Windows Vista: System Speedup

Shnoxxer · 19.06.2014, 18:31

Hallo Trojaner-Board Community,
auf dem PC meiner Freundin ist vor drei Tagen "System Speedup" der gleichnamigen Firma aufgetaucht. Über die Herkunft sind wir uns nicht im Klaren.
Symptome:
Firefox ließ sich nicht starten(mit Fehlermeldung, leider keine genaueren Informationen).
Das Programm ließ sich nicht mehr deinstallieren (über Systemsteuerung), forderte zur Installation weiterer Programme bzw. deren Kauf auf und änderte nach mehrmaliger Ablehnung die Sprache auf Französisch.
Gekauft hat meine Freundin nichts, jedoch wurde trotz Ablehnung mehrmals "Free Software of the Day" installiert.
Meine Freundin hat bereits versucht, das Problem mit Malwarebytes Anti-Malware zu beseitigen, jedoch ohne Erfolg.
Alles, was ich bisher unternommen habe ist ein erneuter Scan mit Malwarebytes, wie erwartet ohne Erfolg.
Das Programm startet nach wie vor beim Windows-Start und verlangsamt den PC sehr, wenn erst einmal gestartet ist.
Vielen Dank im Voraus für die Unterstützung.

Gruß, Simon.

Es folgen nun die Logfiles:

defogger_disable.txt

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:28 on 19/06/2014 (Kristin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST.txt:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-06-2014
Ran by Kristin (administrator) on KRISTIN-PC on 19-06-2014 17:31:21
Running from C:\Users\Kristin\Downloads
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
( ) C:\Windows\System32\lxdxcoms.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
(Nullsoft, Inc.) C:\Program Files\Winamp\winampa.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmsdmon.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4452352 2007-05-02] (Realtek Semiconductor)
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [lxdxmon.exe] => C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe [672424 2010-02-04] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [WinampAgent] => C:\Program Files\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-06] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM\...\Run: [lxdxamon] => C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe [16040 2010-02-04] ()
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564528 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=21&locale=de_DE&gct=kwd&qsrc=2869
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\user.js
FF SearchPlugin: C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\searchplugins\safesearch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Rikaichan Japanese-German Dictionary File - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\rikaichan-jpde@polarcloud.com [2013-08-26]
FF Extension: Rikaichan - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2012-11-14]
FF Extension: Media Hint - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\mediahint@jetpack.xpi [2013-03-25]
FF Extension: Adblock Plus - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-22]
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-06-19]
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-18]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-18]

Chrome: 
=======
CHR HomePage: 
CHR StartupUrls: "hxxp://www.netflix.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Media Hint) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja [2013-11-10]
CHR Extension: (Google Docs) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-21]
CHR Extension: (Google Drive) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-21]
CHR Extension: (YouTube) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Adblock Plus) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-11]
CHR Extension: (Google-Suche) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (ZenMate) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2014-04-26]
CHR Extension: (AdBlock) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-06-15]
CHR Extension: (Norton Identity Safe for Google Chrome™) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-04-21]
CHR Extension: (Google Wallet) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-23]
CHR Extension: (Google Mail) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-21]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-25]

========================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2012-04-23] (Adobe Systems) [File not signed]
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-10-30] (Teruten) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxdx_device; C:\Windows\system32\lxdxcoms.exe [589824 2009-10-16] ( )
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-11] (Symantec Corporation)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-10-30] () [File not signed]
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140618.001\IDSvix86.sys [395992 2014-05-08] (Symantec Corporation)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140618.023\NAVENG.SYS [93272 2014-06-16] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140618.023\NAVEX15.SYS [1612376 2014-06-16] (Symantec Corporation)
S3 PID_0928; C:\Windows\System32\DRIVERS\LV561AV.SYS [495768 2009-04-30] (Logitech Inc.)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-18] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMTDIV.SYS [384728 2014-02-18] (Symantec Corporation)
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys [55232 2014-06-09] (StdLib)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
U2 wuaserv; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-19 17:31 - 2014-06-19 17:31 - 00019447 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:31 - 2014-06-19 17:31 - 00000000 ____D () C:\FRST
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-19 17:19 - 2014-06-19 17:19 - 00032744 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malware.txt
2014-06-19 16:47 - 2014-06-19 17:18 - 00002015 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malware.txt
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:05 - 2014-06-19 16:54 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:03 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 21:02 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-17 20:40 - 2014-06-09 12:15 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-16 23:37 - 2014-06-19 16:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-16 22:13 - 2014-06-17 21:04 - 00000892 _____ () C:\Users\Kristin\Desktop\Continue VuuPC Installation.lnk
2014-06-16 22:01 - 2014-06-19 16:26 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\VOPackage
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-16 22:01 - 2014-06-16 22:01 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-06-16 22:00 - 2014-06-16 23:12 - 00000284 _____ () C:\Windows\Tasks\System Speedup_UPDATES.job
2014-06-16 22:00 - 2014-06-16 23:12 - 00000276 _____ () C:\Windows\Tasks\System Speedup_DEFAULT.job
2014-06-16 21:59 - 2014-06-19 16:09 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\System Speedup
2014-06-16 21:59 - 2014-06-17 20:39 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\systweak
2014-06-16 21:59 - 2014-06-16 21:59 - 00000873 _____ () C:\Users\Public\Desktop\System Speedup.lnk
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Speedup
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\Program Files\System Speedup
2014-06-12 11:47 - 2014-06-12 11:48 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-12 10:18 - 2014-06-14 14:21 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 15:05 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 15:05 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 15:05 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 15:04 - 2014-05-28 18:48 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 15:04 - 2014-05-28 18:39 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 15:04 - 2014-05-28 18:38 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 15:04 - 2014-05-28 18:33 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 15:04 - 2014-05-28 18:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 15:04 - 2014-05-28 18:32 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 15:04 - 2014-05-28 18:30 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 15:04 - 2014-05-28 18:29 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-11 15:04 - 2014-05-28 18:29 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-11 15:04 - 2014-05-28 18:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 15:04 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe
2014-05-21 09:29 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

==================== One Month Modified Files and Folders =======

2014-06-19 17:31 - 2014-06-19 17:31 - 00019447 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:31 - 2014-06-19 17:31 - 00000000 ____D () C:\FRST
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:29 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-19 17:29 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:28 - 2012-04-19 14:37 - 00000000 ____D () C:\Users\Kristin
2014-06-19 17:24 - 2014-05-10 20:53 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-19 17:19 - 2014-06-19 17:19 - 00032744 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malware.txt
2014-06-19 17:18 - 2014-06-19 16:47 - 00002015 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malware.txt
2014-06-19 17:00 - 2006-11-02 14:52 - 01594648 _____ () C:\Windows\WindowsUpdate.log
2014-06-19 16:54 - 2014-06-17 21:05 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-19 16:54 - 2013-04-21 09:39 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-19 16:54 - 2012-04-20 10:36 - 00195936 _____ () C:\Windows\PFRO.log
2014-06-19 16:54 - 2012-04-19 16:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-06-19 16:54 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-19 16:52 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-19 16:44 - 2013-04-21 09:40 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-19 16:37 - 2014-06-16 23:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-19 16:35 - 2012-05-02 20:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-19 16:26 - 2014-06-16 22:01 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\VOPackage
2014-06-19 16:09 - 2014-06-16 21:59 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\System Speedup
2014-06-17 21:25 - 2006-11-02 12:23 - 00000246 _____ () C:\Windows\win.ini
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:04 - 2014-06-16 22:13 - 00000892 _____ () C:\Users\Kristin\Desktop\Continue VuuPC Installation.lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-17 21:03 - 2014-06-17 21:02 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-17 20:45 - 2012-04-23 10:19 - 00000000 ____D () C:\Program Files\Lexmark 3600-4600 Series
2014-06-17 20:39 - 2014-06-16 21:59 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\systweak
2014-06-16 23:12 - 2014-06-16 22:00 - 00000284 _____ () C:\Windows\Tasks\System Speedup_UPDATES.job
2014-06-16 23:12 - 2014-06-16 22:00 - 00000276 _____ () C:\Windows\Tasks\System Speedup_DEFAULT.job
2014-06-16 23:11 - 2013-07-09 17:39 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-16 22:09 - 2012-04-20 08:54 - 00000860 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-16 22:09 - 2012-04-20 08:54 - 00000848 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-16 22:03 - 2013-04-21 09:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-16 22:03 - 2012-04-23 10:05 - 00000000 ____D () C:\ProgramData\lx_Cats
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-06-16 22:03 - 2006-11-02 12:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-06-16 22:03 - 2006-11-02 12:22 - 25690112 _____ () C:\Windows\system32\config\system_previous
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-16 22:01 - 2014-06-16 22:01 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-06-16 21:59 - 2014-06-16 21:59 - 00000873 _____ () C:\Users\Public\Desktop\System Speedup.lnk
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Speedup
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\Program Files\System Speedup
2014-06-16 21:58 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-06-16 21:58 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-06-14 14:21 - 2014-06-12 10:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-12 12:21 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-12 11:48 - 2014-06-12 11:47 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-11 20:38 - 2012-04-23 09:39 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 20:32 - 2013-08-14 10:59 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 14:59 - 2012-05-28 18:15 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Winamp
2014-06-09 12:15 - 2014-06-17 20:40 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-01 17:18 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-30 17:12 - 2013-11-24 23:41 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\vlc
2014-05-30 11:55 - 2012-04-23 10:21 - 00010752 _____ () C:\Users\Kristin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-30 11:43 - 2013-03-24 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-28 18:48 - 2014-06-11 15:04 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-28 18:39 - 2014-06-11 15:04 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-28 18:38 - 2014-06-11 15:04 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-28 18:33 - 2014-06-11 15:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-28 18:32 - 2014-06-11 15:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-28 18:32 - 2014-06-11 15:04 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-28 18:30 - 2014-06-11 15:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-28 18:29 - 2014-06-11 15:04 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-28 18:29 - 2014-06-11 15:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-28 18:28 - 2014-06-11 15:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe
2014-05-25 21:31 - 2013-11-18 20:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-25 21:31 - 2012-04-20 10:50 - 00002215 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-05-25 21:31 - 2012-04-20 10:49 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-21 10:35 - 2012-05-02 20:27 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-21 10:35 - 2012-05-02 20:27 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-21 09:19 - 2012-04-29 20:41 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

Some content of TEMP:
====================
C:\Users\Kristin\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\ose00000.exe
C:\Users\Kristin\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Kristin\AppData\Local\Temp\vlc-2.1.3-win32.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-19 17:01

==================== End Of Log ============================

Addition.txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:18-06-2014
Ran by Kristin at 2014-06-19 17:32:20
Running from C:\Users\Kristin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
Adobe Bridge 1.0 (Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Adobe Photoshop CS2 (HKLM\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.) Hidden
Adobe Reader X (10.1.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Stock Photos 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
ASUS nVidia Driver (Version: 1.00.0000 - ASUSTek) Hidden
Dell Resource CD (HKLM\...\{42929F0F-CE14-47AF-9FC7-FF297A603021}) (Version: 1.10.0000 - Ihr Firmenname)
FEZ (HKLM\...\Steam App 224760) (Version:  - )
GCH Guitar academy (HKLM\...\GCH Guitar academy) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
ICQ7.7 (HKLM\...\{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}) (Version: 7.7 - ICQ)
Installer (HKLM\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
Intel(R) PRO Network Connections 12.1.11.0 (HKLM\...\PROSetDX) (Version:  - Intel)
Intel(R) PRO Network Connections 12.1.11.0 (Version:  - Intel) Hidden
Japanese Fonts Support For Adobe Reader X (HKLM\...\{AC76BA86-7AD7-5760-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) SE Runtime Environment 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160000}) (Version: 1.6.0.0 - Sun Microsystems, Inc.)
Lexmark 3600-4600 Series (HKLM\...\Lexmark 3600-4600 Series) (Version:  - Lexmark International, Inc.)
Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Norton Internet Security (HKLM\...\NIS) (Version: 21.3.0.12 - Symantec Corporation)
NVIDIA 3D Vision Controller Driver (Version: 267.67 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller Driver 267.85 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 267.85 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
NVIDIA PhysX (Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1106 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 311.06 (Version: 311.06 - NVIDIA Corporation) Hidden
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
OpenAL (HKLM\...\OpenAL) (Version:  - )
PDF24 Creator 6.3.2 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
Portal 2 (HKLM\...\Steam App 620) (Version:  - Valve)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5408 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.2.12064_9 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.3.2.12064_9 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.6.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
South Park™: The Stick of Truth™ (HKLM\...\Steam App 213670) (Version:  - Obsidian Entertainment)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
System Speedup (HKLM\...\System Speedup_is1) (Version: 2.1 - systemspeedup.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.623  - Nullsoft, Inc)

==================== Restore Points  =========================

10-04-2014 15:31:55 Windows Update
11-04-2014 17:06:12 Geplanter Prüfpunkt
11-05-2014 08:59:09 Installed Java 7 Update 55
11-05-2014 17:14:26 Windows Update
30-05-2014 18:21:59 Geplanter Prüfpunkt
02-06-2014 10:03:48 Geplanter Prüfpunkt
05-06-2014 16:44:34 Geplanter Prüfpunkt
06-06-2014 12:39:35 Geplanter Prüfpunkt
11-06-2014 18:17:09 Windows Update
12-06-2014 13:41:54 Geplanter Prüfpunkt
16-06-2014 11:40:34 Geplanter Prüfpunkt
16-06-2014 20:07:29 System Speedup Mo, Jun 16, 14  22:06

==================== Hosts content: ==========================

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {02B9630A-9B27-4FC1-BA2E-5D75A4BBBEC6} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => C:\Windows\servicing\vsp1ceip.exe [2008-01-19] (Microsoft Corporation)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1DD41E3C-5E1C-4231-A703-A99311E1C120} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-21] (Adobe Systems Incorporated)
Task: {3297E159-68F0-4907-88FD-094802B97CE8} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3387847C-483B-49CE-AD9A-DE6797754805} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-21] (Google Inc.)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {47A1F49B-ADE4-4DBC-AED3-0DE8CC4864B2} - System32\Tasks\Installation App Launcher => C:\Program Files\Lexmark 3600-4600 Series\ezprint.exe [2010-02-04] (Lexmark International Inc.)
Task: {4B4D2A08-8934-4DF4-9994-678DA97B3A65} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {4C8F8085-8F06-4A52-8CBC-706608DAC37F} - System32\Tasks\System Speedup_UPDATES => C:\Program Files\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {5F8969D4-8A4F-43E6-A12C-B158089289A7} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\WSCStub.exe [2014-05-11] (Symantec Corporation)
Task: {678565CE-91B9-4E05-9911-EDEE0991DDDC} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {85F64572-F867-4226-8ACC-D37AFA26DC0A} - System32\Tasks\System Speedup => C:\Program Files\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2012-04-19] ()
Task: {ED92F7AF-2B46-470D-BF99-776340A819E0} - System32\Tasks\System Speedup_DEFAULT => C:\Program Files\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {EDB2F028-14E7-45F9-BAF2-619CFE4255AF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-21] (Google Inc.)
Task: {F8B4F1CA-6854-4362-9913-696FF21B55BD} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\System Speedup_DEFAULT.job => C:\Program Files\System Speedup\SystemSpeedup.exe
Task: C:\Windows\Tasks\System Speedup_UPDATES.job => C:\Program Files\System Speedup\SystemSpeedup.exe

==================== Loaded Modules (whitelisted) =============

2012-04-23 10:05 - 2009-10-16 18:12 - 00147968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\lxdxdrpp.dll
2012-04-23 10:02 - 2009-10-16 18:09 - 00811008 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdxptpc.dll
2012-04-23 10:02 - 2009-10-16 18:12 - 00162816 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdxdrui.dll
2012-04-23 09:56 - 2009-08-19 14:06 - 00782336 _____ () C:\Windows\system32\lxdxdrs.dll
2012-04-23 09:56 - 2009-08-19 14:06 - 00081920 _____ () C:\Windows\system32\lxdxcaps.dll
2012-04-23 09:56 - 2009-08-19 14:00 - 00069632 _____ () C:\Windows\system32\lxdxcnv4.dll
2009-10-14 13:36 - 2009-10-14 13:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
2012-04-23 10:19 - 2010-02-04 01:27 - 00672424 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
2012-04-23 10:19 - 2010-02-04 00:41 - 00380928 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxscw.dll
2012-04-23 10:19 - 2010-02-04 00:52 - 00589824 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxdatr.dll
2012-04-23 10:19 - 2010-02-04 00:41 - 00782336 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxDRS.dll
2012-04-23 10:19 - 2010-02-04 00:41 - 00081920 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcaps.dll
2012-04-23 10:19 - 2010-02-04 00:28 - 00069632 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcnv4.dll
2014-03-30 13:00 - 2014-03-30 13:00 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\21871ce315d4257cfe2052454e583368\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-03-30 13:01 - 2014-03-30 13:01 - 14971904 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\c94e1e76e67ad518b4310a539f072832\Kies.Theme.ni.dll
2014-03-30 13:00 - 2014-03-30 13:00 - 01842688 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\0107366ee1ddeb3e9873c6fac6344bc1\Kies.UI.ni.dll
2014-03-30 13:00 - 2014-03-30 13:00 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\8375369d3ac9c732c2ec8f6b5c9f2bb8\Kies.MVVM.ni.dll
2014-03-30 13:01 - 2014-03-30 13:01 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2014-04-10 17:39 - 2010-02-04 01:28 - 00025256 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxMsdMon.exe
2014-04-10 17:39 - 2010-02-02 03:30 - 00028672 _____ () C:\Program Files\Lexmark 3600-4600 Series\App4R.Monitor.Common.dll
2014-04-10 17:39 - 2010-02-02 03:30 - 00036864 _____ () C:\Program Files\Lexmark 3600-4600 Series\App4R.Monitor.Core.dll
2014-04-10 17:39 - 2010-02-02 03:29 - 00061440 _____ () C:\Program Files\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.dll
2014-04-10 17:39 - 2007-11-22 03:55 - 00011776 _____ () C:\Program Files\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll
2009-10-14 13:34 - 2009-10-14 13:34 - 00560472 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
2014-05-10 20:53 - 2014-05-07 04:27 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: Broadcom 802.11g-Netzwerkadapter
Description: Broadcom 802.11g-Netzwerkadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom
Service: BCM43XV
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/17/2014 08:44:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm TUTO.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 16b4
Anfangszeit: 01cf8a5c2c35beea
Zeitpunkt der Beendigung: 1706

Error: (06/17/2014 08:44:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm package_plushd_offer_multilang.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 3e4
Anfangszeit: 01cf8a5bca0b969a
Zeitpunkt der Beendigung: 3

Error: (06/17/2014 08:44:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm predm.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 7c8
Anfangszeit: 01cf8a5bcd70ba9a
Zeitpunkt der Beendigung: 5

Error: (06/17/2014 08:43:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm _iu14D2N.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 10ec
Anfangszeit: 01cf8a5bcbdd706a
Zeitpunkt der Beendigung: 2

Error: (06/17/2014 08:43:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm majfst.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: d40
Anfangszeit: 01cf8a5b0b6bd83a
Zeitpunkt der Beendigung: 9

Error: (06/16/2014 11:38:58 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm dm.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1294
Anfangszeit: 01cf89aafb1ad088
Zeitpunkt der Beendigung: 4

Error: (06/16/2014 11:38:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm PLUSHD.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 15fc
Anfangszeit: 01cf89ab11cce758
Zeitpunkt der Beendigung: 3

Error: (06/16/2014 11:38:27 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm predm.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 11f0
Anfangszeit: 01cf89aaf2e538b8
Zeitpunkt der Beendigung: 5

Error: (06/16/2014 11:38:17 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm _iu14D2N.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1540
Anfangszeit: 01cf89aaedecf198
Zeitpunkt der Beendigung: 3

Error: (06/16/2014 11:06:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 29.0.1.5239 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 10ec
Anfangszeit: 01cf89a1263e19fc
Zeitpunkt der Beendigung: 28461


System errors:
=============
Error: (06/19/2014 04:57:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (06/19/2014 04:57:12 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (06/19/2014 04:55:35 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (06/19/2014 04:07:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (06/19/2014 04:07:40 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (06/19/2014 04:07:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86

Error: (06/19/2014 04:06:24 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (06/17/2014 08:35:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069

Error: (06/17/2014 08:35:36 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330

Error: (06/17/2014 08:33:50 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-06-19 17:32:12.752
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:32:12.648
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:32:12.542
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:32:12.431
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:32:12.157
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:32:12.052
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:32:11.948
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:32:11.792
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:31:52.303
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\SYMEVENT.SYS" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-06-19 17:31:52.195
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\SYMEVENT.SYS" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 73%
Total physical RAM: 2045.45 MB
Available physical RAM: 539.12 MB
Total Pagefile: 4333.91 MB
Available Pagefile: 2492.31 MB
Total Virtual: 2047.88 MB
Available Virtual: 1888.23 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:288.04 GB) (Free:140.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATAPART1) (Fixed) (Total:298.09 GB) (Free:53.55 GB) NTFS
Drive e: (RECOVERY) (Fixed) (Total:10 GB) (Free:6.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 58000000)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=288 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: D9F1FF73)
Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Gmer.txt:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-19 17:54:00
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-1 SAMSUNG_HD321KJ rev.CP100-11 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Kristin\AppData\Local\Temp\fxdiafoc.sys


---- System - GMER 2.1 ----

SSDT            86DB3660                                                                                          ZwAlertResumeThread
SSDT            86DB36F8                                                                                          ZwAlertThread
SSDT            86DEDB88                                                                                          ZwAllocateVirtualMemory
SSDT            86BF4A00                                                                                          ZwAlpcConnectPort
SSDT            86DB30D8                                                                                          ZwAssignProcessToJobObject
SSDT            86DB3488                                                                                          ZwCreateMutant
SSDT            8733FA88                                                                                          ZwCreateSymbolicLinkObject
SSDT            86EC5958                                                                                          ZwCreateThread
SSDT            86DB3170                                                                                          ZwDebugActiveProcess
SSDT            86DD5248                                                                                          ZwDuplicateObject
SSDT            86DEDA18                                                                                          ZwFreeVirtualMemory
SSDT            86DB3530                                                                                          ZwImpersonateAnonymousToken
SSDT            86DB35C8                                                                                          ZwImpersonateThread
SSDT            86B956E0                                                                                          ZwLoadDriver
SSDT            86DED960                                                                                          ZwMapViewOfSection
SSDT            86DB33F0                                                                                          ZwOpenEvent
SSDT            8702E7C0                                                                                          ZwOpenProcess
SSDT            86DEDC10                                                                                          ZwOpenProcessToken
SSDT            86DB32C0                                                                                          ZwOpenSection
SSDT            8702E398                                                                                          ZwOpenThread
SSDT            86DB3030                                                                                          ZwProtectVirtualMemory
SSDT            86DB3790                                                                                          ZwResumeThread
SSDT            86DED7C8                                                                                          ZwSetContextThread
SSDT            86DED820                                                                                          ZwSetInformationProcess
SSDT            86DB3208                                                                                          ZwSetSystemInformation
SSDT            86DB3358                                                                                          ZwSuspendProcess
SSDT            86DB3828                                                                                          ZwSuspendThread
SSDT            86D75848                                                                                          ZwTerminateProcess
SSDT            86DB38C0                                                                                          ZwTerminateThread
SSDT            86DED8C8                                                                                          ZwUnmapViewOfSection
SSDT            86DEDAC0                                                                                          ZwWriteVirtualMemory
SSDT            8733FB30                                                                                          ZwCreateThreadEx

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 11D                                                                     826B0768 8 Bytes  [60, 36, DB, 86, F8, 36, DB, ...] {PUSHA ; FILD DWORD [SS:ESI-0x7924c908]}
.text           ntkrnlpa.exe!KeSetEvent + 131                                                                     826B077C 4 Bytes  [88, DB, DE, 86]
.text           ntkrnlpa.exe!KeSetEvent + 13D                                                                     826B0788 4 Bytes  [00, 4A, BF, 86]
.text           ntkrnlpa.exe!KeSetEvent + 191                                                                     826B07DC 4 Bytes  [D8, 30, DB, 86]
.text           ntkrnlpa.exe!KeSetEvent + 1F5                                                                     826B0840 4 Bytes  [88, 34, DB, 86]
.text           ...                                                                                               
?               System32\drivers\bfpro.sys                                                                        Das System kann den angegebenen Pfad nicht finden. !

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3804] ntdll.dll!DbgBreakPoint  770D878E 1 Byte  [C3]
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4348] ntdll.dll!LdrLoadDll                           770B9378 5 Bytes  JMP 5B8C1EB1 C:\Program Files\Mozilla Firefox\mozglue.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!HeapSetInformation + 26           76E1A9B8 2 Bytes  JMP 52C03A32 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!HeapSetInformation + 29           76E1A9BB 4 Bytes  [DE, DB, EB, F9]
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!LockResource + C                  76E36BD3 7 Bytes  JMP 535884D6 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!VirtualAllocEx + 54               76E3B030 7 Bytes  JMP 535884F9 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[4348] GDI32.dll!SetStretchBltMode + 256              76B3745C 7 Bytes  JMP 53588457 C:\Program Files\Mozilla Firefox\xul.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                           {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
AttachedDevice  \Driver\tdx \Device\Tcp                                                                           SYMTDIV.SYS
AttachedDevice  \Driver\tdx \Device\Udp                                                                           {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
AttachedDevice  \Driver\tdx \Device\Udp                                                                           SYMTDIV.SYS
AttachedDevice  \Driver\tdx \Device\RawIp                                                                         SYMTDIV.SYS
AttachedDevice  \FileSystem\fastfat \Fat                                                                          fltmgr.sys

---- EOF - GMER 2.1 ----

bei GMER gab es ein Problem, bei dem ein Laufwerk nicht gefunden werden konnte.

17-6-2014-Malwarebytes-Scan.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 17.06.2014
Scan Time: 21:06:17
Logfile: 17-6-2014-Malware.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.17.10
Rootkit Database: v2014.06.02.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Kristin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 277104
Time Elapsed: 16 min, 36 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 7
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.exe, 2564, , [e4aa2e4b0c6ff5417170a5c9cf320df3]
Adware.Tuto4PC, C:\Program Files\fst_de_36\fst_de_36.exe, 3848, , [137bd9a01a6136004bea69a3f50c16ea]
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, 3820, , [a6e850294e2dd56131b07bf3f8094fb1]
PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, 2740, , [dbb3bdbccbb0280e2b13acf7cd354fb1]
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.BrowserAdapter.exe, 3176, , [58363f3a4536e94da77d08af56aca35d]
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.PurBrowse.exe, 5724, , [58363f3a4536e94da77d08af56aca35d]
PUP.Optional.FirstSeenToday.A, C:\Program Files\fst_de_36\fst_de_36.exe, 3848, , [7b1317624833b284820ea80825dd1ee2]

Modules: 1
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\{af16abf4-eac1-49b4-93fc-58f6ca799135}.dll, , [58363f3a4536e94da77d08af56aca35d], 

Registry Keys: 29
PUP.Optional.ToggleMark.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update ToggleMark, , [e4aa2e4b0c6ff5417170a5c9cf320df3], 
PUP.Optional.ToggleMark.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util ToggleMark, , [a6e850294e2dd56131b07bf3f8094fb1], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\CLSID\{24ac098d-eb44-41b3-abaa-f4bc67d4d64d}, , [7a145722b7c4ad8935abde902cd522de], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{0ea930ca-41da-4b13-aad5-bc86c2a8ea17}, , [7a145722b7c4ad8935abde902cd522de], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E2D6EC1B-0DB2-4B28-BBCB-FE6025A7A966}, , [7a145722b7c4ad8935abde902cd522de], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{24AC098D-EB44-41B3-ABAA-F4BC67D4D64D}, , [7a145722b7c4ad8935abde902cd522de], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\CLSID\{24AC098D-EB44-41B3-ABAA-F4BC67D4D64D}\INPROCSERVER32, , [7a145722b7c4ad8935abde902cd522de], 
PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, , [335bb7c2de9d5adcba510f699d65a55b], 
PUP.Optional.Softonic.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, , [bdd1fc7db6c5f64001950e334db5c23e], 
PUP.Optional.Softonic.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, , [f6982e4b9ae12016c0d799a8d52d13ed], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}, , [523cf1880774cb6b7ab73246d72bfa06], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}, , [b8d680f9265555e1ef439bdd966c04fc], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, , [e6a85128cdae8aac0abc97e0de240df3], 
PUP.Optional.VOPackage.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\vosr, , [dbb3bdbccbb0280e2b13acf7cd354fb1], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ToggleMark, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\Iminent, , [37579adf651687affd4eac1940c224dc], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\ToggleMark, , [e7a75821ff7c3ff784a1a4130101c33d], 
PUP.Optional.Iminent.A, HKLM\SOFTWARE\CLASSES\Iminent, , [1d710b6e55266accd8b33eb1ef1403fd], 
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\FREE_SOFT_TODAY\fst_de_40, , [a9e583f6fc7fb284404fc0f0679baf51], 
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\FREE_SOFT_TODAY\fst_de_48, , [3f4f126785f6f4422669416f679b27d9], 
PUP.Optional.FreeSoftToday.A, HKLM\SOFTWARE\FST\fst_de_36, , [305e2356423945f156a705a1fa080df3], 
PUP.Optional.ToggleMark.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\ToggleMark, , [cdc1c0b981fa11254dd9368123df36ca], 
Adware.EoRezo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\fst_de_36_is1, , [bbd32f4afc7f8fa7035b8e0607fbd22e], 
Adware.EoRezo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\fst_de_40_is1, , [7816e39644373df993cbc0d4e31f5aa6], 
Adware.EoRezo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\fst_de_48_is1, , [6628a9d0d5a678be5b03563ed23044bc], 

Registry Values: 8
Adware.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_36, "C:\Program Files\fst_de_36\fst_de_36.exe", , [137bd9a01a6136004bea69a3f50c16ea]
Adware.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_40, "C:\Program Files\fst_de_40\fst_de_40.exe", , [a0ee0b6e364552e48da837d5d829956b]
Backdoor.Bot.ED, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|upfst_de_40.exe, C:\Users\Kristin\AppData\Local\fst_de_40\upfst_de_40.exe -runonce, , [5e306217cfac6accce8d631afd046f91]
PUP.Optional.Iminent.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, , [e6a85128cdae8aac0abc97e0de240df3], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, , [29650d6c265556e09a2cef888c769769], 
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_36, "C:\Program Files\fst_de_36\fst_de_36.exe", , [7b1317624833b284820ea80825dd1ee2]
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_40, "C:\Program Files\fst_de_40\fst_de_40.exe", , [55393445235876c05040fcb4bf433dc3]
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_48, "C:\Program Files\fst_de_48\fst_de_48.exe", , [8a045a1f87f45cdabfd1a10f0002b54b]

Registry Data: 0
(No malicious items detected)

Folders: 27
PUP.Optional.FreeSoftToday.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst, , [dbb31e5bccafa69015e7188e8d75d828], 
Adware.EoRezo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFT_TODAY, , [48468bee5f1c92a4ec68961d56acae52], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\TEMP, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.Iminent.A, C:\Program Files\IminentToolbar, , [197514659edd47ef579253379c6602fe], 
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy, , [eda15425136866d06a88543644bed62a], 
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\1988B6C156854B0C9A2CB4A2DFD14133, , [eda15425136866d06a88543644bed62a], 
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\2AFCA6F2C7994406BF5F38B8E3075A52, , [eda15425136866d06a88543644bed62a], 
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\OpenCandy_1988B6C156854B0C9A2CB4A2DFD14133, , [eda15425136866d06a88543644bed62a], 
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\OpenCandy_2AFCA6F2C7994406BF5F38B8E3075A52, , [eda15425136866d06a88543644bed62a], 
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Local\Temp\Iminent, , [bdd17dfccfaca19559b28803936f1be5], 
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Roaming\IminentToolbar, , [eea07009d7a40a2c447604883dc5ba46], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS, , [513d4732f08b6dc9acd58012cd3515eb], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36, , [533b4f2a6f0ca690c695474daf53b050], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36, , [533b4f2a6f0ca690c695474daf53b050], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36\1.10, , [533b4f2a6f0ca690c695474daf53b050], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\Download, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_48, , [bcd28cede794a98d164599fb59a948b8], 
Adware.EoRezo, C:\Program Files\fst_de_36, , [bbd32f4afc7f8fa7035b8e0607fbd22e], 
Adware.EoRezo, C:\Program Files\fst_de_40, , [7816e39644373df993cbc0d4e31f5aa6], 
Adware.EoRezo, C:\Program Files\fst_de_48, , [6628a9d0d5a678be5b03563ed23044bc], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft, , [345ad6a3b2c9c175419ba9ef7c86718f], 

Files: 136
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.exe, , [e4aa2e4b0c6ff5417170a5c9cf320df3], 
Adware.Tuto4PC, C:\Program Files\fst_de_36\fst_de_36.exe, , [137bd9a01a6136004bea69a3f50c16ea], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, , [a6e850294e2dd56131b07bf3f8094fb1], 
Adware.Tuto4PC, C:\Program Files\fst_de_40\fst_de_40.exe, , [a0ee0b6e364552e48da837d5d829956b], 
Backdoor.Bot.ED, C:\Users\Kristin\AppData\Local\fst_de_40\upfst_de_40.exe, , [5e306217cfac6accce8d631afd046f91], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\ToggleMarkBHO.dll, , [7a145722b7c4ad8935abde902cd522de], 
PUP.Optional.AirInstaller, C:\$Recycle.Bin\S-1-5-21-3444271574-3087294878-1149490491-1000\$RQDVMBM.exe, , [0985a6d3f28983b3b89ff62946bb1ae6], 
PUP.Optional.SoftonicTB.A, C:\Users\Kristin\AppData\Local\Temp\softonic_ggl_1.6.7.4.exe, , [4f3f7504afcc70c67d98780344bd1be5], 
PUP.Optional.FirstSeenToday, C:\Users\Kristin\AppData\Local\Temp\n4660\fst_de_0606-88a44852.exe, , [6e206712d2a9b0865808b0d406fb837d], 
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Local\Temp\n4660\Iminent_1712-b2fcad5e.exe, , [bbd329507407989e9ff105425da4a15f], 
PUP.Optional.BundleInstaller.A, C:\Users\Kristin\AppData\Local\Temp\n4660\s4660.exe, , [2e60d4a597e46ec8401e8dba36ca2ed2], 
PUP.Optional.GenericExt.A, C:\Users\Kristin\AppData\Local\Temp\igdhbblpcellaljokkpfhcjlagemhgjl87d4\minibarchrome.exe, , [75194e2bf18adc5aa79a82bb9b656b95], 
PUP.Optional.InstallMonetizer.NS, C:\Users\Kristin\AppData\Local\Temp\is-4JCBD.tmp\IMNS.exe, , [f599f8815427d363b19162285ba62ed2], 
PUP.Optional.InstallMonetizer.NS, C:\Users\Kristin\AppData\Local\Temp\is-URVQ7.tmp\IMNS.exe, , [75194e2badce5dd979c91575fd04b64a], 
PUP.Optional.Softonic.A, C:\Users\Kristin\Downloads\SoftonicDownloader_fuer_free-guitar-tuner.exe, , [543a7dfc750667cf1a816eb5a25fdf21], 
PUP.Optional.OpenCandy, C:\Users\Kristin\Downloads\winamp5623_full_emusic-7plus_de-de(1).exe, , [f09e97e2b7c4d0664428920d7e8650b0], 
PUP.Optional.OpenCandy, C:\Users\Kristin\Downloads\winamp5623_full_emusic-7plus_de-de.exe, , [99f5b3c67cff82b4b0bc4f508183dc24], 
Backdoor.Bot.ED, C:\Users\Kristin\AppData\Local\fst_de_36\upfst_de_36.exe, , [4a4442373a4139fdfe5ddba2ed14d42c], 
PUP.Optional.FreeSoft, C:\Users\Kristin\AppData\Local\fst_de_40\Download\majfst.exe, , [69256316cead112508e3710b52af8b75], 
PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, , [dbb3bdbccbb0280e2b13acf7cd354fb1], 
PUP.Optional.FreeSoftToday.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst\Freesofttoday.lnk, , [dbb31e5bccafa69015e7188e8d75d828], 
PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOPackage.exe, , [39552d4ce39874c25c64cbe108fa1ee2], 
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage, , [444a4237374410260c49bdf0659dd22e], 
Adware.EoRezo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFT_TODAY\Freesofttoday.lnk, , [48468bee5f1c92a4ec68961d56acae52], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\ToggleMark.ico, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\0, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\7za.exe, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\ToggleMarkUninstall.exe, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.InstallState, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\7za.exe, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\BrowserAdapterS.7z, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.BrowserAdapter.exe, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.PurBrowse.exe, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.PurBrowseG.zip, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMarkBAApp.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.InstallState, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\{af16abf4-eac1-49b4-93fc-58f6ca799135}.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.Bromon.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.BroStats.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.BrowserAdapterS.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.CompatibilityChecker.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.FFUpdate.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.IEUpdate.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.PurBrowseG.dll, , [58363f3a4536e94da77d08af56aca35d], 
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot.exe, , [523c3544fb8080b668f0aa311fe4e11f], 
PUP.Optional.FirstSeenToday.A, C:\Program Files\fst_de_36\fst_de_36.exe, , [7b1317624833b284820ea80825dd1ee2], 
PUP.Optional.FirstSeenToday.A, C:\Program Files\fst_de_40\fst_de_40.exe, , [55393445235876c05040fcb4bf433dc3], 
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\1988B6C156854B0C9A2CB4A2DFD14133\driverscannerROE.exe, , [eda15425136866d06a88543644bed62a], 
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\2AFCA6F2C7994406BF5F38B8E3075A52\speedupmypcROE.exe, , [eda15425136866d06a88543644bed62a], 
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Roaming\IminentToolbar\sqlite3.dll, , [eea07009d7a40a2c447604883dc5ba46], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\174.crx, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\174.dll, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\174.xpi, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\a.db, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\b.db, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurf.exe, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfA.exe, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfbx174.bin, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfbx174.dll, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfbx174.exe, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\Sqlite3.dll, , [513d4732f08b6dc9acd58012cd3515eb], 
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\Uninstall.exe, , [513d4732f08b6dc9acd58012cd3515eb], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\upfst_de_36.cyp, , [533b4f2a6f0ca690c695474daf53b050], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36\1.10\cnf.cyl, , [533b4f2a6f0ca690c695474daf53b050], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36\1.10\eorezo.cyl, , [533b4f2a6f0ca690c695474daf53b050], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\upfst_de_40.cyp, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\Download\majfst.exe, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10\cnf.cyl, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10\eorezo.cyl, , [276738411863c86e5803157f1be7e11f], 
Adware.EoRezo, C:\Program Files\fst_de_36\freeSoftToday_widget.exe, , [bbd32f4afc7f8fa7035b8e0607fbd22e], 
Adware.EoRezo, C:\Program Files\fst_de_36\predm.exe, , [bbd32f4afc7f8fa7035b8e0607fbd22e], 
Adware.EoRezo, C:\Program Files\fst_de_36\unins000.dat, , [bbd32f4afc7f8fa7035b8e0607fbd22e], 
Adware.EoRezo, C:\Program Files\fst_de_36\unins000.exe, , [bbd32f4afc7f8fa7035b8e0607fbd22e], 
Adware.EoRezo, C:\Program Files\fst_de_36\unins000.msg, , [bbd32f4afc7f8fa7035b8e0607fbd22e], 
Adware.EoRezo, C:\Program Files\fst_de_40\freeSoftToday_widget.exe, , [7816e39644373df993cbc0d4e31f5aa6], 
Adware.EoRezo, C:\Program Files\fst_de_40\predm.exe, , [7816e39644373df993cbc0d4e31f5aa6], 
Adware.EoRezo, C:\Program Files\fst_de_40\unins000.dat, , [7816e39644373df993cbc0d4e31f5aa6], 
Adware.EoRezo, C:\Program Files\fst_de_40\unins000.exe, , [7816e39644373df993cbc0d4e31f5aa6], 
Adware.EoRezo, C:\Program Files\fst_de_40\unins000.msg, , [7816e39644373df993cbc0d4e31f5aa6], 
Adware.EoRezo, C:\Program Files\fst_de_48\freeSoftToday_widget.exe, , [6628a9d0d5a678be5b03563ed23044bc], 
Adware.EoRezo, C:\Program Files\fst_de_48\predm.exe, , [6628a9d0d5a678be5b03563ed23044bc], 
Adware.EoRezo, C:\Program Files\fst_de_48\unins000.dat, , [6628a9d0d5a678be5b03563ed23044bc], 
Adware.EoRezo, C:\Program Files\fst_de_48\unins000.exe, , [6628a9d0d5a678be5b03563ed23044bc], 
Adware.EoRezo, C:\Program Files\fst_de_48\unins000.msg, , [6628a9d0d5a678be5b03563ed23044bc], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\173.dll, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\173.xpi, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\a.db, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\b.db, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\Sqlite3.dll, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\Uninstall.exe, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordFIXQNw.exe, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordKT173.bin, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordKT173.dll, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordKT173.exe, , [345ad6a3b2c9c175419ba9ef7c86718f], 
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.admin", false);), ,[226c9edb6f0cd06633d65f4a739125db]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.aflt", "SD");), ,[3b53e3965328d1656c9d41688d7717e9]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.autoRvrt", "false");), ,[85094435fd7e35017a8f3376768ec33d]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.cntry", "us");), ,[cac4f4856c0f48ee24e5c4e500046e92]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.cv", "cv5");), ,[434b31485b2067cf15f46c3d16ee23dd]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.dfltLng", "de");), ,[d4badf9a0873fe3847c29613d232e51b]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.dfltsrch", "false");), ,[b7d76c0d6219e94d1ced149520e438c8]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.envrmnt", "production");), ,[4e40fc7d215abd79f6137d2c15ef33cd]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.excTlbr", false);), ,[47470b6e136810264bbe7e2b20e455ab]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hdrMd5", "E370ED6FEB49DCC81B588F9B58078655");), ,[ade19ddcadcec2743bced6d372927b85]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hmpg", false);), ,[3658bebbdd9ed75ff1187a2f18ec52ae]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hrdid", "d2a4837e000000000000001aa099324c");), ,[fb9337423f3ce25437d2d6d3c143ab55]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.id", "d2a4837e000000000000001aa099324c");), ,[513d1a5fd7a47fb706033970cb39f010]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.instlDay", "15590");), ,[a3eb5920cface74ff1185d4c46be7987]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.instlRef", "MON00015");), ,[f896f782bdbeb08663a62881e32123dd]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.isdcmntcmplt", "false");), ,[5e304c2d83f8a492e9205b4ee024fb05]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.keywordurl", "");), ,[5e303b3ef7842c0a8287ecbd59ab26da]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.lastVrsnTs", "1.6.7.419:01:44");), ,[632b542553280c2a49c06a3fe61e35cb]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.mntrvrsn", "1.3.0");), ,[206ee693cdaec86e0cfdb3f65ea67888]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.monitorreport", true);), ,[c5c989f0b4c7d75f7f8a218833d1b64a]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newTab", false);), ,[dbb34732f88366d0c8415a4f09fb639d]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newtab", "false");), ,[28664c2d1269ca6c51b87336bd47c63a]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newtaburl", "");), ,[088694e5b2c960d65aaf1e8bba4a7987]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.prdct", "Softonic");), ,[b7d73544374473c35eab02a7d2327888]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.propectorlck", 86165111);), ,[701ea9d09edd65d1719870391ce8ef11]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.prtnrId", "softonic");), ,[e4aa1267106bc76f23e6b3f60bf9ac54]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.radiomystations", "[{\"id\":\"1069\",\"name\":\"ORS Rom�ntica en espa�ol\",\"url\":\"hxxp://www.orsradio.com/oldies56k.asx\",\"streamType\":\"mp\"},{\"id\":\"1213\",\"name\":\"ORS Top Hits\",\"url\":\"hxxp://www.orsradio.com/tophits128k.asx\",\"streamType\":\"mp\"},{\"id\":\"1952\",\"name\":\"Dance Radio\",\"url\":\"hxxp://www.play.cz/radio/danceradio128.asx\",\"streamType\":\"mp\"},{\"id\":\"323\",\"name\":\"Sky Love\",\"url\":\"hxxp://www.sky.fm/wma/lovemusic.asx\",\"streamType\":\"mp\"},{\"id\":\"3300\",\"name\":\"Sky Blue Radio\",\"url\":\"hxxp://www.skyblueradio.com/skyblueradio.asx\",\"streamType\":\"mp\"},{\"id\":\"3672\",\"name\":\"RIGHTONSCALES REGGAE RADIO\",\"url\":\"mms://win2.fast-serv.com/ros\",\"streamType\":\"mp\"},{\"id\":\"4948\",\"name\":\"ORS Radio - Poptop\",\"url\":\"hxxp://www.orsradio.com/poptop128k.asx\",\"streamType\":\"mp\"},{\"id\":\"5375\",\"name\":\"ORS Radio - Country\",\"url\":\"hxxp://www.orsradio.com/country128k.asx\",\"streamType\":\"mp\"},{\"id\":\"5440\",\"name\":\"SomaFM: Space Station 128k\",\"url\":\"hxxp://somafm.com/wma128/spacestation.asx\",\"streamType\":\"mp\"},{\"id\":\"5464\",\"name\":\"Community listening network - garinger.org\",\"url\":\"hxxp://asx.abacast.com/ccr-ccr-20.asx\",\"streamType\":\"mp\"},{\"id\":\"560\",\"name\":\"Soma FM Sonic Universe\",\"url\":\"hxxp://somafm.com/wma128/sonicuniverse.asx\",\"streamType\":\"mp\"},{\"id\":\"8396\",\"name\":\"Radio.isg.si\",\"url\":\"hxxp://radio.isg.si:8000/radio.isg.si.mp3.m3u\",\"streamType\":\"mp\"},{\"id\":\"9639\",\"name\":\"soma fm - DroneZone 32K\",\"url\":\"hxxp://somafm.com/wma/dronezone.asx\",\"streamType\":\"mp\"}]");), ,[305e2851dba07bbb25e461480ff5bb45]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search settings, Click No to restore original settings");), ,[672721581f5c1c1a0bfedbcec93b05fb]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.savedVrsnTs", "1");), ,[226c5326116a63d38a7f1297b74de719]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.sg", "az");), ,[8905da9f3645cd6919f033762bd98c74]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.smplGrp", "none");), ,[5638fe7b2b502e082edb2d7cad5714ec]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.srch", "");), ,[c2ccadcc81facf6779906643b94b1be5]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.srchprvdr", "");), ,[e8a6e0995526181e54b5b4f51aea13ed]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.tlbrId", "base");), ,[b0ded2a7700b67cfee1b9019e51fac54]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=");), ,[dab43e3b4536eb4bee1b713806fe19e7]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsn", "1.6.7.4");), ,[e9a57207c7b40333e9206f3a0400c53b]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsnTs", "1.6.7.419:01:44");), ,[c8c6344516655dd947c2cadf9a6ad030]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsni", "1.6.7.4");), ,[e2ac3f3a7b005ed8a8618227f50f45bb]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic_i.newTab", false);), ,[f9958ced0378ed4932d744658381f010]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic_i.smplGrp", "none");), ,[9df162173b4060d63dccccdd0cf824dc]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic_i.vrsnTs", "1.6.7.419:01:44");), ,[39553346a3d8cb6bfd0cccdd5ca8e51b]
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\user.js, Good: (), Bad: (user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");), ,[8c024c2d255661d506f7a9ff11f3a060]

Physical Sectors: 0
(No malicious items detected)


(end)

17-6-2014-Malwarebytes-Protection.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Protection, 17.06.2014 21:05:02, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting, 
Protection, 17.06.2014 21:05:04, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started, 
Protection, 17.06.2014 21:05:04, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Update, 17.06.2014 21:05:30, SYSTEM, KRISTIN-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.6.2.1, 
Update, 17.06.2014 21:05:47, SYSTEM, KRISTIN-PC, Manual, Malware Database, 2014.3.4.9, 2014.6.17.10, 
Protection, 17.06.2014 21:05:59, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting, 
Protection, 17.06.2014 21:06:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 
Protection, 17.06.2014 21:06:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 17.06.2014 21:06:02, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 17.06.2014 21:06:06, SYSTEM, KRISTIN-PC, Protection, Refresh, Success, 
Protection, 17.06.2014 21:06:06, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Protection, 17.06.2014 21:06:06, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 
Detection, 17.06.2014 21:06:20, Kristin, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.FreeSoftToday.A, C:\Users\Kristin\AppData\Local\Temp\nsc915C.tmp, Quarantine, [f69856234f2ce155b9593f4cf70a837d]
Protection, 17.06.2014 21:06:20, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Local\Temp\nsc915C.tmp, 
Error, 17.06.2014 21:06:20, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Local\Temp\nsc915C.tmp, 
Detection, 17.06.2014 21:07:00, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, Adware.Tuto4PC, C:\Program Files\fst_de_48\fst_de_48.exe, Quarantine, [404e35442d4eb482e45135d712ef3ac6]
Detection, 17.06.2014 21:07:02, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_48\upfst_de_48.exe, Quarantine, [67279bde364531055efd61335da57e82]
Detection, 17.06.2014 21:07:46, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfB72.exe, Quarantine, [abe35425cab111253a4793ff41c1ec14]
Detection, 17.06.2014 21:31:36, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.exe, Quarantine, [91fdd8a192e93ff77e63452947ba0af6]
Protection, 17.06.2014 21:31:36, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\updateToggleMark.exe, 
Error, 17.06.2014 21:31:36, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\updateToggleMark.exe, 
Detection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, Quarantine, [e4aa82f7a7d40e28b62bf777c23f6898]
Protection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, 
Error, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, 
Detection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, Quarantine, [266889f0e992f14581bdbae9c04240c0]
Protection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, 
Error, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, 

(end)

19-6-2014-Malwarebytes-Scan.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 19.06.2014
Scan Time: 16:23:26
Logfile: 19-6-2014-Malware.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.19.06
Rootkit Database: v2014.06.02.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Kristin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 277468
Time Elapsed: 20 min, 22 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 9
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40, Quarantined, [56fca2d8e8932f071ddd12839969d62a], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\Download, Quarantined, [56fca2d8e8932f071ddd12839969d62a], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40, Quarantined, [56fca2d8e8932f071ddd12839969d62a], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10, Quarantined, [56fca2d8e8932f071ddd12839969d62a], 
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_48, Quarantined, [f959a6d48bf0c86ec337791cf60c946c], 
Adware.EoRezo, C:\Program Files\fst_de_36, Quarantined, [034ff387c2b92c0a96679005b74bde22], 
Adware.EoRezo, C:\Program Files\fst_de_40, Quarantined, [6ae84f2ba5d62511619cc2d3c939b24e], 
Adware.EoRezo, C:\Program Files\fst_de_48, Quarantined, [60f2a5d5d1aa122439c4b4e1b44e8b75], 
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft, Quarantined, [f260f585c1baaa8cd5a41486010120e0], 

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

19-6-2014-Malwarebytes-Protection.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org


Protection, 19.06.2014 16:04:55, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting, 
Protection, 19.06.2014 16:04:55, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started, 
Protection, 19.06.2014 16:04:55, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Protection, 19.06.2014 16:05:18, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 
Update, 19.06.2014 16:23:16, SYSTEM, KRISTIN-PC, Manual, Malware Database, 2014.6.17.10, 2014.6.19.6, 
Protection, 19.06.2014 16:23:19, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting, 
Protection, 19.06.2014 16:23:19, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 19.06.2014 16:23:20, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 19.06.2014 16:23:31, SYSTEM, KRISTIN-PC, Protection, Refresh, Success, 
Protection, 19.06.2014 16:23:31, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Protection, 19.06.2014 16:24:04, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 
Update, 19.06.2014 16:41:26, SYSTEM, KRISTIN-PC, Scheduler, Malware Database, 2014.6.19.6, 2014.6.19.7, 
Protection, 19.06.2014 16:42:00, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting, 
Protection, 19.06.2014 16:42:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 19.06.2014 16:42:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 19.06.2014 16:42:59, SYSTEM, KRISTIN-PC, Protection, Refresh, Success, 
Protection, 19.06.2014 16:42:59, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Protection, 19.06.2014 16:43:06, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 
Protection, 19.06.2014 16:54:38, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting, 
Protection, 19.06.2014 16:54:38, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started, 
Protection, 19.06.2014 16:54:38, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Protection, 19.06.2014 16:54:57, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 
Protection, 19.06.2014 17:36:10, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 19.06.2014 17:36:11, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 19.06.2014 17:36:11, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Stopping, 
Protection, 19.06.2014 17:36:27, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Stopped, 
Protection, 19.06.2014 18:15:23, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting, 
Protection, 19.06.2014 18:15:23, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started, 
Protection, 19.06.2014 18:15:23, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Protection, 19.06.2014 18:15:24, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 
Update, 19.06.2014 18:46:01, SYSTEM, KRISTIN-PC, Scheduler, Malware Database, 2014.6.19.7, 2014.6.19.8, 
Protection, 19.06.2014 18:46:19, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting, 
Protection, 19.06.2014 18:46:19, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 19.06.2014 18:46:19, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 19.06.2014 18:46:23, SYSTEM, KRISTIN-PC, Protection, Refresh, Success, 
Protection, 19.06.2014 18:46:23, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting, 
Protection, 19.06.2014 18:46:24, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started, 

(end)

Noch einmal vielen Dank für die Hilfe.

schrauber · 19.06.2014, 18:50

hi,

Adware & Co. deinstallieren

Lade Dir bitte von hier Revo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:

diesen Zusatz haben:
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Shnoxxer · 19.06.2014, 20:07

Hi schrauber,
danke für die schnelle Antwort. Habe alles wie im Post oben beschrieben durchgeführt.
Hier die Logfiles:

mbam.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 19.06.2014
Suchlauf-Zeit: 20:14:46
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.19.08
Rootkit Datenbank: v2014.06.02.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Kristin

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 276858
Verstrichene Zeit: 8 Min, 46 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 41
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.admin", false);), Ersetzt,[5103accee992e74f0739713b679dfd03]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.aflt", "SD");), Ersetzt,[1a3a334766154de919278626ac58d62a]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.autoRvrt", "false");), Ersetzt,[371d1c5e96e57abcb48cc5e70cf8639d]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.cntry", "us");), Ersetzt,[88cc2a502d4e80b660e01993dd27ad53]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.cv", "cv5");), Ersetzt,[5df7fe7c75067cbae45c812b72924ab6]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.dfltLng", "de");), Ersetzt,[e86c07739dde3ef8cb753c70679d5fa1]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.dfltsrch", "false");), Ersetzt,[89cb7a001b607fb76ed2129aff05bd43]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.envrmnt", "production");), Ersetzt,[153f8af0f38895a10d33f2ba31d302fe]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.excTlbr", false);), Ersetzt,[074d6a10c7b454e2d769cfdd52b2837d]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.hdrMd5", "E370ED6FEB49DCC81B588F9B58078655");), Ersetzt,[9cb82e4c6d0ec96db18fa408d23253ad]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.hmpg", false);), Ersetzt,[e86c7208eb90f3439da3d8d46c98659b]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.hrdid", "d2a4837e000000000000001aa099324c");), Ersetzt,[fa5a0971bdbec571ad93ab019470659b]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.id", "d2a4837e000000000000001aa099324c");), Ersetzt,[98bc7703fc7fcf67f848feae20e4e719]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.instlDay", "15590");), Ersetzt,[1b3987f3f487e45285bb1f8d17ed649c]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.instlRef", "MON00015");), Ersetzt,[87cd245657242016d16f4e5e867e1de3]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.isdcmntcmplt", "false");), Ersetzt,[4b093a40601bfe384ef2901cb84cf709]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.keywordurl", "");), Ersetzt,[371dde9c0d6efa3cf44c17955ea6ab55]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.lastVrsnTs", "1.6.7.419:01:44");), Ersetzt,[b79dcfab9edd9f9787b98d1f1ee6f808]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.mntrvrsn", "1.3.0");), Ersetzt,[4b09bebc9ae137ffbe82317b60a4c040]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.monitorreport", true);), Ersetzt,[73e15d1daad11e18a898416b23e17987]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.newTab", false);), Ersetzt,[8bc92a50cbb0ec4a20204e5e35cf669a]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.newtab", "false");), Ersetzt,[64f01e5cf2899b9b2e12911baa5ab24e]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.newtaburl", "");), Ersetzt,[81d398e2bdbedd59a69a9a12da2a6997]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.prdct", "Softonic");), Ersetzt,[e66e8befd1aa9e98a69a17954eb6b24e]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.propectorlck", 86165111);), Ersetzt,[56fe8ded344753e33e02b2fa10f4a25e]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.prtnrId", "softonic");), Ersetzt,[d77da4d62754e84e2c14812bc1436c94]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.radiomystations", "[{\"id\":\"1069\",\"name\":\"ORS Romï¿½ntica en espaï¿½ol\",\"url\":\"hxxp://www.orsradio.com/oldies56k.asx\",\"streamType\":\"mp\"},{\"id\":\"1213\",\"name\":\"ORS Top Hits\",\"url\":\"hxxp://www.orsradio.com/tophits128k.asx\",\"streamType\":\"mp\"},{\"id\":\"1952\",\"name\":\"Dance Radio\",\"url\":\"hxxp://www.play.cz/radio/danceradio128.asx\",\"streamType\":\"mp\"},{\"id\":\"323\",\"name\":\"Sky Love\",\"url\":\"hxxp://www.sky.fm/wma/lovemusic.asx\",\"streamType\":\"mp\"},{\"id\":\"3300\",\"name\":\"Sky Blue Radio\",\"url\":\"hxxp://www.skyblueradio.com/skyblueradio.asx\",\"streamType\":\"mp\"},{\"id\":\"3672\",\"name\":\"RIGHTONSCALES REGGAE RADIO\",\"url\":\"mms://win2.fast-serv.com/ros\",\"streamType\":\"mp\"},{\"id\":\"4948\",\"name\":\"ORS Radio - Poptop\",\"url\":\"hxxp://www.orsradio.com/poptop128k.asx\",\"streamType\":\"mp\"},{\"id\":\"5375\",\"name\":\"ORS Radio - Country\",\"url\":\"hxxp://www.orsradio.com/country128k.asx\",\"streamType\":\"mp\"},{\"id\":\"5440\",\"name\":\"SomaFM: Space Station 128k\",\"url\":\"hxxp://somafm.com/wma128/spacestation.asx\",\"streamType\":\"mp\"},{\"id\":\"5464\",\"name\":\"Community listening network - garinger.org\",\"url\":\"hxxp://asx.abacast.com/ccr-ccr-20.asx\",\"streamType\":\"mp\"},{\"id\":\"560\",\"name\":\"Soma FM Sonic Universe\",\"url\":\"hxxp://somafm.com/wma128/sonicuniverse.asx\",\"streamType\":\"mp\"},{\"id\":\"8396\",\"name\":\"Radio.isg.si\",\"url\":\"hxxp://radio.isg.si:8000/radio.isg.si.mp3.m3u\",\"streamType\":\"mp\"},{\"id\":\"9639\",\"name\":\"soma fm - DroneZone 32K\",\"url\":\"hxxp://somafm.com/wma/dronezone.asx\",\"streamType\":\"mp\"}]");), Ersetzt,[69eb6d0d6e0d4fe7ed53812bd62e6e92]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search settings, Click No to restore original settings");), Ersetzt,[a6ae7bffcab1181efb45c0ecbc4814ec]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.savedVrsnTs", "1");), Ersetzt,[50043941e4972f0796aaf1bbb252966a]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.sg", "az");), Ersetzt,[cc88fc7ec7b49a9c17298c20788cf907]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.smplGrp", "none");), Ersetzt,[4b09473346357abc62de0aa2bb494bb5]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.srch", "");), Ersetzt,[e27276042f4c270f77c9109c0bf99e62]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.srchprvdr", "");), Ersetzt,[52025426df9c3bfb2719c4e86e961ce4]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.tlbrId", "base");), Ersetzt,[ea6a7703f08bc76fa799426ad72d8e72]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=");), Ersetzt,[afa583f78fec0036063a8626cf359070]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.vrsn", "1.6.7.4");), Ersetzt,[c58fc0ba78039f977cc4d7d5729223dd]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.vrsnTs", "1.6.7.419:01:44");), Ersetzt,[f65e52284635eb4b48f80f9d33d13ec2]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic.vrsni", "1.6.7.4");), Ersetzt,[7cd8eb8fb9c20f270c347834e123d828]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic_i.newTab", false);), Ersetzt,[e173ec8e5e1dea4c59e7208c1fe56b95]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic_i.smplGrp", "none");), Ersetzt,[e86cc0badd9eb08688b800aca95b40c0]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.Softonic_i.vrsnTs", "1.6.7.419:01:44");), Ersetzt,[5cf839416b10d56165db6b4143c1b947]

Physische Sektoren: 0
(No malicious items detected)


(end)

AdwCleaner[S0].txt

Code:

ATTFilter

# AdwCleaner v3.212 - Bericht erstellt am 19/06/2014 um 20:33:36
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Kristin - KRISTIN-PC
# Gestartet von : C:\Users\Kristin\Desktop\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Speedup
Ordner Gelöscht : C:\Program Files\System Speedup
Ordner Gelöscht : C:\Users\Kristin\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Kristin\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Kristin\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Kristin\AppData\Roaming\System Speedup
Ordner Gelöscht : C:\Users\Kristin\AppData\Roaming\Systweak
Datei Gelöscht : C:\Users\Kristin\Desktop\Continue VuuPC Installation.lnk
Datei Gelöscht : C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\searchplugins\safesearch.xml
Datei Gelöscht : C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\user.js
Datei Gelöscht : C:\Windows\Tasks\System Speedup_DEFAULT.job
Datei Gelöscht : C:\Windows\System32\Tasks\System Speedup_DEFAULT
Datei Gelöscht : C:\Windows\Tasks\System Speedup_UPDATES.job
Datei Gelöscht : C:\Windows\System32\Tasks\System Speedup_UPDATES

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ED92F7AF-2B46-470D-BF99-776340A819E0}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED92F7AF-2B46-470D-BF99-776340A819E0}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4C8F8085-8F06-4A52-8CBC-706608DAC37F}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4C8F8085-8F06-4A52-8CBC-706608DAC37F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\System Speedup
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\Tutorials
Schlüssel Gelöscht : HKCU\Software\TutoTag
Schlüssel Gelöscht : HKLM\Software\Free_soft_today
Schlüssel Gelöscht : HKLM\Software\System Speedup
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Tutorials
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\System Speedup_is1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Iminent
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\System Speedup_is1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\VOPackage
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DatamngrCoordinator.exe

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16555


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.Softonic.admin", false);
Zeile gelöscht : user_pref("extensions.Softonic.aflt", "SD");
Zeile gelöscht : user_pref("extensions.Softonic.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.cntry", "us");
Zeile gelöscht : user_pref("extensions.Softonic.cv", "cv5");
Zeile gelöscht : user_pref("extensions.Softonic.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.Softonic.dfltlng", "de");
Zeile gelöscht : user_pref("extensions.Softonic.dfltsrch", "false");
Zeile gelöscht : user_pref("extensions.Softonic.envrmnt", "production");
Zeile gelöscht : user_pref("extensions.Softonic.excTlbr", false);
Zeile gelöscht : user_pref("extensions.Softonic.hdrMd5", "E370ED6FEB49DCC81B588F9B58078655");
Zeile gelöscht : user_pref("extensions.Softonic.hmpg", false);
Zeile gelöscht : user_pref("extensions.Softonic.hrdid", "d2a4837e000000000000001aa099324c");
Zeile gelöscht : user_pref("extensions.Softonic.id", "d2a4837e000000000000001aa099324c");
Zeile gelöscht : user_pref("extensions.Softonic.instlDay", "15590");
Zeile gelöscht : user_pref("extensions.Softonic.instlRef", "MON00015");
Zeile gelöscht : user_pref("extensions.Softonic.instlday", "15590");
Zeile gelöscht : user_pref("extensions.Softonic.instlref", "MON00015");
Zeile gelöscht : user_pref("extensions.Softonic.isdcmntcmplt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.keywordurl", "");
Zeile gelöscht : user_pref("extensions.Softonic.lastVrsnTs", "1.6.7.419:01:44");
Zeile gelöscht : user_pref("extensions.Softonic.mntrvrsn", "1.3.0");
Zeile gelöscht : user_pref("extensions.Softonic.monitorreport", true);
Zeile gelöscht : user_pref("extensions.Softonic.newTab", false);
Zeile gelöscht : user_pref("extensions.Softonic.newtab", "false");
Zeile gelöscht : user_pref("extensions.Softonic.newtaburl", "");
Zeile gelöscht : user_pref("extensions.Softonic.prdct", "Softonic");
Zeile gelöscht : user_pref("extensions.Softonic.propectorlck", 86165111);
Zeile gelöscht : user_pref("extensions.Softonic.prtnrId", "softonic");
Zeile gelöscht : user_pref("extensions.Softonic.prtnrid", "softonic");
Zeile gelöscht : user_pref("extensions.Softonic.radiomystations", "[{\"id\":\"1069\",\"name\":\"ORS Romántica en español\",\"url\":\"hxxp://www.orsradio.com/oldies56k.asx\",\"streamType\":\"mp\"},{\"id\":\"1213\",\"na[...]
Zeile gelöscht : user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search settings, Click No to restore original settings");
Zeile gelöscht : user_pref("extensions.Softonic.savedVrsnTs", "1");
Zeile gelöscht : user_pref("extensions.Softonic.sg", "az");
Zeile gelöscht : user_pref("extensions.Softonic.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.Softonic.smplgrp", "none");
Zeile gelöscht : user_pref("extensions.Softonic.srch", "");
Zeile gelöscht : user_pref("extensions.Softonic.srchprvdr", "");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrid", "base");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrsrchurl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=");
Zeile gelöscht : user_pref("extensions.Softonic.vrsn", "1.6.7.4");
Zeile gelöscht : user_pref("extensions.Softonic.vrsnTs", "1.6.7.419:01:44");
Zeile gelöscht : user_pref("extensions.Softonic.vrsni", "1.6.7.4");
Zeile gelöscht : user_pref("extensions.Softonic.vrsnts", "1.6.7.419:01:44");
Zeile gelöscht : user_pref("extensions.Softonic_i.newTab", false);
Zeile gelöscht : user_pref("extensions.Softonic_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.Softonic_i.vrsnTs", "1.6.7.419:01:44");
Zeile gelöscht : user_pref("extensions.iminent.admin", false);
Zeile gelöscht : user_pref("extensions.iminent.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.iminent.appId", "{0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}");
Zeile gelöscht : user_pref("extensions.iminent.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.iminent.dfltLng", "");
Zeile gelöscht : user_pref("extensions.iminent.excTlbr", false);
Zeile gelöscht : user_pref("extensions.iminent.ffxUnstlRst", false);
Zeile gelöscht : user_pref("extensions.iminent.id", "d2a4837e000000000000001aa099324c");
Zeile gelöscht : user_pref("extensions.iminent.instlDay", "16237");
Zeile gelöscht : user_pref("extensions.iminent.instlRef", "");
Zeile gelöscht : user_pref("extensions.iminent.newTab", false);
Zeile gelöscht : user_pref("extensions.iminent.prdct", "iminent");
Zeile gelöscht : user_pref("extensions.iminent.prtnrId", "iminent");
Zeile gelöscht : user_pref("extensions.iminent.rvrt", "false");
Zeile gelöscht : user_pref("extensions.iminent.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.iminent.tlbrId", "YBCPCSTIPO");
Zeile gelöscht : user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");
Zeile gelöscht : user_pref("extensions.iminent.vrsn", "1.8.28.3");
Zeile gelöscht : user_pref("extensions.iminent.vrsnTs", "1.8.28.322:00:14");
Zeile gelöscht : user_pref("extensions.iminent.vrsni", "1.8.28.3");
Zeile gelöscht : user_pref("iminent.adapters", "{\"start.iminent.com\":{\"CountryCode\":\"DE\",\"NoAds\":false,\"Status\":1,\"AdapterKey\":\"iminent\",\"v\":true,\"p\":0,\"t\":1,\"th\":0.228,\"expireTime\":\"140294952[...]
Zeile gelöscht : user_pref("iminent.trackingInfo", "{\"state\":0,\"samplingRate\":0}");

-\\ Google Chrome v35.0.1916.153

[ Datei : C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [10796 octets] - [19/06/2014 20:33:11]
AdwCleaner[S0].txt - [10618 octets] - [19/06/2014 20:33:36]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10679 octets] ##########

JRT.txt:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Kristin on 19.06.2014 at 20:49:51,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\Kristin\AppData\Roaming\mozilla\firefox\profiles\e4x2ivuo.default\minidumps [138 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.06.2014 at 20:53:02,53
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-06-2014
Ran by Kristin (administrator) on KRISTIN-PC on 19-06-2014 21:04:53
Running from C:\Users\Kristin\Desktop
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
(Nullsoft, Inc.) C:\Program Files\Winamp\winampa.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmsdmon.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
( ) C:\Windows\System32\lxdxcoms.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4452352 2007-05-02] (Realtek Semiconductor)
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [lxdxmon.exe] => C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe [672424 2010-02-04] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [WinampAgent] => C:\Program Files\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-06] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM\...\Run: [lxdxamon] => C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe [16040 2010-02-04] ()
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564528 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

SearchScopes: HKLM - DefaultScope value is missing.
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Rikaichan Japanese-German Dictionary File - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\rikaichan-jpde@polarcloud.com [2013-08-26]
FF Extension: Rikaichan - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2012-11-14]
FF Extension: Media Hint - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\mediahint@jetpack.xpi [2013-03-25]
FF Extension: Adblock Plus - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-22]
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-18]
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-06-19]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-18]

Chrome: 
=======
CHR HomePage: 
CHR StartupUrls: "hxxp://www.netflix.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Media Hint) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja [2013-11-10]
CHR Extension: (Google Docs) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-21]
CHR Extension: (Google Drive) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-21]
CHR Extension: (YouTube) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Adblock Plus) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-11]
CHR Extension: (Google-Suche) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (ZenMate) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2014-04-26]
CHR Extension: (AdBlock) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-06-15]
CHR Extension: (Norton Identity Safe for Google Chrome™) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-04-21]
CHR Extension: (Google Wallet) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-23]
CHR Extension: (Google Mail) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-21]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-25]

========================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2012-04-23] (Adobe Systems) [File not signed]
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-10-30] (Teruten) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxdx_device; C:\Windows\system32\lxdxcoms.exe [589824 2009-10-16] ( )
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-11] (Symantec Corporation)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-10-30] () [File not signed]
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140618.001\IDSvix86.sys [395992 2014-05-08] (Symantec Corporation)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140618.023\NAVENG.SYS [93272 2014-06-16] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140618.023\NAVEX15.SYS [1612376 2014-06-16] (Symantec Corporation)
S3 PID_0928; C:\Windows\System32\DRIVERS\LV561AV.SYS [495768 2009-04-30] (Logitech Inc.)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-18] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMTDIV.SYS [384728 2014-02-18] (Symantec Corporation)
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys [55232 2014-06-09] (StdLib)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
U2 wuaserv; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-19 20:56 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Desktop\FRST.exe
2014-06-19 20:53 - 2014-06-19 20:53 - 00000812 _____ () C:\Users\Kristin\Desktop\JRT.txt
2014-06-19 20:49 - 2014-06-19 20:49 - 00000000 ____D () C:\Windows\ERUNT
2014-06-19 20:45 - 2014-06-19 20:03 - 01016261 _____ (Thisisu) C:\Users\Kristin\Desktop\JRT.exe
2014-06-19 20:40 - 2014-06-19 20:40 - 00010760 _____ () C:\Users\Kristin\Desktop\AdwCleaner[S0].txt
2014-06-19 20:33 - 2014-06-19 20:41 - 00000000 ____D () C:\AdwCleaner
2014-06-19 20:32 - 2014-06-19 20:32 - 01333465 _____ () C:\Users\Kristin\Downloads\adwcleaner_3.212.exe
2014-06-19 20:32 - 2014-06-19 20:32 - 01333465 _____ () C:\Users\Kristin\Desktop\adwcleaner_3.212.exe
2014-06-19 20:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-06-19 20:25 - 2014-06-19 20:25 - 00012307 _____ () C:\Users\Kristin\Desktop\mbam.txt
2014-06-19 20:04 - 2014-06-19 20:04 - 00001059 _____ () C:\Users\Kristin\Desktop\Revo Uninstaller.lnk
2014-06-19 20:04 - 2014-06-19 20:04 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-19 20:03 - 2014-06-19 20:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kristin\Downloads\revosetup95.exe
2014-06-19 20:03 - 2014-06-19 20:03 - 01016261 _____ (Thisisu) C:\Users\Kristin\Downloads\JRT.exe
2014-06-19 19:20 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Desktop\defogger_disable.log
2014-06-19 18:55 - 2014-06-19 18:55 - 00003791 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malwarebytes-Protection.txt
2014-06-19 18:54 - 2014-06-19 18:54 - 00003872 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malwarebytes-Protection.txt
2014-06-19 17:54 - 2014-06-19 17:54 - 00007899 _____ () C:\Users\Kristin\Desktop\Gmer.txt
2014-06-19 17:34 - 2014-06-19 21:04 - 00018643 _____ () C:\Users\Kristin\Desktop\FRST.txt
2014-06-19 17:34 - 2014-06-19 17:34 - 00029137 _____ () C:\Users\Kristin\Desktop\Addition.txt
2014-06-19 17:32 - 2014-06-19 17:33 - 00029137 _____ () C:\Users\Kristin\Downloads\Addition.txt
2014-06-19 17:32 - 2014-06-19 17:32 - 00380416 _____ () C:\Users\Kristin\Downloads\Gmer-19357.exe
2014-06-19 17:31 - 2014-06-19 21:04 - 00000000 ____D () C:\FRST
2014-06-19 17:31 - 2014-06-19 17:33 - 00037489 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:24 - 2014-06-19 17:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-19 17:19 - 2014-06-19 18:54 - 00032744 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malwarebytes-Scan.txt
2014-06-19 16:47 - 2014-06-19 18:55 - 00002015 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malwarebytes-Scan.txt
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:05 - 2014-06-19 20:38 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:03 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 21:02 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-17 20:40 - 2014-06-09 12:15 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-16 23:37 - 2014-06-19 16:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-12 11:47 - 2014-06-12 11:48 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-12 10:18 - 2014-06-14 14:21 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 15:05 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 15:05 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 15:05 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 15:04 - 2014-05-28 18:48 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 15:04 - 2014-05-28 18:39 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 15:04 - 2014-05-28 18:38 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 15:04 - 2014-05-28 18:33 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 15:04 - 2014-05-28 18:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 15:04 - 2014-05-28 18:32 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 15:04 - 2014-05-28 18:30 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 15:04 - 2014-05-28 18:29 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-11 15:04 - 2014-05-28 18:29 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-11 15:04 - 2014-05-28 18:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 15:04 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe
2014-05-21 09:29 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

==================== One Month Modified Files and Folders =======

2014-06-19 21:05 - 2014-06-19 17:34 - 00018643 _____ () C:\Users\Kristin\Desktop\FRST.txt
2014-06-19 21:04 - 2014-06-19 17:31 - 00000000 ____D () C:\FRST
2014-06-19 20:53 - 2014-06-19 20:53 - 00000812 _____ () C:\Users\Kristin\Desktop\JRT.txt
2014-06-19 20:49 - 2014-06-19 20:49 - 00000000 ____D () C:\Windows\ERUNT
2014-06-19 20:47 - 2006-11-02 14:52 - 01600966 _____ () C:\Windows\WindowsUpdate.log
2014-06-19 20:44 - 2013-04-21 09:40 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-19 20:41 - 2014-06-19 20:33 - 00000000 ____D () C:\AdwCleaner
2014-06-19 20:40 - 2014-06-19 20:40 - 00010760 _____ () C:\Users\Kristin\Desktop\AdwCleaner[S0].txt
2014-06-19 20:38 - 2014-06-17 21:05 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-19 20:38 - 2012-04-29 19:48 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Skype
2014-06-19 20:36 - 2013-07-09 17:39 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-19 20:36 - 2013-04-21 09:39 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-19 20:36 - 2012-04-20 10:36 - 00196690 _____ () C:\Windows\PFRO.log
2014-06-19 20:36 - 2012-04-19 16:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-06-19 20:36 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-19 20:36 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-19 20:36 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-19 20:35 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-19 20:32 - 2014-06-19 20:32 - 01333465 _____ () C:\Users\Kristin\Downloads\adwcleaner_3.212.exe
2014-06-19 20:32 - 2014-06-19 20:32 - 01333465 _____ () C:\Users\Kristin\Desktop\adwcleaner_3.212.exe
2014-06-19 20:25 - 2014-06-19 20:25 - 00012307 _____ () C:\Users\Kristin\Desktop\mbam.txt
2014-06-19 20:04 - 2014-06-19 20:04 - 00001059 _____ () C:\Users\Kristin\Desktop\Revo Uninstaller.lnk
2014-06-19 20:04 - 2014-06-19 20:04 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-19 20:03 - 2014-06-19 20:45 - 01016261 _____ (Thisisu) C:\Users\Kristin\Desktop\JRT.exe
2014-06-19 20:03 - 2014-06-19 20:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kristin\Downloads\revosetup95.exe
2014-06-19 20:03 - 2014-06-19 20:03 - 01016261 _____ (Thisisu) C:\Users\Kristin\Downloads\JRT.exe
2014-06-19 19:35 - 2012-05-02 20:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-19 18:55 - 2014-06-19 18:55 - 00003791 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malwarebytes-Protection.txt
2014-06-19 18:55 - 2014-06-19 16:47 - 00002015 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malwarebytes-Scan.txt
2014-06-19 18:54 - 2014-06-19 18:54 - 00003872 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malwarebytes-Protection.txt
2014-06-19 18:54 - 2014-06-19 17:19 - 00032744 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malwarebytes-Scan.txt
2014-06-19 18:40 - 2012-04-23 10:19 - 00000000 ____D () C:\Program Files\Lexmark 3600-4600 Series
2014-06-19 17:54 - 2014-06-19 17:54 - 00007899 _____ () C:\Users\Kristin\Desktop\Gmer.txt
2014-06-19 17:37 - 2013-08-26 16:32 - 00000000 ____D () C:\Users\Kristin\AppData\Local\CrashDumps
2014-06-19 17:34 - 2014-06-19 17:34 - 00029137 _____ () C:\Users\Kristin\Desktop\Addition.txt
2014-06-19 17:33 - 2014-06-19 17:32 - 00029137 _____ () C:\Users\Kristin\Downloads\Addition.txt
2014-06-19 17:33 - 2014-06-19 17:31 - 00037489 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:32 - 2014-06-19 17:32 - 00380416 _____ () C:\Users\Kristin\Downloads\Gmer-19357.exe
2014-06-19 17:30 - 2014-06-19 20:56 - 01072128 _____ (Farbar) C:\Users\Kristin\Desktop\FRST.exe
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:28 - 2014-06-19 19:20 - 00000476 _____ () C:\Users\Kristin\Desktop\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:28 - 2012-04-19 14:37 - 00000000 ____D () C:\Users\Kristin
2014-06-19 17:24 - 2014-06-19 17:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-19 16:37 - 2014-06-16 23:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-17 21:25 - 2006-11-02 12:23 - 00000246 _____ () C:\Windows\win.ini
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-17 21:03 - 2014-06-17 21:02 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-16 22:09 - 2012-04-20 08:54 - 00000860 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-16 22:09 - 2012-04-20 08:54 - 00000848 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-16 22:03 - 2013-04-21 09:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-16 22:03 - 2012-04-23 10:05 - 00000000 ____D () C:\ProgramData\lx_Cats
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-06-16 22:03 - 2006-11-02 12:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-06-16 22:03 - 2006-11-02 12:22 - 25690112 _____ () C:\Windows\system32\config\system_previous
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-16 21:58 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-06-16 21:58 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-06-14 14:21 - 2014-06-12 10:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-12 12:21 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-12 11:48 - 2014-06-12 11:47 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-11 20:38 - 2012-04-23 09:39 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 20:32 - 2013-08-14 10:59 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 14:59 - 2012-05-28 18:15 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Winamp
2014-06-09 12:15 - 2014-06-17 20:40 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-01 17:18 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-30 17:12 - 2013-11-24 23:41 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\vlc
2014-05-30 11:55 - 2012-04-23 10:21 - 00010752 _____ () C:\Users\Kristin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-30 11:43 - 2013-03-24 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-28 18:48 - 2014-06-11 15:04 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-28 18:39 - 2014-06-11 15:04 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-28 18:38 - 2014-06-11 15:04 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-28 18:33 - 2014-06-11 15:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-28 18:32 - 2014-06-11 15:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-28 18:32 - 2014-06-11 15:04 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-28 18:30 - 2014-06-11 15:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-28 18:29 - 2014-06-11 15:04 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-28 18:29 - 2014-06-11 15:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-28 18:28 - 2014-06-11 15:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe
2014-05-25 21:31 - 2013-11-18 20:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-25 21:31 - 2012-04-20 10:50 - 00002215 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-05-25 21:31 - 2012-04-20 10:49 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-21 10:35 - 2012-05-02 20:27 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-21 10:35 - 2012-05-02 20:27 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-21 09:19 - 2012-04-29 20:41 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

Some content of TEMP:
====================
C:\Users\Kristin\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\ose00000.exe
C:\Users\Kristin\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Kristin\AppData\Local\Temp\vlc-2.1.3-win32.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-19 20:43

==================== End Of Log ============================

--- --- ---

Diesmal kam keine Addition.txt dazu.

Gruß, Simon.

schrauber · 20.06.2014, 18:58

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Shnoxxer · 21.06.2014, 20:50

ESET log

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=aec7d2d3dcb459428afb66df3ac0d6ce
# engine=18813
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-21 12:01:40
# local_time=2014-06-21 02:01:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Norton Internet Security'
# compatibility_mode=3597 16777213 100 100 56997 165948685 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 18150119 240884828 0 0
# scanned=32236
# found=5
# cleaned=0
# scan_time=1753
sh=75F4A06A0290B613622C7E10E3B05EE0525C1481 ft=1 fh=e7b99738d4ab1513 vn="MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\System Speedup\systweakasp.exe.vir"
sh=08A0C25B0BF40535697C1C584ACCDA490D6BC882 ft=1 fh=dbe7f66a50ce49ed vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kristin\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=ED4434617159FA464F6C82BB72400FC090C0785B ft=1 fh=9e5a83a29460e5f8 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\ToggleMark\bin\ToggleMark.BrowserAdapter.exe"
sh=4C76005CD7A6C3660D875C18C4BE0BF274C18D9A ft=1 fh=f916e70674ef2013 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\ToggleMark\bin\ToggleMarkBAApp.dll"
sh=8A2BEAC4847655855C698AECC4E153742A0C601F ft=1 fh=643d105b4a1e8510 vn="Variante von Win32/BrowseFox.K evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\ToggleMark\bin\{af16abf4-eac1-49b4-93fc-58f6ca799135}.dll"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=aec7d2d3dcb459428afb66df3ac0d6ce
# engine=18813
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-21 02:49:54
# local_time=2014-06-21 04:49:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Norton Internet Security'
# compatibility_mode=3597 16777213 100 100 67091 165958779 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 18160213 240894922 0 0
# scanned=400819
# found=66
# cleaned=0
# scan_time=9983
sh=75F4A06A0290B613622C7E10E3B05EE0525C1481 ft=1 fh=e7b99738d4ab1513 vn="MSIL/AdvancedSystemProtector.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\System Speedup\systweakasp.exe.vir"
sh=08A0C25B0BF40535697C1C584ACCDA490D6BC882 ft=1 fh=dbe7f66a50ce49ed vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Kristin\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
sh=ED4434617159FA464F6C82BB72400FC090C0785B ft=1 fh=9e5a83a29460e5f8 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\ToggleMark\bin\ToggleMark.BrowserAdapter.exe"
sh=4C76005CD7A6C3660D875C18C4BE0BF274C18D9A ft=1 fh=f916e70674ef2013 vn="Variante von Win32/BrowseFox.I evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\ToggleMark\bin\ToggleMarkBAApp.dll"
sh=8A2BEAC4847655855C698AECC4E153742A0C601F ft=1 fh=643d105b4a1e8510 vn="Variante von Win32/BrowseFox.K evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\ToggleMark\bin\{af16abf4-eac1-49b4-93fc-58f6ca799135}.dll"
sh=53562A24FA2B9695991DFA0FB01B3A42D5F0463D ft=1 fh=10d4a0be453efeb6 vn="Win32/AdWare.1ClickDownload.AR Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000"
sh=4832D3339EB300E408EA91236C6856C9CB1DAB65 ft=1 fh=be3798f42be81fe6 vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\File System\004\t\00\00000000"
sh=1443F87253DBC75722C98523AEF640A366C610DC ft=1 fh=e2409ef923535bce vn="Win32/DomaIQ.BJ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\File System\005\t\00\00000000"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Users\Kristin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LZN45U95\Setup[1].exe"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\ICReinstall_nsbCC1.tmp"
sh=939C16ADE15384AA65A71E9DD19E53ABBBDC344C ft=1 fh=96b3e5887a7711bf vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\ICReinstall_nsh403F.tmp"
sh=59A774F4B65159BB9D8EF396CF5D75B27C1A3CE4 ft=1 fh=f81ccf0897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\ICReinstall_nsi7F90.tmp"
sh=F827DFC9A4512D2272CD0472AC695EB2E7F5C9B9 ft=1 fh=9e562bc1a5b769d8 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\ICReinstall_nsk3276.tmp"
sh=CC381B031AD01B7A276C32C5914C3F284F1CF0B4 ft=1 fh=8e5cdad897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\ICReinstall_nsp81D.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\ICReinstall_nspC026.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\ICReinstall_nsxD0E7.tmp"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\nsbCC1.tmp"
sh=F827DFC9A4512D2272CD0472AC695EB2E7F5C9B9 ft=1 fh=9e562bc1a5b769d8 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\nsk3276.tmp"
sh=CC381B031AD01B7A276C32C5914C3F284F1CF0B4 ft=1 fh=8e5cdad897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\nsp81D.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\nspC026.tmp"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\is-5CQ5C.tmp\dm.exe"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\is-5GRB9.tmp\dm.exe"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\is-LENDB.tmp\dm.exe"
sh=A6016262D2739A16E163C74990B22C6D8C12AA4C ft=1 fh=16987cec724dc360 vn="Win32/VOPackage.J evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\AppData\Local\Temp\n4660\VOPackage.exe"
sh=EB13B3B9B71D14450D47979AB49E2D6CD6A2F01B ft=1 fh=3a7519cb14a880f9 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe"
sh=4832D3339EB300E408EA91236C6856C9CB1DAB65 ft=1 fh=be3798f42be81fe6 vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Kristin\Downloads\New player.exe"
sh=53562A24FA2B9695991DFA0FB01B3A42D5F0463D ft=1 fh=10d4a0be453efeb6 vn="Win32/AdWare.1ClickDownload.AR Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Google\Chrome\User Data\Default\File System\001\t\00\00000000"
sh=4832D3339EB300E408EA91236C6856C9CB1DAB65 ft=1 fh=be3798f42be81fe6 vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Google\Chrome\User Data\Default\File System\004\t\00\00000000"
sh=1443F87253DBC75722C98523AEF640A366C610DC ft=1 fh=e2409ef923535bce vn="Win32/DomaIQ.BJ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Google\Chrome\User Data\Default\File System\005\t\00\00000000"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Microsoft\Windows\Temporary Internet Files\Content.IE5\LZN45U95\Setup[1].exe"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\ICReinstall_nsbCC1.tmp"
sh=939C16ADE15384AA65A71E9DD19E53ABBBDC344C ft=1 fh=96b3e5887a7711bf vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\ICReinstall_nsh403F.tmp"
sh=59A774F4B65159BB9D8EF396CF5D75B27C1A3CE4 ft=1 fh=f81ccf0897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\ICReinstall_nsi7F90.tmp"
sh=F827DFC9A4512D2272CD0472AC695EB2E7F5C9B9 ft=1 fh=9e562bc1a5b769d8 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\ICReinstall_nsk3276.tmp"
sh=CC381B031AD01B7A276C32C5914C3F284F1CF0B4 ft=1 fh=8e5cdad897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\ICReinstall_nsp81D.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\ICReinstall_nspC026.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\ICReinstall_nsxD0E7.tmp"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\nsbCC1.tmp"
sh=F827DFC9A4512D2272CD0472AC695EB2E7F5C9B9 ft=1 fh=9e562bc1a5b769d8 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\nsk3276.tmp"
sh=CC381B031AD01B7A276C32C5914C3F284F1CF0B4 ft=1 fh=8e5cdad897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\nsp81D.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\nspC026.tmp"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\is-5CQ5C.tmp\dm.exe"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\is-5GRB9.tmp\dm.exe"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\is-LENDB.tmp\dm.exe"
sh=A6016262D2739A16E163C74990B22C6D8C12AA4C ft=1 fh=16987cec724dc360 vn="Win32/VOPackage.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Anwendungsdaten\Temp\n4660\VOPackage.exe"
sh=0D43B6D95B001D350909EE01A1D533E4EA2C366F ft=0 fh=0000000000000000 vn="Variante von Win32/Packed.Themida evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Downloaded Installations\{0066D73C-19D9-448A-8EFF-B1AE8C869656}\Movavi VideoSuite 5.msi"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\AppData\Local\Temporary Internet Files\Content.IE5\LZN45U95\Setup[1].exe"
sh=53562A24FA2B9695991DFA0FB01B3A42D5F0463D ft=1 fh=10d4a0be453efeb6 vn="Win32/AdWare.1ClickDownload.AR Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Google\Chrome\User Data\Default\File System\001\t\00\00000000"
sh=4832D3339EB300E408EA91236C6856C9CB1DAB65 ft=1 fh=be3798f42be81fe6 vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Google\Chrome\User Data\Default\File System\004\t\00\00000000"
sh=1443F87253DBC75722C98523AEF640A366C610DC ft=1 fh=e2409ef923535bce vn="Win32/DomaIQ.BJ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Google\Chrome\User Data\Default\File System\005\t\00\00000000"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Microsoft\Windows\Temporary Internet Files\Content.IE5\LZN45U95\Setup[1].exe"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\ICReinstall_nsbCC1.tmp"
sh=939C16ADE15384AA65A71E9DD19E53ABBBDC344C ft=1 fh=96b3e5887a7711bf vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\ICReinstall_nsh403F.tmp"
sh=59A774F4B65159BB9D8EF396CF5D75B27C1A3CE4 ft=1 fh=f81ccf0897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\ICReinstall_nsi7F90.tmp"
sh=F827DFC9A4512D2272CD0472AC695EB2E7F5C9B9 ft=1 fh=9e562bc1a5b769d8 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\ICReinstall_nsk3276.tmp"
sh=CC381B031AD01B7A276C32C5914C3F284F1CF0B4 ft=1 fh=8e5cdad897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\ICReinstall_nsp81D.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\ICReinstall_nspC026.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\ICReinstall_nsxD0E7.tmp"
sh=20C022F3512AC3D85E25209FD1755A71D417F7F0 ft=1 fh=0b9c7452f993757c vn="Variante von Win32/Injected.F Trojaner" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\nsbCC1.tmp"
sh=F827DFC9A4512D2272CD0472AC695EB2E7F5C9B9 ft=1 fh=9e562bc1a5b769d8 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\nsk3276.tmp"
sh=CC381B031AD01B7A276C32C5914C3F284F1CF0B4 ft=1 fh=8e5cdad897876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\nsp81D.tmp"
sh=FC77FEE903A4AFAE3DB7A5F733703E1BFD078486 ft=1 fh=ea57cd2e97876b90 vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\nspC026.tmp"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\is-5CQ5C.tmp\dm.exe"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\is-5GRB9.tmp\dm.exe"
sh=D738AA141A5CFB351D5760B703CA265CCA939D74 ft=1 fh=fd26318b1e1ec5c3 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\is-LENDB.tmp\dm.exe"
sh=A6016262D2739A16E163C74990B22C6D8C12AA4C ft=1 fh=16987cec724dc360 vn="Win32/VOPackage.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows.old\Users\Kristin\Lokale Einstellungen\Temp\n4660\VOPackage.exe"

SecurityCheck

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.83  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
Norton Internet Security   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 55  
 Java(TM) SE Runtime Environment 6 
 Adobe Flash Player 	13.0.0.214  
 Mozilla Firefox (30.0) 
 Google Chrome 35.0.1916.114  
 Google Chrome 35.0.1916.153  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-06-2014 01
Ran by Kristin (administrator) on KRISTIN-PC on 21-06-2014 21:42:11
Running from C:\Users\Kristin\Desktop\Trojaner-Board
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
(Nullsoft, Inc.) C:\Program Files\Winamp\winampa.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmsdmon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
( ) C:\Windows\System32\lxdxcoms.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4452352 2007-05-02] (Realtek Semiconductor)
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [lxdxmon.exe] => C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe [672424 2010-02-04] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [WinampAgent] => C:\Program Files\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-06] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM\...\Run: [lxdxamon] => C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe [16040 2010-02-04] ()
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564528 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9136161D638DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Rikaichan Japanese-German Dictionary File - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\rikaichan-jpde@polarcloud.com [2013-08-26]
FF Extension: Rikaichan - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2012-11-14]
FF Extension: Media Hint - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\mediahint@jetpack.xpi [2013-03-25]
FF Extension: Adblock Plus - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-22]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-04-19]
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-06-21]
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-18]

Chrome: 
=======
CHR HomePage: 
CHR StartupUrls: "hxxp://www.netflix.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Media Hint) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja [2013-11-10]
CHR Extension: (Google Docs) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-21]
CHR Extension: (Google Drive) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-21]
CHR Extension: (YouTube) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Adblock Plus) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-11]
CHR Extension: (Google-Suche) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (ZenMate) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2014-04-26]
CHR Extension: (AdBlock) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-06-15]
CHR Extension: (Norton Identity Safe for Google Chrome™) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-04-21]
CHR Extension: (Google Wallet) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-23]
CHR Extension: (Google Mail) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-21]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-25]

========================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2012-04-23] (Adobe Systems) [File not signed]
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-10-30] (Teruten) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxdx_device; C:\Windows\system32\lxdxcoms.exe [589824 2009-10-16] ( )
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-11] (Symantec Corporation)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-10-30] () [File not signed]
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140620.001\IDSvix86.sys [395992 2014-05-08] (Symantec Corporation)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-21] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140620.009\NAVENG.SYS [93272 2014-06-16] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140620.009\NAVEX15.SYS [1612376 2014-06-16] (Symantec Corporation)
S3 PID_0928; C:\Windows\System32\DRIVERS\LV561AV.SYS [495768 2009-04-30] (Logitech Inc.)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-18] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMTDIV.SYS [384728 2014-02-18] (Symantec Corporation)
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys [55232 2014-06-09] (StdLib)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
U2 wuaserv; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-21 21:27 - 2014-06-21 21:27 - 00854367 _____ () C:\Users\Kristin\Downloads\SecurityCheck.exe
2014-06-20 21:26 - 2014-06-20 21:26 - 00000000 ____D () C:\Program Files\ESET
2014-06-20 21:22 - 2014-06-21 21:26 - 02347384 _____ (ESET) C:\Users\Kristin\Downloads\esetsmartinstaller_deu.exe
2014-06-19 22:53 - 2014-06-21 21:42 - 00000000 ____D () C:\Users\Kristin\Desktop\Trojaner-Board
2014-06-19 20:49 - 2014-06-19 20:49 - 00000000 ____D () C:\Windows\ERUNT
2014-06-19 20:33 - 2014-06-19 20:41 - 00000000 ____D () C:\AdwCleaner
2014-06-19 20:32 - 2014-06-19 20:32 - 01333465 _____ () C:\Users\Kristin\Downloads\adwcleaner_3.212.exe
2014-06-19 20:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-06-19 20:04 - 2014-06-19 20:04 - 00001059 _____ () C:\Users\Kristin\Desktop\Revo Uninstaller.lnk
2014-06-19 20:04 - 2014-06-19 20:04 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-19 20:03 - 2014-06-19 20:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kristin\Downloads\revosetup95.exe
2014-06-19 20:03 - 2014-06-19 20:03 - 01016261 _____ (Thisisu) C:\Users\Kristin\Downloads\JRT.exe
2014-06-19 17:32 - 2014-06-19 17:33 - 00029137 _____ () C:\Users\Kristin\Downloads\Addition.txt
2014-06-19 17:32 - 2014-06-19 17:32 - 00380416 _____ () C:\Users\Kristin\Downloads\Gmer-19357.exe
2014-06-19 17:31 - 2014-06-21 21:42 - 00000000 ____D () C:\FRST
2014-06-19 17:31 - 2014-06-19 17:33 - 00037489 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:24 - 2014-06-19 17:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:05 - 2014-06-21 16:33 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-21 14:36 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 21:02 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-17 20:40 - 2014-06-09 12:15 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-16 23:37 - 2014-06-19 16:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-12 11:47 - 2014-06-12 11:48 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-12 10:18 - 2014-06-14 14:21 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 15:05 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 15:05 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 15:05 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 15:04 - 2014-05-28 18:48 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 15:04 - 2014-05-28 18:39 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 15:04 - 2014-05-28 18:38 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 15:04 - 2014-05-28 18:33 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 15:04 - 2014-05-28 18:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 15:04 - 2014-05-28 18:32 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 15:04 - 2014-05-28 18:30 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 15:04 - 2014-05-28 18:29 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-11 15:04 - 2014-05-28 18:29 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-11 15:04 - 2014-05-28 18:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 15:04 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe

==================== One Month Modified Files and Folders =======

2014-06-21 21:42 - 2014-06-19 22:53 - 00000000 ____D () C:\Users\Kristin\Desktop\Trojaner-Board
2014-06-21 21:42 - 2014-06-19 17:31 - 00000000 ____D () C:\FRST
2014-06-21 21:35 - 2012-05-02 20:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-21 21:27 - 2014-06-21 21:27 - 00854367 _____ () C:\Users\Kristin\Downloads\SecurityCheck.exe
2014-06-21 21:26 - 2014-06-20 21:22 - 02347384 _____ (ESET) C:\Users\Kristin\Downloads\esetsmartinstaller_deu.exe
2014-06-21 21:26 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-21 21:26 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-21 21:17 - 2013-04-21 09:40 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-21 21:17 - 2006-11-02 14:52 - 01634738 _____ () C:\Windows\WindowsUpdate.log
2014-06-21 19:44 - 2013-04-21 09:39 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-21 16:33 - 2014-06-17 21:05 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-21 14:36 - 2014-06-17 21:02 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-21 14:36 - 2012-04-23 10:19 - 00000000 ____D () C:\Program Files\Lexmark 3600-4600 Series
2014-06-21 13:28 - 2012-04-29 19:48 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Skype
2014-06-21 13:26 - 2012-04-20 10:36 - 00197282 _____ () C:\Windows\PFRO.log
2014-06-21 13:26 - 2012-04-19 16:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-06-21 13:26 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-20 22:46 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-20 21:26 - 2014-06-20 21:26 - 00000000 ____D () C:\Program Files\ESET
2014-06-19 21:58 - 2013-06-04 14:04 - 00000000 ____D () C:\Program Files\Steam
2014-06-19 20:49 - 2014-06-19 20:49 - 00000000 ____D () C:\Windows\ERUNT
2014-06-19 20:41 - 2014-06-19 20:33 - 00000000 ____D () C:\AdwCleaner
2014-06-19 20:36 - 2013-07-09 17:39 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-19 20:32 - 2014-06-19 20:32 - 01333465 _____ () C:\Users\Kristin\Downloads\adwcleaner_3.212.exe
2014-06-19 20:04 - 2014-06-19 20:04 - 00001059 _____ () C:\Users\Kristin\Desktop\Revo Uninstaller.lnk
2014-06-19 20:04 - 2014-06-19 20:04 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-06-19 20:03 - 2014-06-19 20:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Kristin\Downloads\revosetup95.exe
2014-06-19 20:03 - 2014-06-19 20:03 - 01016261 _____ (Thisisu) C:\Users\Kristin\Downloads\JRT.exe
2014-06-19 17:37 - 2013-08-26 16:32 - 00000000 ____D () C:\Users\Kristin\AppData\Local\CrashDumps
2014-06-19 17:33 - 2014-06-19 17:32 - 00029137 _____ () C:\Users\Kristin\Downloads\Addition.txt
2014-06-19 17:33 - 2014-06-19 17:31 - 00037489 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:32 - 2014-06-19 17:32 - 00380416 _____ () C:\Users\Kristin\Downloads\Gmer-19357.exe
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:28 - 2012-04-19 14:37 - 00000000 ____D () C:\Users\Kristin
2014-06-19 17:24 - 2014-06-19 17:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-19 16:37 - 2014-06-16 23:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-17 21:25 - 2006-11-02 12:23 - 00000246 _____ () C:\Windows\win.ini
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-16 22:09 - 2012-04-20 08:54 - 00000860 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-16 22:09 - 2012-04-20 08:54 - 00000848 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-16 22:03 - 2013-04-21 09:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-16 22:03 - 2012-04-23 10:05 - 00000000 ____D () C:\ProgramData\lx_Cats
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-06-16 22:03 - 2006-11-02 12:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-06-16 22:03 - 2006-11-02 12:22 - 25690112 _____ () C:\Windows\system32\config\system_previous
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-16 21:58 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-06-16 21:58 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-06-14 14:21 - 2014-06-12 10:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-12 12:21 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-12 11:48 - 2014-06-12 11:47 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-11 20:38 - 2012-04-23 09:39 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 20:32 - 2013-08-14 10:59 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 14:59 - 2012-05-28 18:15 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Winamp
2014-06-09 12:15 - 2014-06-17 20:40 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-01 17:18 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-30 17:12 - 2013-11-24 23:41 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\vlc
2014-05-30 11:55 - 2012-04-23 10:21 - 00010752 _____ () C:\Users\Kristin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-30 11:43 - 2013-03-24 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-28 18:48 - 2014-06-11 15:04 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-28 18:39 - 2014-06-11 15:04 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-28 18:38 - 2014-06-11 15:04 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-28 18:33 - 2014-06-11 15:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-28 18:32 - 2014-06-11 15:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-28 18:32 - 2014-06-11 15:04 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-28 18:30 - 2014-06-11 15:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-28 18:29 - 2014-06-11 15:04 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-28 18:29 - 2014-06-11 15:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-28 18:28 - 2014-06-11 15:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe
2014-05-25 21:31 - 2013-11-18 20:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-25 21:31 - 2012-04-20 10:50 - 00002215 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-05-25 21:31 - 2012-04-20 10:49 - 00000000 ____D () C:\Windows\system32\Drivers\NIS

Some content of TEMP:
====================
C:\Users\Kristin\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\ose00000.exe
C:\Users\Kristin\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Kristin\AppData\Local\Temp\vlc-2.1.3-win32.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-21 13:35

==================== End Of Log ============================

--- --- ---

--- --- ---

Soweit sind keine Probleme mehr aufgetreten.

schrauber · 22.06.2014, 07:06

Ordner Windows.old löschen

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Shnoxxer · 26.06.2014, 09:09

Alles erledigt und soweit auch keine Probleme mehr.
Vielen Dank!

schrauber · 27.06.2014, 07:15

Gern Geschehen

27.06.2014, 07:15	#8
schrauber /// the machine /// TB-Ausbilder	Windows Vista: System Speedup Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows Vista: System Speedup

Log-Analyse und Auswertung: Windows Vista: System Speedup