367 _____ () C:\Users\Angelique\Desktop\SecurityCheck.exe
2014-06-19 23:41 - 2014-06-19 23:42 - 02347384 _____ (ESET) C:\Users\Angelique\Desktop\esetsmartinstaller_deu.exe
2014-06-19 07:42 - 2014-06-19 07:42 - 01016261 _____ (Thisisu) C:\Users\Angelique\Desktop\JRT.exe
2014-06-19 07:16 - 2014-06-19 07:16 - 01333465 _____ () C:\Users\Angelique\Desktop\adwcleaner_3.212.exe
2014-06-18 20:58 - 2014-06-18 20:58 - 00000472 _____ () C:\Users\Angelique\Desktop\defogger_disable.log
2014-06-18 20:57 - 2014-06-18 20:57 - 00050477 _____ () C:\Users\Angelique\Desktop\Defogger.exe
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:10 - 2014-06-18 20:10 - 00380416 _____ () C:\Users\Angelique\Desktop\Gmer-19357.exe
2014-06-18 20:01 - 2014-06-20 06:16 - 00000000 ____D () C:\FRST
2014-06-18 20:01 - 2014-06-19 07:51 - 01072128 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable
2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:38 - 2014-06-18 18:39 - 00001796 _____ () C:\sc-cleaner.txt
2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:22 - 2014-06-19 07:24 - 00000938 _____ () C:\windows\PFRO.log
2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-18 17:10 - 2014-06-19 07:23 - 00000000 ____D () C:\AdwCleaner
2014-06-18 16:26 - 2014-06-18 16:29 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-15 11:20 - 2014-06-19 07:59 - 00000672 _____ () C:\windows\setupact.log
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-14 06:55 - 2014-06-14 06:56 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList

==================== One Month Modified Files and Folders =======

2014-06-20 06:16 - 2014-06-20 06:16 - 00020875 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-20 06:16 - 2014-06-18 20:01 - 00000000 ____D () C:\FRST
2014-06-20 06:09 - 2014-06-20 06:09 - 00854367 _____ () C:\Users\Angelique\Desktop\SecurityCheck.exe
2014-06-20 06:07 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-20 05:52 - 2012-04-02 08:16 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-20 04:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job
2014-06-20 03:00 - 2010-03-05 06:29 - 01434133 _____ () C:\windows\WindowsUpdate.log
2014-06-20 01:14 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job
2014-06-19 23:42 - 2014-06-19 23:41 - 02347384 _____ (ESET) C:\Users\Angelique\Desktop\esetsmartinstaller_deu.exe
2014-06-19 19:07 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-19 08:16 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM
2014-06-19 08:13 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox
2014-06-19 08:13 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster
2014-06-19 08:13 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox
2014-06-19 08:06 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-19 08:06 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-19 07:59 - 2014-06-15 11:20 - 00000672 _____ () C:\windows\setupact.log
2014-06-19 07:59 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-19 07:51 - 2014-06-18 20:01 - 01072128 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-19 07:42 - 2014-06-19 07:42 - 01016261 _____ (Thisisu) C:\Users\Angelique\Desktop\JRT.exe
2014-06-19 07:24 - 2014-06-18 18:22 - 00000938 _____ () C:\windows\PFRO.log
2014-06-19 07:23 - 2014-06-18 17:10 - 00000000 ____D () C:\AdwCleaner
2014-06-19 07:16 - 2014-06-19 07:16 - 01333465 _____ () C:\Users\Angelique\Desktop\adwcleaner_3.212.exe
2014-06-18 20:58 - 2014-06-18 20:58 - 00000472 _____ () C:\Users\Angelique\Desktop\defogger_disable.log
2014-06-18 20:57 - 2014-06-18 20:57 - 00050477 _____ () C:\Users\Angelique\Desktop\Defogger.exe
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:19 - 2013-11-18 10:24 - 00000000 ____D () C:\windows\Minidump
2014-06-18 20:10 - 2014-06-18 20:10 - 00380416 _____ () C:\Users\Angelique\Desktop\Gmer-19357.exe
2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable
2014-06-18 19:57 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin
2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera
2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 19:22 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-18 19:21 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM
2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja
2014-06-18 18:53 - 2014-05-13 08:19 - 00000000 ____D () C:\Program Files\PSHD-9.9
2014-06-18 18:39 - 2014-06-18 18:38 - 00001796 _____ () C:\sc-cleaner.txt
2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk
2014-06-18 16:53 - 2014-05-17 08:18 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-18 16:29 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini
2014-06-17 23:07 - 2012-04-02 08:16 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-06-17 23:07 - 2011-08-15 19:31 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique
2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp
2014-06-17 19:23 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin
2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-17 10:13 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin
2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-14 06:56 - 2014-06-14 06:55 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-06-03 12:26 - 2012-11-30 22:59 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
2014-05-23 06:37 - 2014-05-17 09:01 - 00001033 _____ () C:\Users\Angelique\Desktop\Dropbox.lnk
2014-05-23 06:37 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList
2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList

Some content of TEMP:
====================
C:\Users\Angelique\AppData\Local\Temp\avgnt.exe
C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpnyatvz.dll


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 20.06.2014, 20:01

Backup auf D löschen.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Program Files\PSHD-9.9
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Mobile Partner] => C:\Program Files\Mobile Partner\Mobile Partner.exe [540672 2010-01-08] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Facebook Update] => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-16] (Facebook Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [IncrediMail] => C:\Program Files\IncrediMail\bin\IncMail.exe [366576 2012-12-01] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Paswörter ändern ist Pflicht bei Befall, aber das hier war nur Adware.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Katty · 20.06.2014, 22:45

Guten Abend,

und weiter gehts mit Fixlog.txt

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:20-06-2014
Ran by Angelique at 2014-06-20 22:20:07 Run:1
Running from C:\Users\Angelique\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Program Files\PSHD-9.9
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Mobile Partner] => C:\Program Files\Mobile Partner\Mobile Partner.exe [540672 2010-01-08] ()
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Facebook Update] => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-16] (Facebook Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [IncrediMail] => C:\Program Files\IncrediMail\bin\IncMail.exe [366576 2012-12-01] (IncrediMail, Ltd.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
         
*****************


"C:\Program Files\PSHD-9.9" directory move:

Could not move "C:\Program Files\PSHD-9.9\1293297481.mxaddon" => Scheduled to move on reboot.
Could not move "C:\Program Files\PSHD-9.9\360-52916.crx" => Scheduled to move on reboot.
Could not move "C:\Program Files\PSHD-9.9\52916.crx" => Scheduled to move on reboot.
Could not move "C:\Program Files\PSHD-9.9\52916.xpi" => Scheduled to move on reboot.
Could not move "C:\Program Files\PSHD-9.9\background.html" => Scheduled to move on reboot.
Could not move "C:\Program Files\PSHD-9.9\bgNova.html" => Scheduled to move on reboot.
Could not move "C:\Program Files\PSHD-9.9\PSHD-9.9.ico" => Scheduled to move on reboot.
Could not move "C:\Program Files\PSHD-9.9" directory. => Scheduled to move on reboot.

HKU\S-1-5-21-2339853823-2107313754-116825072-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Mobile Partner => value deleted successfully.
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Facebook Update => value deleted successfully.
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\Software\Microsoft\Windows\CurrentVersion\Run\\IncrediMail => value deleted successfully.

"C:\windows\system32\GroupPolicy\Machine" directory move:

Could not move "C:\windows\system32\GroupPolicy\Machine\Registry.pol" => Scheduled to move on reboot.
Could not move "C:\windows\system32\GroupPolicy\Machine" directory. => Scheduled to move on reboot.

Could not move "C:\windows\system32\GroupPolicy\GPT.ini" => Scheduled to move on reboot.

Och menno ...

so sieht der Scan von mbam jetzt aus ... unverändert.

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 20.06.2014
Suchlauf-Zeit: 23:26:27
Logdatei: mbam.txt
Administrator: Nein

Version: 2.00.2.1012
Malware Datenbank: v2014.06.20.12
Rootkit Datenbank: v2014.06.19.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Angelique

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 210617
Verstrichene Zeit: 8 Min, 22 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 14
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4B62762D-AA67-4312-A5BF-91BCB7A4720A}, Löschen bei Neustart, [863690ea493275c14ff43d3fb151a55b], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\TypeLib\{105F25A9-C42F-48A6-998D-0494E8AE336A}, In Quarantäne, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{506DD7C6-B05D-43CE-81FF-AA05E11DBDFD}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6D3C9858-2674-46E1-9112-107340758481}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{79C9FA6C-352A-49BA-89BA-85077BC35DC3}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{909112FE-C4A2-4990-A499-E58867D55B15}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{9BEEB5A2-8B02-465A-904D-FE5A447F59EB}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B618C19D-A418-4586-80C6-09DBDA9C748E}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B68B00A0-95B9-4162-BA45-7A1113317DA9}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{BFE45A8B-650C-4E99-A3F4-CC6A2874893B}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E413D78F-283C-45F1-9992-8EF7D55A4933}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E7C2FDF1-1635-41B4-8207-C1684B6807D7}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F9F5A267-FA5A-4CA3-8BE5-4C1EEAD01011}, Löschen bei Neustart, [902ca7d3eb90ec4a0c37235946bca957], 
PUP.Optional.PlusHD.A, HKLM\SOFTWARE\PSHD-9.9, Löschen bei Neustart, [94282a50b3c83ef8b9562f826b97ac54], 

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 1
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 

Dateien: 7
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\1293297481.mxaddon, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\360-52916.crx, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\52916.crx, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\52916.xpi, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\background.html, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\bgNova.html, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 
PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\PSHD-9.9.ico, Löschen bei Neustart, [8a321f5ba3d8d4625a8b9704867c11ef], 

Physische Sektoren: 0
(No malicious items detected)


(end)

schrauber · 21.06.2014, 21:04

POste mal bitte ein frisches FRST log. Bist du Admin?

Katty · 22.06.2014, 20:16

Guten Abend

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-06-2014 01
Ran by Angelique (ATTENTION: The logged in user is not administrator) on ANGELIQUE-PC on 22-06-2014 21:05:31
Running from C:\Users\Angelique\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Opera Software) C:\Program Files\Opera\opera.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {32a285c4-0323-11e1-9b96-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba709-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba72a-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba786-fd98-11e0-bd08-001e101faa49} - F:\AutoRun.exe
HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk
ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
SearchScopes: HKCU - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de
SearchScopes: HKCU - {913EFC05-49A2-46C4-8CF1-7B5C8AB004D2} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {9F269F2D-4B93-4149-AAD9-88148B946E08} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_fs
SearchScopes: HKCU - {EAF954B9-B349-4A20-BFB1-674445DE695B} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {F1386E8E-9EBB-4FE8-B14A-B55DF1F18DD0} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F4428DA7-6596-44EC-8987-7FA604AB46DD} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{029509DA-91DB-45AF-9F70-4D08C7407C19}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{516F3F00-D2D0-4057-AF58-1EB4A6F30C9B}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Angelique\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03]
FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]
FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi
FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Google Docs) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-02]
CHR Extension: (Google Drive) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-02]
CHR Extension: (YouTube) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-02]
CHR Extension: (Google Cast) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-05-12]
CHR Extension: (Google Search) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-02]
CHR Extension: (Google Wallet) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Gmail) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-02]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-18] (SurfRight B.V.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 lmhosts; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NlaSvc; C:\windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek )
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation)
S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed]
R3 PSI; C:\windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X]
S3 XDva389; \??\C:\windows\system32\XDva389.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-22 21:05 - 2014-06-22 21:06 - 00020773 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-22 21:05 - 2014-06-22 21:05 - 00000000 ____D () C:\FRST
2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\InstallMate
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Program Files\BillP Studios
2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe
2014-06-20 23:28 - 2014-06-20 23:29 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-20 23:27 - 2014-06-20 23:28 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe
2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi
2014-06-20 23:03 - 2014-06-20 23:12 - 00000794 _____ () C:\windows\SecuniaPackage.log
2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia
2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe
2014-06-20 22:35 - 2014-06-20 22:36 - 00000988 _____ () C:\DelFix.txt
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:29 - 2014-06-20 22:35 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:22 - 2014-06-22 15:12 - 00002082 _____ () C:\windows\PFRO.log
2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-18 16:26 - 2014-06-18 16:29 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-15 11:20 - 2014-06-22 19:12 - 00000952 _____ () C:\windows\setupact.log
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe

==================== One Month Modified Files and Folders =======

2014-06-22 21:06 - 2014-06-22 21:05 - 00020773 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-22 21:05 - 2014-06-22 21:05 - 00000000 ____D () C:\FRST
2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-22 20:52 - 2012-04-02 08:16 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-22 20:13 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-22 19:20 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-22 19:20 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-22 19:19 - 2010-03-05 06:29 - 01520489 _____ () C:\windows\WindowsUpdate.log
2014-06-22 19:14 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM
2014-06-22 19:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job
2014-06-22 19:13 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox
2014-06-22 19:13 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster
2014-06-22 19:13 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox
2014-06-22 19:13 - 2014-05-17 08:18 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-22 19:13 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-22 19:12 - 2014-06-15 11:20 - 00000952 _____ () C:\windows\setupact.log
2014-06-22 19:12 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-22 15:12 - 2014-06-18 18:22 - 00002082 _____ () C:\windows\PFRO.log
2014-06-21 11:38 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-21 07:17 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job
2014-06-20 23:54 - 2010-03-05 06:31 - 00000000 ____D () C:\ProgramData\Temp
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\InstallMate
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Program Files\BillP Studios
2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod
2014-06-20 23:47 - 2011-02-25 19:59 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe
2014-06-20 23:29 - 2014-06-20 23:28 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-20 23:28 - 2014-06-20 23:27 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-20 23:14 - 2011-01-04 11:24 - 00000000 ____D () C:\Program Files\Java
2014-06-20 23:12 - 2014-06-20 23:03 - 00000794 _____ () C:\windows\SecuniaPackage.log
2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe
2014-06-20 23:11 - 2013-11-18 08:30 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-06-20 23:10 - 2011-02-25 19:59 - 00000000 ____D () C:\ProgramData\Apple
2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi
2014-06-20 23:03 - 2012-04-02 08:16 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2014-06-20 23:03 - 2011-08-15 19:31 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia
2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe
2014-06-20 22:36 - 2014-06-20 22:35 - 00000988 _____ () C:\DelFix.txt
2014-06-20 22:35 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-20 22:32 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:19 - 2013-11-18 10:24 - 00000000 ____D () C:\windows\Minidump
2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera
2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 19:21 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM
2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja
2014-06-18 18:53 - 2014-05-13 08:19 - 00000000 ____D () C:\Program Files\PSHD-9.9
2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk
2014-06-18 16:29 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini
2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique
2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp
2014-06-17 19:23 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin
2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-17 10:13 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin
2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-06-03 12:26 - 2012-11-30 22:59 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
2014-05-23 06:37 - 2014-05-17 09:01 - 00001033 _____ () C:\Users\Angelique\Desktop\Dropbox.lnk
2014-05-23 06:37 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\Angelique\AppData\Local\Temp\avgnt.exe
C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphckqov.dll


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-06-2014 01
Ran by Angelique at 2014-06-22 21:06:55
Running from C:\Users\Angelique\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe AIR (Version: 14.0.0.110 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\{1F5E5F2E-5E61-431D-B796-58CCC6B68E28}) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AIO_CDB_ProductContext (Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_CDB_Software (Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_Scan (Version: 130.0.421.000 - Hewlett-Packard) Hidden
Alice Greenfingers (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Amazon Music Importer (HKLM\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC)
Amazon Music Importer (Version: 2.1.0 - Amazon Services LLC) Hidden
Apple Application Support (HKLM\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{10E3A6DD-84D8-4D8A-BB11-5E5314BCA7FD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft ShowBiz (HKLM\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version:  - ArcSoft)
Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.2.1119 - Atheros)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
AVS Update Manager 1.0 (HKLM\...\AVS Update Manager_is1) (Version:  - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (HKLM\...\AVS4YOU Software Navigator_is1) (Version:  - Online Media Technologies Ltd.)
BatteryLifeExtender (HKLM\...\{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}) (Version: 1.0.1 - Samsung)
Biet-O-Matic v2.14.12 (HKLM\...\Biet-O-Matic v2.14.12) (Version: 2.14.12 - BOM Development Team)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
ChargeableUSB (HKLM\...\{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}) (Version: 1.0.0.0 - SAMSUNG)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant Polaris Unused CIR Function (HKLM\...\Uninstaller52bc73a10) (Version: 1.0.0.0 - Conexant Systems)
Copy (Version: 130.0.428.000 - Hewlett-Packard) Hidden
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.)
CyberLink DVD Suite (Version: 6.0.2806 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink LabelPrint (Version: 2.5.1916 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108a - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.3108a - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3213 - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.3213 - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815b - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2815b - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1812 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.0.1.1812 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3625 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.3625 - CyberLink Corp.) Hidden
Dairy Dash (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden
Die Sims™ 3 (HKLM\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.57.62 - Electronic Arts)
DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{34B76DCB-BF7C-440F-B058-C84172C1E338}) (Version: 4.2.8 - Samsung)
EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.3 - Samsung)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.0.13587 - Landesfinanzdirektion Thüringen)
eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
F300 (Version: 130.0.365.000 - Hewlett-Packard) Hidden
F300_Help (Version: 82.0.242.000 - Hewlett-Packard) Hidden
F300Trb (Version: 82.0.242.000 - Hewlett-Packard) Hidden
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Farm Frenzy 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
Fax (Version: 130.0.418.000 - Hewlett-Packard) Hidden
Game Pack (HKLM\...\{63eafc52-b963-4297-a7eb-d412944e7065}_is1) (Version: 5.3.0.10 - Oberon Media, Inc.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
GMX Desktop Icons (HKLM\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)
GMX MailCheck für Internet Explorer (HKLM\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.4.0.0 - 1&1 Mail & Media GmbH)
GMX Softwareaktualisierung (HKLM\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH)
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google SketchUp 8 (HKLM\...\{15F02176-0D12-4FAF-B2CD-2767C7781427}) (Version: 3.0.4993 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.216 - SurfRight B.V.)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (HKLM\...\{B61ED343-0B14-4241-999C-490CB1A20DA4}) (Version: 13.0 - HP)
HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.001 - Hewlett-Packard)
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
IcoFX 1.6.4 (HKLM\...\IcoFX_is1) (Version:  - )
IncrediMail (Version: 6.3.9.5248 - IncrediMail) Hidden
IncrediMail 2.0 (HKLM\...\IncrediMail) (Version: 6.3.9.5248 - IncrediMail Ltd.)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.3.1001 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1003 - Intel Corporation)
iTunes (HKLM\...\{616445AF-BBCF-41C1-A4D6-8CFF171C182D}) (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mobile Partner (HKLM\...\Mobile Partner) (Version: 16.002.03.01.40 - Huawei Technologies Co.,Ltd)
MobileMe Control Panel (HKLM\...\{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}) (Version: 3.1.8.0 - Apple Inc.)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Network (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Nur Deinstallierung der CopyTrans Suite möglich. (HKCU\...\CopyTrans Suite) (Version: 2.27 - WindSolutions)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Opera 12.17 (HKLM\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
Origin (HKLM\...\Origin) (Version: 9.3.2.2730 - Electronic Arts, Inc.)
Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.3.5.6 - Pando Networks Inc.)
phase-6 2.3.3 (HKLM\...\phase-6) (Version: 2.3.3 - phase-6)
PhotoScape (HKLM\...\PhotoScape) (Version:  - )
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6003 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Software (HKLM\...\{F2BC3383-F000-410C-A038-3846ADBE8D90}) (Version: 1.01.0088 - REALTEK Semiconductor Corp.)
Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung)
Samsung R-Series (HKLM\...\{3EED7541-55F8-4DC6-B9CD-28762D71310E}) (Version: 1.0 - Samsung)
Samsung Support Center (HKLM\...\{0A353130-D22C-41DD-8C67-1B02A05F2CE0}) (Version: 1.1.0 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
Secunia PSI (3.0.0.9016) (HKLM\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
SpywareBlaster 5.0 (HKLM\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.10.0 - Synaptics Incorporated)
System Requirements Lab (HKLM\...\SystemRequirementsLab) (Version:  - )
TeamViewer 7 (HKLM\...\TeamViewer 7) (Version: 7.0.15723 - TeamViewer)
Tinypic 3.18 (HKLM\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
TippKönigin 5.5 (HKLM\...\TippKönigin_is1) (Version:  - Giletech e.K.)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden
TrueCrypt (HKLM\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
TuneAid 3.76 (HKLM\...\TuneAid_is1) (Version: 3.76 - DigiDNA)
UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden
USB PnP Sound Device (HKLM\...\C-Media CM108 Like Sound Driver) (Version:  - )
USB PnP Sound Device (HKLM\...\Generic USB 108 Sound) (Version:  - )
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
Video Grabber (HKLM\...\Uninstaller52bc73a00) (Version: 1.0.0.0 - Conexant Systems)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinPatrol (HKLM\...\{84481A87-2316-4923-8FAB-3BA8CA29323D}) (Version: 31.0.2014.0 - BillP Studios)
WinZip 14.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}) (Version: 14.5.9095 - WinZip Computing, S.L. )

==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => ?

==================== Loaded Modules (whitelisted) =============

2010-03-05 06:38 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2009-06-03 13:59 - 2009-06-03 13:59 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-06-03 13:59 - 2009-06-03 13:59 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-06-22 19:13 - 2014-06-22 19:13 - 00043008 _____ () C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphckqov.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Angelique\AppData\Roaming\Dropbox\bin\libcef.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00835584 _____ () C:\Program Files\Opera\gstreamer\gstreamer.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00093696 _____ () C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00094208 _____ () C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00057344 _____ () C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00096256 _____ () C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00062976 _____ () C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00067072 _____ () C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00158208 _____ () C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00312832 _____ () C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00038912 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00073728 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll
2012-11-30 22:48 - 2014-04-25 07:34 - 00101888 _____ () C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
AlternateDataStreams: C:\ProgramData\Temp:A42A9F39
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Angelique^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk => C:\windows\pss\OpenOffice.org 3.2.lnk.Startup
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: IncrediMail => C:\Program Files\IncrediMail\bin\IncMail.exe /c
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: PDVD8LanguageShortcut => "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RemoteControl8 => "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/22/2014 03:58:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/22/2014 03:58:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/22/2014 03:55:24 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/22/2014 03:54:06 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/21/2014 03:03:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/21/2014 03:03:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/21/2014 02:58:35 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/21/2014 02:57:01 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/20/2014 11:44:32 PM) (Source: MsiInstaller) (EventID: 1002) (User: NT-AUTORITÄT)
Description: Nicht erwarteter oder fehlender Wert (Name: "PackageName", Wert: "") für Schlüssel "HKLM\Software\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547\SourceList".

Error: (06/20/2014 11:44:20 PM) (Source: MsiInstaller) (EventID: 1002) (User: NT-AUTORITÄT)
Description: Nicht erwarteter oder fehlender Wert (Name: "PackageName", Wert: "") für Schlüssel "HKLM\Software\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547\SourceList".


System errors:
=============
Error: (06/20/2014 10:36:00 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy7" den Befehl "chkdsk" aus.

Error: (06/20/2014 10:35:58 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy3" den Befehl "chkdsk" aus.

Error: (06/20/2014 10:35:55 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy2" den Befehl "chkdsk" aus.

Error: (06/20/2014 10:35:53 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy1" den Befehl "chkdsk" aus.

Error: (06/20/2014 10:35:49 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy7" den Befehl "chkdsk" aus.

Error: (06/20/2014 10:26:40 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/20/2014 03:11:01 AM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy7" den Befehl "chkdsk" aus.

Error: (06/19/2014 06:15:08 PM) (Source: Ntfs) (EventID: 55) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy7" den Befehl "chkdsk" aus.


Microsoft Office Sessions:
=========================
Error: (06/22/2014 03:58:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Samsung\chargeableusb\vista_xp_driver\x64\KStartMem.exe.Manifest

Error: (06/22/2014 03:58:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Samsung\chargeableusb\ChargeableUSB_64.exe

Error: (06/22/2014 03:55:24 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\Samsung\BatteryLifeExtender\Drv\SABI2x64\KStartMem.exe.Manifest

Error: (06/22/2014 03:54:06 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\Samsung\Samsung Support Center\Drv\drv2x64\KStartMem.exe.Manifest

Error: (06/21/2014 03:03:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Samsung\chargeableusb\vista_xp_driver\x64\KStartMem.exe.Manifest

Error: (06/21/2014 03:03:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Samsung\chargeableusb\ChargeableUSB_64.exe

Error: (06/21/2014 02:58:35 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\Samsung\BatteryLifeExtender\Drv\SABI2x64\KStartMem.exe.Manifest

Error: (06/21/2014 02:57:01 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Program Files\Samsung\Samsung Support Center\Drv\drv2x64\KStartMem.exe.Manifest

Error: (06/20/2014 11:44:32 PM) (Source: MsiInstaller) (EventID: 1002) (User: NT-AUTORITÄT)
Description: PackageNameHKLM\Software\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547\SourceList(NULL)(NULL)(NULL)

Error: (06/20/2014 11:44:20 PM) (Source: MsiInstaller) (EventID: 1002) (User: NT-AUTORITÄT)
Description: PackageNameHKLM\Software\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547\SourceList(NULL)(NULL)(NULL)


==================== Memory info =========================== 

Percentage of memory in use: 37%
Total physical RAM: 3565.61 MB
Available physical RAM: 2232.2 MB
Total Pagefile: 7129.52 MB
Available Pagefile: 5617.86 MB
Total Virtual: 2047.88 MB
Available Virtual: 1887.54 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:141.49 GB) (Free:86.39 GB) NTFS
Drive d: (Volume) (Fixed) (Total:141.5 GB) (Free:41.89 GB) NTFS

==================== MBR & Partition Table ==================

==================== End Of Log ============================

Admin? ... ähm .. ja, ich glaub schon.
Zumindest öffnet sich ein Fenster bei Programmen, die Admin-Rechte erfordern, und ich muss das Admin-Passwort eingeben, damit diese Programme funktionieren.

schrauber · 23.06.2014, 18:37

Zitat:

Ran by Angelique (ATTENTION: The logged in user is not administrator) on ANGELIQUE-PC on 22-06-2014 21:05:31

Logge dich bitte als Admin ein und scanne nochma.

Katty · 23.06.2014, 19:27

Hallihallo

kurze Zwischennachricht:
Beim Einloggen als Admin (ich bin dort nur äußerst selten eingeloggt) meckert Avira gleich erstmal rum und meldet den Fund / in Quarantäne verschoben:
TR/Drop.Softomat.AN
Quelle: bundleSetup.exe

Außerdem neu entdeckt im IE Add-on iminent - jetzt deaktiviert.

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:22-06-2014
Ran by Armin (administrator) on ANGELIQUE-PC on 23-06-2014 20:20:17
Running from C:\Users\Armin\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
() C:\Windows\System32\Rezip.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Opera Software) C:\Program Files\Opera\opera.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1003\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3549528 2013-09-08] (Electronic Arts)
HKU\S-1-5-21-2339853823-2107313754-116825072-1003\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [1128000 2014-06-03] (BillP Studios)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk
ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Armin\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/br/ie11_startpage
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - {0149E807-B987-4E2D-BD54-EDC158FCC679} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
SearchScopes: HKCU - {267EF3C0-6969-4EBB-925C-C129CFC7431B} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {4C7D8CE6-99D1-42C5-A5DC-F15028CF0CE4} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE386
SearchScopes: HKCU - {A82DC977-0F54-4431-88CB-77F900DAD944} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D90868E5-DB4F-41F1-8491-E8922913A21A} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {F3A90CB4-A8AF-447D-9F47-4E22DB5C8DC8} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{029509DA-91DB-45AF-9F70-4D08C7407C19}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{516F3F00-D2D0-4057-AF58-1EB4A6F30C9B}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03]
FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]
FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi
FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com"
CHR Extension: (Google Docs) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13]
CHR Extension: (Google Drive) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-13]
CHR Extension: (YouTube) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13]
CHR Extension: (Google-Suche) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13]
CHR Extension: (Google Wallet) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13]
CHR Extension: (Google Mail) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-13]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-23] (SurfRight B.V.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek )
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation)
S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed]
R3 PSI; C:\windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X]
S3 XDva389; \??\C:\windows\system32\XDva389.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-23 20:20 - 2014-06-23 20:20 - 00019533 _____ () C:\Users\Armin\Desktop\FRST.txt
2014-06-23 20:09 - 2014-06-23 20:09 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe
2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe
2014-06-22 21:06 - 2014-06-22 21:07 - 00033808 _____ () C:\Users\Angelique\Desktop\Addition.txt
2014-06-22 21:05 - 2014-06-23 20:20 - 00000000 ____D () C:\FRST
2014-06-22 21:05 - 2014-06-22 21:07 - 00045626 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\InstallMate
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Program Files\BillP Studios
2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe
2014-06-20 23:28 - 2014-06-20 23:29 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-20 23:27 - 2014-06-20 23:28 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe
2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi
2014-06-20 23:03 - 2014-06-20 23:12 - 00000794 _____ () C:\windows\SecuniaPackage.log
2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI
2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia
2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe
2014-06-20 22:35 - 2014-06-20 22:36 - 00000988 _____ () C:\DelFix.txt
2014-06-18 20:38 - 2014-06-18 20:55 - 00003696 _____ () C:\Users\Armin\Desktop\Gmer.log
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp
2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:29 - 2014-06-20 22:35 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:22 - 2014-06-22 15:12 - 00002082 _____ () C:\windows\PFRO.log
2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-18 16:26 - 2014-06-18 16:29 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker
2014-06-15 11:20 - 2014-06-22 19:12 - 00000952 _____ () C:\windows\setupact.log
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe

==================== One Month Modified Files and Folders =======

2014-06-23 20:20 - 2014-06-23 20:20 - 00019533 _____ () C:\Users\Armin\Desktop\FRST.txt
2014-06-23 20:20 - 2014-06-22 21:05 - 00000000 ____D () C:\FRST
2014-06-23 20:13 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-23 20:09 - 2014-06-23 20:09 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe
2014-06-23 20:07 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin
2014-06-23 20:02 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox
2014-06-23 20:02 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM
2014-06-23 20:02 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-23 19:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job
2014-06-23 10:08 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-23 10:08 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-23 10:04 - 2010-03-05 06:29 - 01533952 _____ () C:\windows\WindowsUpdate.log
2014-06-23 06:51 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job
2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe
2014-06-22 22:00 - 2013-05-29 07:29 - 00000000 ____D () C:\Program Files\Adobe
2014-06-22 21:43 - 2010-06-29 20:57 - 00000000 ____D () C:\Users\Angelique\AppData\Local\Google
2014-06-22 21:07 - 2014-06-22 21:06 - 00033808 _____ () C:\Users\Angelique\Desktop\Addition.txt
2014-06-22 21:07 - 2014-06-22 21:05 - 00045626 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-22 19:14 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM
2014-06-22 19:13 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster
2014-06-22 19:13 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox
2014-06-22 19:13 - 2014-05-17 08:18 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-22 19:12 - 2014-06-15 11:20 - 00000952 _____ () C:\windows\setupact.log
2014-06-22 19:12 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-22 15:12 - 2014-06-18 18:22 - 00002082 _____ () C:\windows\PFRO.log
2014-06-21 11:38 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-20 23:54 - 2010-03-05 06:31 - 00000000 ____D () C:\ProgramData\Temp
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\InstallMate
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Program Files\BillP Studios
2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod
2014-06-20 23:47 - 2011-02-25 19:59 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe
2014-06-20 23:29 - 2014-06-20 23:28 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-20 23:28 - 2014-06-20 23:27 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-20 23:14 - 2011-01-04 11:24 - 00000000 ____D () C:\Program Files\Java
2014-06-20 23:12 - 2014-06-20 23:03 - 00000794 _____ () C:\windows\SecuniaPackage.log
2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe
2014-06-20 23:10 - 2011-02-25 19:59 - 00000000 ____D () C:\ProgramData\Apple
2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi
2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI
2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia
2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe
2014-06-20 22:36 - 2014-06-20 22:35 - 00000988 _____ () C:\DelFix.txt
2014-06-20 22:35 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-20 22:32 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin
2014-06-18 20:55 - 2014-06-18 20:38 - 00003696 _____ () C:\Users\Armin\Desktop\Gmer.log
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp
2014-06-18 20:19 - 2013-11-18 10:24 - 00000000 ____D () C:\windows\Minidump
2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera
2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja
2014-06-18 18:53 - 2014-05-13 08:19 - 00000000 ____D () C:\Program Files\PSHD-9.9
2014-06-18 18:21 - 2012-12-04 10:52 - 00001162 _____ () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk
2014-06-18 16:29 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini
2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique
2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp
2014-06-17 19:23 - 2012-12-15 10:10 - 00000000 ____D () C:\Users\Armin\AppData\Local\Google
2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin
2014-06-17 10:13 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin
2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-06-03 12:26 - 2012-11-30 22:59 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe

Some content of TEMP:
====================
C:\Users\Angelique\AppData\Local\Temp\avgnt.exe
C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphckqov.dll
C:\Users\Armin\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 13:18

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 24.06.2014, 13:02

AdwCleaner bitte im Admin Account laufen lassen, dann frisches FRST log, alles im Admin Account.

Katty · 25.06.2014, 06:16

Guten Morgen

Code:

ATTFilter

# AdwCleaner v3.213 - Bericht erstellt am 25/06/2014 um 07:03:58
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Armin - ANGELIQUE-PC
# Gestartet von : C:\Users\Armin\Desktop\adwcleaner_3.213.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files\PSHD-9.9
Ordner Gelöscht : C:\Users\Angelique\AppData\Roaming\Gutscheinmieze

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\BillP Studios
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PSHD-9.9
Schlüssel Gelöscht : HKLM\Software\BillP Studios
Schlüssel Gelöscht : HKLM\Software\PSHD-9.9
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{84481A87-2316-4923-8FAB-3BA8CA29323D}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126


-\\ Google Chrome v35.0.1916.153

[ Datei : C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ Datei : C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1344 octets] - [25/06/2014 07:00:51]
AdwCleaner[S0].txt - [1265 octets] - [25/06/2014 07:03:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1325 octets] ##########

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:22-06-2014
Ran by Armin (administrator) on ANGELIQUE-PC on 25-06-2014 07:13:39
Running from C:\Users\Armin\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
() C:\Windows\System32\Rezip.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
() C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Opera Software) C:\Program Files\Opera\opera.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)
HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKU\S-1-5-21-2339853823-2107313754-116825072-1003\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3595608 2014-06-23] (Electronic Arts)
HKU\S-1-5-21-2339853823-2107313754-116825072-1003\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [1128000 2014-06-03] (BillP Studios)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk
ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Armin\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/br/ie11_startpage
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - {0149E807-B987-4E2D-BD54-EDC158FCC679} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
SearchScopes: HKCU - {267EF3C0-6969-4EBB-925C-C129CFC7431B} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {4C7D8CE6-99D1-42C5-A5DC-F15028CF0CE4} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE386
SearchScopes: HKCU - {A82DC977-0F54-4431-88CB-77F900DAD944} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D90868E5-DB4F-41F1-8491-E8922913A21A} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8
SearchScopes: HKCU - {F3A90CB4-A8AF-447D-9F47-4E22DB5C8DC8} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03]
FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]
FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi
FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com"
CHR Extension: (Google Docs) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13]
CHR Extension: (Google Drive) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-13]
CHR Extension: (YouTube) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13]
CHR Extension: (Google-Suche) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13]
CHR Extension: (Google Wallet) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13]
CHR Extension: (Google Mail) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-13]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-23] (SurfRight B.V.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [97648 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek )
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation)
S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed]
R3 PSI; C:\windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc)
R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)
R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)
S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 XDva389; \??\C:\windows\system32\XDva389.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-25 07:13 - 2014-06-25 07:13 - 00019469 _____ () C:\Users\Armin\Desktop\FRST.txt
2014-06-25 07:00 - 2014-06-25 07:04 - 00000000 ____D () C:\AdwCleaner
2014-06-25 06:59 - 2014-06-25 06:59 - 01342659 _____ () C:\Users\Armin\Desktop\adwcleaner_3.213.exe
2014-06-23 20:48 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\OpenOffice
2014-06-23 20:09 - 2014-06-25 07:13 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe
2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe
2014-06-22 21:06 - 2014-06-22 21:07 - 00033808 _____ () C:\Users\Angelique\Desktop\Addition.txt
2014-06-22 21:05 - 2014-06-25 07:13 - 00000000 ____D () C:\FRST
2014-06-22 21:05 - 2014-06-22 21:07 - 00045626 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\InstallMate
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Program Files\BillP Studios
2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe
2014-06-20 23:28 - 2014-06-20 23:29 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-20 23:27 - 2014-06-20 23:28 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe
2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi
2014-06-20 23:03 - 2014-06-20 23:12 - 00000794 _____ () C:\windows\SecuniaPackage.log
2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI
2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia
2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe
2014-06-20 22:35 - 2014-06-20 22:36 - 00000988 _____ () C:\DelFix.txt
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp
2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:29 - 2014-06-20 22:35 - 00000000 ____D () C:\windows\ERUNT
2014-06-18 18:22 - 2014-06-25 07:04 - 00003326 _____ () C:\windows\PFRO.log
2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll
2014-06-18 16:26 - 2014-06-18 16:29 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-17 10:13 - 2014-06-25 06:54 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker
2014-06-15 11:20 - 2014-06-25 07:05 - 00001064 _____ () C:\windows\setupact.log
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe

==================== One Month Modified Files and Folders =======

2014-06-25 07:14 - 2014-06-25 07:13 - 00019469 _____ () C:\Users\Armin\Desktop\FRST.txt
2014-06-25 07:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job
2014-06-25 07:13 - 2014-06-23 20:09 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe
2014-06-25 07:13 - 2014-06-22 21:05 - 00000000 ____D () C:\FRST
2014-06-25 07:13 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin
2014-06-25 07:13 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-25 07:09 - 2010-03-05 06:29 - 01578132 _____ () C:\windows\WindowsUpdate.log
2014-06-25 07:05 - 2014-06-15 11:20 - 00001064 _____ () C:\windows\setupact.log
2014-06-25 07:05 - 2014-05-17 08:18 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-25 07:05 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin
2014-06-25 07:05 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM
2014-06-25 07:05 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-25 07:05 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-25 07:04 - 2014-06-25 07:00 - 00000000 ____D () C:\AdwCleaner
2014-06-25 07:04 - 2014-06-18 18:22 - 00003326 _____ () C:\windows\PFRO.log
2014-06-25 06:59 - 2014-06-25 06:59 - 01342659 _____ () C:\Users\Armin\Desktop\adwcleaner_3.213.exe
2014-06-25 06:54 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin
2014-06-25 06:51 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox
2014-06-25 06:45 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job
2014-06-24 11:01 - 2012-11-30 22:59 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-06-24 05:03 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-24 05:03 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-24 04:57 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM
2014-06-24 04:56 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster
2014-06-24 04:56 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox
2014-06-23 20:59 - 2011-10-23 19:03 - 00000000 ____D () C:\Program Files\Mobile Partner
2014-06-23 20:57 - 2012-12-18 23:58 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Google
2014-06-23 20:48 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\OpenOffice
2014-06-23 20:25 - 2012-12-15 10:10 - 00000000 ____D () C:\Users\Armin\AppData\Local\Google
2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe
2014-06-22 22:00 - 2013-05-29 07:29 - 00000000 ____D () C:\Program Files\Adobe
2014-06-22 21:43 - 2010-06-29 20:57 - 00000000 ____D () C:\Users\Angelique\AppData\Local\Google
2014-06-22 21:07 - 2014-06-22 21:06 - 00033808 _____ () C:\Users\Angelique\Desktop\Addition.txt
2014-06-22 21:07 - 2014-06-22 21:05 - 00045626 _____ () C:\Users\Angelique\Desktop\FRST.txt
2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe
2014-06-21 11:38 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-20 23:54 - 2010-03-05 06:31 - 00000000 ____D () C:\ProgramData\Temp
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\ProgramData\InstallMate
2014-06-20 23:48 - 2014-06-20 23:48 - 00000000 ____D () C:\Program Files\BillP Studios
2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes
2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod
2014-06-20 23:47 - 2011-02-25 19:59 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe
2014-06-20 23:29 - 2014-06-20 23:28 - 00000000 ____D () C:\Program Files\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses
2014-06-20 23:28 - 2014-06-20 23:27 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-20 23:14 - 2011-01-04 11:24 - 00000000 ____D () C:\Program Files\Java
2014-06-20 23:12 - 2014-06-20 23:03 - 00000794 _____ () C:\windows\SecuniaPackage.log
2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe
2014-06-20 23:10 - 2011-02-25 19:59 - 00000000 ____D () C:\ProgramData\Apple
2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi
2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI
2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia
2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe
2014-06-20 22:36 - 2014-06-20 22:35 - 00000988 _____ () C:\DelFix.txt
2014-06-20 22:35 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT
2014-06-20 22:32 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin
2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP
2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp
2014-06-18 20:19 - 2013-11-18 10:24 - 00000000 ____D () C:\windows\Minidump
2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera
2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung
2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic
2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro
2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja
2014-06-18 18:21 - 2012-12-04 10:52 - 00001162 _____ () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk
2014-06-18 16:29 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini
2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique
2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp
2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin
2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList
2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker
2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository
2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD
2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache
2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe
2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner
2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT
2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt
2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe

Some content of TEMP:
====================
C:\Users\Angelique\AppData\Local\Temp\avgnt.exe
C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvmvvhs.dll
C:\Users\Armin\AppData\Local\Temp\avgnt.exe
C:\Users\Armin\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 13:18

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 25.06.2014, 18:22

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Noch Probleme?

Katty · 25.06.2014, 22:15

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:22-06-2014
Ran by Armin at 2014-06-25 22:51:18 Run:1
Running from C:\Users\Armin\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
         
*****************

C:\windows\system32\GroupPolicy\Machine => Moved successfully.
C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.


The system needed a reboot. 

==== End of Fixlog ====

Ich selbst bemerke keine Probleme mehr.

mbam findet von Tag zu Tag mehr und das, obwohl der Rechner kaum genutzt wird seitdem ich um Hilfe gerufen habe ... also Kids haben Verbot und die Großen nutzen den Rechner nur für das Nötigste.

Hier kommt der aktuelle mbam-Scan vom heutigen Abend.
Muss ich mir Sorgen machen?

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 25.06.2014
Suchlauf-Zeit: 22:59:00
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.25.18
Rootkit Datenbank: v2014.06.23.02
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: Armin

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 355987
Verstrichene Zeit: 11 Min, 48 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 40
PUP.Optional.FaceMoods.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0D7562AE-8EF6-416d-A838-AB665251703A}, , [199d413bc8b3e74f1e89e167837f21df], 
PUP.Optional.SearchGolTB.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{00078E95-3A4A-4137-8DE7-2824908D1C17}, , [4b6b08748fec42f48ee6bec2897923dd], 
PUP.Optional.SearchGolTB.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{00078E95-3A4A-4137-8DE7-2824908D1C17}, , [4b6b08748fec42f48ee6bec2897923dd], 
PUP.Optional.FaceMoods.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{64182481-4F71-486B-A045-B233BD0DA8FC}, , [ffb7afcdaccf38fed3d20c3ce61ca858], 
PUP.Optional.FaceMoods.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{64182481-4F71-486B-A045-B233BD0DA8FC}, , [ffb7afcdaccf38fed3d20c3ce61ca858], 
PUP.Optional.SearchGolTB.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{8F547BDD-FCD4-48F8-A06F-573D6F404A3C}, , [23930577e99290a65a1b017fe121f709], 
PUP.Optional.SearchGolTB.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{8F547BDD-FCD4-48F8-A06F-573D6F404A3C}, , [23930577e99290a65a1b017fe121f709], 
PUP.Optional.FaceMoods.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}, , [8e28e597295247ef6b3b3117758d7888], 
PUP.Optional.FaceMoods.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}, , [8e28e597295247ef6b3b3117758d7888], 
PUP.Optional.BonanzaDeals.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FE063412-BEA4-4D76-8ED3-183BE6220D17}, , [3d79522aa4d7d561732b245c649eb54b], 
PUP.Optional.BonanzaDeals.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FE063412-BEA4-4D76-8ED3-183BE6220D17}, , [3d79522aa4d7d561732b245c649eb54b], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4B62762D-AA67-4312-A5BF-91BCB7A4720A}, , [4a6cee8ee09b5cdaaec8d4acdc26d62a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\TypeLib\{105F25A9-C42F-48A6-998D-0494E8AE336A}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{506DD7C6-B05D-43CE-81FF-AA05E11DBDFD}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6D3C9858-2674-46E1-9112-107340758481}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{79C9FA6C-352A-49BA-89BA-85077BC35DC3}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{909112FE-C4A2-4990-A499-E58867D55B15}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{9BEEB5A2-8B02-465A-904D-FE5A447F59EB}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B618C19D-A418-4586-80C6-09DBDA9C748E}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B68B00A0-95B9-4162-BA45-7A1113317DA9}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{BFE45A8B-650C-4E99-A3F4-CC6A2874893B}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E413D78F-283C-45F1-9992-8EF7D55A4933}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E7C2FDF1-1635-41B4-8207-C1684B6807D7}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F9F5A267-FA5A-4CA3-8BE5-4C1EEAD01011}, , [c3f3ec9035465fd7babcd4ac2bd7669a], 
PUP.Optional.PlusHD.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PSHD-9.9, , [07af6f0d3447e551920a6a4d22e07987], 
PUP.Optional.BonanzaDeals.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BonanzaDealsLive, , [932354285e1d7abc8e98b439956ebc44], 
PUP.Optional.FaceMoods.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\facemoods.com, , [7d399edeaccfa78f8e9de1e03cc64db3], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent, , [01b5601c15662d0908daf2ddf40eb34d], 
PUP.Optional.SearchGolTB.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\searchgol, , [d1e5eb910675a78fc67b03e97e850af6], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, , [cee884f8e497d75fe09a22d7669dbc44], 
PUP.Optional.PlusHD.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PSHD-9.9, , [a90d3f3dd4a7989e316b05b22bd70af6], 
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\19979, , [16a0d1ab710a62d4cc99428053af20e0], 
PUP.Optional.PlusHD.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\PlusVHD, , [5f57fb81750657dfc14ccff3a45e41bf], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\Iminent, , [e2d4acd0f8830135e23617a3808217e9], 
PUP.Optional.BProtector.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\BPROTECTSETTINGS, , [8234a6d65b200b2b4beb8068c142c33d], 
PUP.Optional.PCPerformer.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\PERFORMERSOFT\PC Performer, , [d9dd136976053ff7e51836afeb1828d8], 
PUP.Optional.Softonic.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [595d99e34e2d20164a565f5ed82af40c], 
PUP.Optional.RegCleanerPro.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\RegClean Pro, , [4d690f6d324994a28d2ce802867df30d], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\Iminent, , [496d6c1053285bdb33e50eac39c9857b], 
PUP.Optional.BonanzaDeals.A, HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BonanzaDealsLive, , [1d99e4989edd4beb7caaa04ddf2430d0], 

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
PUP.Optional.Iminent.A, C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl, , [7d39f587fe7ddc5af5804169917116ea], 

Physische Sektoren: 0
(No malicious items detected)


(end)

21.06.2014, 21:04	#8
schrauber /// the machine /// TB-Ausbilder	searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner POste mal bitte ein frisches FRST log. Bist du Admin? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

24.06.2014, 13:02	#12
schrauber /// the machine /// TB-Ausbilder	searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner AdwCleaner bitte im Admin Account laufen lassen, dann frisches FRST log, alles im Admin Account. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner

Log-Analyse und Auswertung: searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner