Windows 7: Es poppen neue Tabs auf und fordern zur Installation auf.

prichert

Hallo,

meine Frau hat nach einem Lied für ihren Unterricht gesucht. Dabei ist sie auf ein kostenlosen Download des Liedes gestoßen. Jetzt wissen wir auch warum das Angebot kostenlos war ... Beim Versuch das Lied downzuloaden hat sie sich wohl einen Virus/Trojaner installiert.
Seitdem poppen in Abständen von ca. 15 Minuten neue Tabs in Firefox auf und machen Werbung für irgendwelche Dating-Webseiten oder fordern auf irgendwelche Programme zu installieren.
Ich hoffe, dass mir hier im Forum jemand helfen kann.
Ich habe noch nicht soviel Erfahrung bzgl. Trojanerbekämpfung und hoffe, dass ich alle Logfiles richtig poste...

Gruß,
Peter

Hier meine Logfiles:

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-06-2014
Ran by Loni ***** at 2014-06-25 19:28:12
Running from C:\Users\Loni *****\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: ZoneAlarm Antivirus (Enabled - Up to date) {23B6D20A-C2DE-B3F5-C67D-07ECD854E6A9}
AS: ZoneAlarm Anti-Spyware (Enabled - Up to date) {98D733EE-E4E4-BC7B-FCCD-3C9EA3D3AC14}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Firewall (Enabled) {1B8D532F-88B1-B2AD-ED22-AED92687A1D2}

==================== Installed Programs ======================

1ClickDownload (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - 1ClickDownload)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.0.19530 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.7.0.19530 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.615 - Adobe Systems, Inc.)
Allgemeine Runtime Files (x86) (HKLM\...\{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1) (Version: 1.0.3.2 - Sereby Corporation)
Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.3.0.422 - Amazon Services LLC)
Amazon MP3-Downloader 1.0.9 (HKLM-x32\...\Amazon MP3-Downloader) (Version: - )
Amazon Music Importer (HKLM-x32\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC)
Amazon Music Importer (x32 Version: 2.1.0 - Amazon Services LLC) Hidden
Amazon PriceWatcher 2.1.3 (HKLM-x32\...\Amazon PriceWatcher) (Version: 2.1.3 - OrangeBlue)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Client Installation Program (HKLM-x32\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.2.1119 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{F8FEEFC0-D7D6-9A40-28E9-1E7A6716E803}) (Version: 3.0.774.0 - ATI Technologies, Inc.)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4487 - APN, LLC)
BatteryLifeExtender (HKLM-x32\...\{08B67A13-8501-48CB-B747-9D413BDC4594}) (Version: 1.0.3 - Samsung)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.44 - Broadcom Corporation)
Brother MFL-Pro Suite DCP-145C (HKLM-x32\...\{48D082B9-18F6-4426-AFAC-8B6A3E7021B1}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - )
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
Canon MG4100 series Benutzerregistrierung (HKLM-x32\...\Canon MG4100 series Benutzerregistrierung) (Version: - )
Canon MG4100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4100_series) (Version: - )
Canon MG4100 series On-screen Manual (HKLM-x32\...\Canon MG4100 series On-screen Manual) (Version: - )
Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0504.2152.37420 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help English (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help French (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help German (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0504.2151.37420 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0504.2152.37420 - ATI) Hidden
ccc-utility64 (Version: 2010.0504.2152.37420 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3911 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 2.0.3911 - CyberLink Corp.) Hidden
DirectX 9.0c Extra Files (x86, x64) (HKLM\...\{8729E65B-8C12-4A42-B1FE-E4DA7ED52855}_is1) (Version: 1.10.06.0 - Sereby Corporation)
DirectX for Managed Code (HKLM\...\{FDF7187F-3960-4BEC-916D-98C9A83E3A68}_is1) (Version: 1.0.0.0 - Sereby Corporation)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Easy Content Share (HKLM-x32\...\{2DDC70C1-C77A-4D08-89D2-9AB648504533}) (Version: 1.0.0.13 - Samsung Electronics Co., LTD)
Easy Display Manager (HKLM-x32\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.1 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM-x32\...\{F771F1D4-EDD4-4D68-82DC-811583C099CD}) (Version: 4.3.1 - Samsung)
Easy SpeedUp Manager (HKLM-x32\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.1.0.11 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM-x32\...\{4A331D24-A9E8-484F-835E-1BA7B139689C}) (Version: 4.0.0.4 - Samsung)
EasyFileShare (HKLM-x32\...\{C4582EED-A3FB-4358-8F3F-8C994460DF28}) (Version: 1.0.3 - Samsung)
ETDWare PS/2-x64 7.0.7.0_WHQL (HKLM\...\Elantech) (Version: 7.0.7.0 - ELAN Microelectronics Corp.)
Filzip 3.06 (HKLM-x32\...\Filzip 3.0.6.93_is1) (Version: 3.0.6 - Philipp Engel)
Finale Viewer (HKLM-x32\...\Finale Viewer) (Version: 2011.0.4001.0 - MakeMusic)
Free Audio Converter version 5.0.37.327 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.37.327 - DVDVideoSoft Ltd.)
Free YouTube Download version 2.10.33.324 (HKLM-x32\...\Free YouTube Download_is1) (Version: - DVDVideoSoft Limited.)
fst_de_56 (HKLM-x32\...\fst_de_56_is1) (Version: - FREE_SOFT_TODAY) <==== ATTENTION
fst_de_60 (HKLM-x32\...\fst_de_60_is1) (Version: - FREE_SOFTTODAY) <==== ATTENTION
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
GoforFiles (HKCU\...\GoforFiles) (Version: 3.14.25 - hxxp://www.gofor-files.net/) <==== ATTENTION
Installer (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.3.1001 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.02.00.1002 - Intel Corporation)
iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416022FF}) (Version: 6.0.220 - Oracle)
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Marvell Miniport Driver (HKLM-x32\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50917.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (HKLM-x32\...\Microsoft Visual J# 2.0 Redistributable Package) (Version: - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (x32 Version: 2.0.50727 - Microsoft Corporation) Hidden
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MULTiTEXT (HKLM\...\MULTiTEXT_is1) (Version: 2012.06.0.2 - HINDELANG-Software)
Musicnotes Software Suite 1.7.2 (HKLM-x32\...\Musicnotes Combined Installer_is1) (Version: 1.7.2 - Musicnotes Inc.)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.13580 - Symantec Corporation)
PaMina e-version (HKLM-x32\...\at.helbling.eversion.pamina) (Version: 1.0 - Helbling Verlag Gmbh)
PaMina e-version (x32 Version: 1.0 - Helbling Verlag Gmbh) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.5.0 - Frank Heindörfer, Philip Chinery)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6083 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Software (HKLM-x32\...\{0F796312-289C-40CA-856C-9FBCF5E83342}) (Version: 0133.09.1202 - REALTEK Semiconductor Corp.)
Samsung Recovery Solution 4 (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung)
Samsung Support Center (HKLM-x32\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.0.2 - Samsung)
Samsung Update Plus (HKLM-x32\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
Schroedel Arbeitsblätter (HKLM-x32\...\Schroedel Arbeitsblätter) (Version: - )
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.3.38 - Client Connect LTD) <==== ATTENTION
Skype™ 4.2 (HKLM-x32\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: 4.2.155 - Skype Technologies S.A.)
Speedial (HKCU\...\Speedial) (Version: - Speedial) <==== ATTENTION
SWF Opener (HKLM-x32\...\{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1) (Version: 1.3 - UnH Solutions)
TowerTilt (HKLM\...\TowerTilt) (Version: 2014.06.22.181121 - TowerTilt)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version: - )
User Guide (HKLM-x32\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
Visual C++ 2008 x64 Runtime - (v9.0.30729.5026) (x32 Version: 9.0.30729.5026 - Microsoft Corporation) Hidden
Visual C++ 2008 x64 Runtime - v9.0.30729.5026 (HKLM-x32\...\{0FB0306C-11D8-35F2-9AC9-121FA753F9AD}.vc_x64runtime_30729_5026) (Version: 9.0.30729.5026 - Microsoft Corporation)
Visual C++ 2008 x86 Runtime - (v9.0.30729.5026) (x32 Version: 9.0.30729.5026 - Microsoft Corporation) Hidden
Visual C++ 2008 x86 Runtime - v9.0.30729.5026 (HKLM-x32\...\{E04ACCBC-DF36-364E-87E8-6C24BB981AB8}.vc_x86runtime_30729_5026) (Version: 9.0.30729.5026 - Microsoft Corporation)
webssearches uninstall (HKLM-x32\...\webssearches uninstall) (Version: - webssearches) <==== ATTENTION
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WindowsProtectManger20.0.0.401 (HKLM-x32\...\WindowsProtectManger) (Version: 20.0.0.401 - Fuyu LIMITED) <==== ATTENTION
ZoneAlarm Antivirus (x32 Version: 13.2.015.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (x32 Version: 13.2.015.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Antivirus + Firewall (HKLM-x32\...\ZoneAlarm Free Antivirus + Firewall) (Version: 13.2.015.000 - Check Point)
ZoneAlarm Security (x32 Version: 13.2.015.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Security Toolbar (HKCU\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)
ZoneAlarm Security Toolbar (HKLM-x32\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)

==================== Restore Points =========================

03-06-2014 21:38:34 Geplanter Prüfpunkt
12-06-2014 21:53:00 Windows Update
20-06-2014 21:53:39 Geplanter Prüfpunkt
22-06-2014 16:06:35 Installed iTunes

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {09DE3527-BE9C-449D-92BE-A051DDD66104} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {0A9F4188-FAE6-4F6E-9686-B4F3E54C96D4} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {136E17BD-DA71-48CD-BCD2-915ED6EB83AC} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2288ED38-9A34-46E0-9641-6F49AC52E592} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-13] (Adobe Systems Incorporated)
Task: {2812C6B9-BCB3-4D2A-BEE7-DBDC04D36F97} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {6510C24C-3709-49FD-B7AF-9DA29300014C} - System32\Tasks\BlockAndSurf_wd => C:\Program Files (x86)\-BlockAndSurfS\BlockAndSurfm.exe <==== ATTENTION
Task: {744E27C0-ACF2-4132-870A-E97B0712CBA1} - System32\Tasks\Speedial => C:\Users\Loni *****\AppData\Roaming\Speedial\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {7A897247-C606-4C9B-AE32-50C754D4E84E} - System32\Tasks\GoforFilesUpdate => C:\Program Files (x86)\GoforFiles Updater\GFFUpdater.exe <==== ATTENTION
Task: {84E9B2A6-5D55-451D-9231-1D79BB533CCA} - System32\Tasks\BlockAndSurf Update => C:\Program Files (x86)\-BlockAndSurfS\BlockAndSurfq07.exe <==== ATTENTION
Task: {8813E5D3-87AE-4768-B14F-387BD05ACF8D} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2010-05-06] (SAMSUNG Electronics)
Task: {ADC02462-9261-4FB5-8969-5ACB4CF8B5F7} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {B3038D87-CE94-422A-9FDC-9D893BB5CEE3} - System32\Tasks\advSRS4 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2010-01-19] (SEC)
Task: {CD819A81-4C92-4F0E-9242-D3431D89ACF4} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-05-06] (Samsung Electronics)
Task: {D68D72DB-5BC6-4ADF-B9DF-509CA46A1028} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
Task: {D7124D21-9D3D-430E-9095-5CA5C98AB530} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-04-17] (Samsung Electronics. Co. Ltd.)
Task: {D774F9DD-6A0C-478D-A6E1-DF1734E28C67} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
Task: {F56B76B9-95E0-47F8-8A07-72DDB540B015} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-04-07] (Samsung Electronics Co., Ltd.)
Task: {F9CE13F9-8BA6-4A7A-9512-FC0F318C1BB5} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-03-29] (SAMSUNG Electronics co., LTD.)
Task: {FE8C4C69-B791-4E4E-9A72-23EC961E70A1} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\Speedial.job => C:\Users\LONIRI~1\AppData\Roaming\Speedial\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2012-09-03 20:54 - 2011-02-07 09:56 - 00138192 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2010-06-01 03:04 - 2009-03-05 11:54 - 00311296 _____ () C:\Windows\SysWOW64\Rezip.exe
2014-06-22 20:11 - 2014-06-25 16:47 - 00317728 _____ () C:\Program Files (x86)\TowerTilt\updateTowerTilt.exe
2014-06-22 22:52 - 2014-06-25 06:14 - 00317728 _____ () C:\Program Files (x86)\TowerTilt\bin\utilTowerTilt.exe
2014-05-20 11:18 - 2014-05-20 11:18 - 00053248 _____ () C:\Users\Loni *****\AppData\Roaming\VOPackage\VOsrv.exe
2014-06-23 08:14 - 2014-06-20 16:32 - 03356656 _____ () C:\Users\Loni *****\AppData\Local\fst_de_56\upfst_de_56.exe
2014-02-17 18:18 - 2014-01-14 21:46 - 03140608 _____ () C:\Users\Loni *****\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
2014-06-23 08:14 - 2014-06-20 16:32 - 03979760 _____ () C:\Program Files (x86)\fst_de_56\fst_de_56.exe
2014-06-25 17:15 - 2014-06-23 11:33 - 03979760 _____ () C:\Program Files (x86)\fst_de_60\fst_de_60.exe
2009-02-12 07:32 - 2009-02-12 07:32 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-06-01 03:01 - 2010-06-01 03:01 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-01-27 16:43 - 2014-01-27 16:43 - 00065936 _____ () C:\Program Files (x86)\CheckPoint\ZoneAlarm\Community.CsharpSqlite.SQLiteClient.dll
2014-06-25 19:12 - 2014-06-25 19:12 - 00043008 _____ () c:\Users\Loni *****\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpx0cnc3.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\libcef.dll
2010-11-12 12:15 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2011-05-09 19:11 - 2014-06-16 19:14 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-05-13 23:21 - 2014-05-13 23:21 - 16361136 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:2430E4FC

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============

Name: avkmgr
Description: avkmgr
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: avkmgr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: avipbb
Description: avipbb
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: avipbb
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/25/2014 07:12:25 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:12:25.695]: [00003144]: Initialize TwdsMain Class failed!

Error: (06/25/2014 07:12:25 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:12:25.695]: [00003144]: ##### Fatal ERROR!! Create STI-device failed! #####

Error: (06/25/2014 07:12:25 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:12:25.695]: [00003144]: GetDeviceList Failed! pStiInfo = 0x0..

Error: (06/25/2014 07:12:23 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:12:23.870]: [00003144]: Initialize TwdsMain Class failed!

Error: (06/25/2014 07:12:23 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:12:23.870]: [00003144]: ##### Fatal ERROR!! Create STI-device failed! #####

Error: (06/25/2014 07:12:23 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:12:23.854]: [00003144]: GetDeviceList Failed! pStiInfo = 0x0..

Error: (06/25/2014 07:11:57 PM) (Source: Schedule) (EventID: 0) (User: )
Description: Schedule error: 10106Initialize call failed, bailing out

Error: (06/25/2014 07:09:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x84c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (06/25/2014 07:04:04 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:04:04.421]: [00003804]: Initialize TwdsMain Class failed!

Error: (06/25/2014 07:04:04 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: TWN BrtTWN: [2014/06/25 19:04:04.421]: [00003804]: ##### Fatal ERROR!! Create STI-device failed! #####


System errors:
=============
Error: (06/25/2014 07:14:20 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Update" wurde mit folgendem Fehler beendet:
%%-2147014790

Error: (06/25/2014 07:14:17 PM) (Source: WMPNetworkSvc) (EventID: 14348) (User: )
Description: 0x80070057

Error: (06/25/2014 07:14:17 PM) (Source: WMPNetworkSvc) (EventID: 14323) (User: )
Description: WMPNetworkSvc0xc00d4268

Error: (06/25/2014 07:14:17 PM) (Source: WMPNetworkSvc) (EventID: 14356) (User: )
Description: 0x80070057

Error: (06/25/2014 07:14:17 PM) (Source: WMPNetworkSvc) (EventID: 14323) (User: )
Description: WMPNetworkSvc0xc00d4268

Error: (06/25/2014 07:14:17 PM) (Source: WMPNetworkSvc) (EventID: 14323) (User: )
Description: WMPNetworkSvc0xc00d4268

Error: (06/25/2014 07:14:09 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147014790.

Error: (06/25/2014 07:14:09 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16392) (User: NT-AUTORITÄT)
Description: Fehler beim Starten des BITS-Dienstes. Fehler: 2147952506.

Error: (06/25/2014 07:12:13 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10106

Error: (06/25/2014 07:12:11 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10106


Microsoft Office Sessions:
=========================
Error: (01/07/2014 06:23:02 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 196 seconds with 180 seconds of active time. This session ended with a crash.

Error: (09/25/2013 00:58:50 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 59 seconds with 0 seconds of active time. This session ended with a crash.

Error: (09/25/2013 00:57:34 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 20 seconds with 0 seconds of active time. This session ended with a crash.

Error: (09/25/2013 00:57:06 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 8713 seconds with 1680 seconds of active time. This session ended with a crash.

Error: (06/26/2012 09:40:35 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 951 seconds with 900 seconds of active time. This session ended with a crash.

Error: (05/18/2012 08:47:09 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 14 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/18/2012 08:46:42 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 135 seconds with 120 seconds of active time. This session ended with a crash.

Error: (01/21/2012 06:00:34 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 22758 seconds with 6720 seconds of active time. This session ended with a crash.

Error: (11/23/2010 00:46:13 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3923 seconds with 1140 seconds of active time. This session ended with a crash.


==================== Memory info ===========================

Percentage of memory in use: 52%
Total physical RAM: 3946.12 MB
Available physical RAM: 1874.65 MB
Total Pagefile: 7890.41 MB
Available Pagefile: 5571.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:112 GB) (Free:12.72 GB) NTFS
Drive d: () (Fixed) (Total:165.99 GB) (Free:165.88 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 4394EB81)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=166 GB) - (Type=OF Extended)

==================== End Of Log ============================


defogger_disable.txt

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:24 on 25/06/2014 (Loni *****

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-06-2014
Ran by Loni *****(administrator) on LONISPC on 25-06-2014 19:26:02
Running from C:\Users\Loni *****\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(AMD) C:\Windows\System32\atieclxx.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
() C:\Windows\SysWOW64\Rezip.exe
() C:\Program Files (x86)\TowerTilt\updateTowerTilt.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
() C:\Program Files (x86)\TowerTilt\bin\utilTowerTilt.exe
() C:\Users\Loni *****\AppData\Roaming\VOPackage\VOsrv.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
() C:\Users\Loni *****\AppData\Local\fst_de_56\upfst_de_56.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
() C:\Users\Loni *****\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Dropbox, Inc.) C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
() C:\Program Files (x86)\fst_de_56\fst_de_56.exe
() C:\Program Files (x86)\fst_de_60\fst_de_60.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-07] (Realtek Semiconductor)
HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [2703752 2010-03-25] (ELAN Microelectronics Corp.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [102400 2010-05-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1112920 2010-03-05] (Symantec Corporation)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758160 2014-02-13] (APN)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-05-30] (Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [fst_de_56] => C:\Program Files (x86)\fst_de_56\fst_de_56.exe [3979760 2014-06-20] ()
HKLM-x32\...\Run: [fst_de_60] => C:\Program Files (x86)\fst_de_60\fst_de_60.exe [3979760 2014-06-23] ()
HKLM-x32\...\RunOnce: [upfst_de_56.exe] - C:\Users\Loni *****\AppData\Local\fst_de_56\upfst_de_56.exe -runonce [3356656 2014-06-20] ()
HKU\S-1-5-21-3457901039-3679683318-3372754741-1001\...\Run: [Amazon Cloud Player] => C:\Users\Loni *****\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()
Startup: C:\Users\Loni *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://speedial.com/?f=1&a=spd_md_14_25_ff&cd=2XzuyEtN2Y1L1Qzu0E0EtAzy0D0FyByCyCtC0B0CyC0CyE0DtN0D0Tzu0SzytDyEtN1L2XzutBtFtBtCtFzytFtDtN1L1CzutCyEtBzytDyD1V1RtN1L1G1B1V1N 2Y1L1Qzu2StCtB0B0DyE0A0EzztGtB0FtAyDtG0D0CyEtAtGyEyEtB0DtGyDtA0DzzyD0FtByC0C0BtDtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzyyCyC0AyE0DtCtG0CyDtC0AtGyC0FyEzytGyBzz zy0CtGtB0CyEtAtAtD0F0FtCyDtByB2Q&cr=2115531065&ir=
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
URLSearchHook: HKCU - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\searchhook.dll (APN LLC.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_md_14_25_ff&cd=2XzuyEtN2Y1L1Qzu0E0EtAzy0D0FyByCyCtC0B0CyC0CyE0DtN0D0Tzu0SzytDyEtN1L2XzutBtFtBtCtFzytFtDtN1L1Czut CyEtBzytDyD1V1RtN1L1G1B1V1N2Y1L1Qzu2StCtB0B0DyE0A0EzztGtB0FtAyDtG0D0CyEtAtGyEyEtB0DtGyDtA0DzzyD0FtByC0C0BtDtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzyyCyC0AyE0Dt CtG0CyDtC0AtGyC0FyEzytGyBzzzy0CtGtB0CyEtAtAtD0F0FtCyDtByB2Q&cr=2115531065&ir=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=MAF6C9AF8-1E4D-4126-9E7F-5D2C16B52D66&SearchSource=58&CUI=&UM=5&UP=SP17A73373-B2B3-4CB8-B9DE-45EA2B25DBF5&q={searchTerms}&SSPV=
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100888&tt=090212_noffx&babsrc=SP_ss&mntrId=d8436c4d000000000000e839df7661bc
SearchScopes: HKCU - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1403466500&from=exp&uid=SAMSUNGXHM321HI_S26VJ9GZ715937&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://speedial.com/results.php?f=4&q={searchTerms}&a=spd_md_14_25_ff&cd=2XzuyEtN2Y1L1Qzu0E0EtAzy0D0FyByCyCtC0B0CyC0CyE0DtN0D0Tzu0SzytDyEtN1L2XzutBtFtBtCtFzytFtDtN1L1Czut CyEtBzytDyD1V1RtN1L1G1B1V1N2Y1L1Qzu2StCtB0B0DyE0A0EzztGtB0FtAyDtG0D0CyEtAtGyEyEtB0DtGyDtA0DzzyD0FtByC0C0BtDtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzyyCyC0AyE0Dt CtG0CyDtC0AtGyC0FyEzytGyBzzzy0CtGtB0CyEtAtAtD0F0FtCyDtByB2Q&cr=2115531065&ir=
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={1C5E7043-E4A7-4F65-A65D-55C3D88668DD}&mid=47c6eb7a91ad47d0bbf3d16d12563426-7c11802e2d5e5bf0d5238e645080cc35aa0211f8&lang=de&ds=od011&pr=sa&d=2012-05-16 22:38:42&v=11.1.0.7&sap=dsp&q={searchTerms}
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 05 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 06 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 07 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 08 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 19 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default
FF NewTab: chrome://quick_start/content/index.html
FF SearchEngineOrder.1: Ask Search
FF Homepage: www.googlemail.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Musicnotes.com/Musicnotes Viewer - C:\Program Files\Musicnotes\npmusicn64.dll (Musicnotes, Inc.)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Musicnotes.com/Musicnotes Viewer - C:\Program Files (x86)\Musicnotes\npmusicn.dll (Musicnotes, Inc.)
FF Plugin-x32: @Sibelius.com/Scorch Plugin - C:\Program Files (x86)\Musicnotes\npsibelius.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\searchplugins\Speedial.xml
FF SearchPlugin: C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\searchplugins\trovi-search.xml
FF SearchPlugin: C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\searchplugins\zonealarm.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fast Start - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\faststartff@gmail.com [2014-06-22]
FF Extension: zonealarm.com - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\ffxtlbr@zonealarm.com [2014-06-22]
FF Extension: Bitdefender QuickScan - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-06-22]
FF Extension: Speedial - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} [2014-06-22]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: TowerTilt - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\{587cb346-a3d8-4884-b39b-f0ed918b6f96}.xpi [2014-06-23]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-24]
FF Extension: Adblock Plus - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-06-04]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\extensions\faststartff@gmail.com
FF Extension: Fast Start - C:\Users\Loni *****\AppData\Roaming\Mozilla\Firefox\Profiles\mw9nk5ne.default\extensions\faststartff@gmail.com [2014-06-22]

==================== Services (Whitelisted) =================

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2782552 2010-03-05] (Symantec Corporation)
R2 Rezip; C:\Windows\SysWOW64\Rezip.exe [311296 2009-03-05] () [File not signed]
R2 Update TowerTilt; C:\Program Files (x86)\TowerTilt\updateTowerTilt.exe [317728 2014-06-25] ()
R2 Util TowerTilt; C:\Program Files (x86)\TowerTilt\bin\utilTowerTilt.exe [317728 2014-06-25] ()
R2 vosr; C:\Users\Loni *****\AppData\Roaming\VOPackage\VOsrv.exe [53248 2014-05-20] () [File not signed]
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3592120 2014-05-30] (Check Point Software Technologies Ltd.)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [90936 2014-05-29] (Check Point Software Technologies, Ltd.)

==================== Drivers (Whitelisted) ====================

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2014-04-30] (Kaspersky Lab ZAO)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [92768 2014-04-30] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [490592 2014-04-30] (Kaspersky Lab ZAO)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2010-07-27] (Windows (R) 2003 DDK 3790 provider)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450968 2014-05-30] (Check Point Software Technologies Ltd.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
R1 {587cb346-a3d8-4884-b39b-f0ed918b6f96}Gw64; C:\Windows\System32\drivers\{587cb346-a3d8-4884-b39b-f0ed918b6f96}Gw64.sys [61120 2014-06-16] (StdLib)
S2 avgntflt; system32\DRIVERS\avgntflt.sys [X]
S1 avipbb; system32\DRIVERS\avipbb.sys [X]
S1 avkmgr; system32\DRIVERS\avkmgr.sys [X]
U3 JavaQuickStarterService;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-25 19:27 - 2014-06-25 19:27 - 00000000 ____D () C:\Users\Loni *****\Desktop\trojaner board
2014-06-25 19:26 - 2014-06-25 19:27 - 00023409 _____ () C:\Users\Loni *****\Downloads\FRST.txt
2014-06-25 19:25 - 2014-06-25 19:26 - 00000000 ____D () C:\FRST
2014-06-25 19:25 - 2014-06-25 19:25 - 02082816 _____ (Farbar) C:\Users\Loni *****\Downloads\FRST64.exe
2014-06-25 19:24 - 2014-06-25 19:24 - 00000486 _____ () C:\Users\Loni *****\Downloads\defogger_disable.log
2014-06-25 19:24 - 2014-06-25 19:24 - 00000000 _____ () C:\Users\Loni *****\defogger_reenable
2014-06-25 19:22 - 2014-06-25 19:22 - 00050477 _____ () C:\Users\Loni *****\Downloads\Defogger.exe
2014-06-25 18:22 - 2014-06-25 18:22 - 00961360 _____ (Chip Digital GmbH) C:\Users\Loni *****\Downloads\AdwCleaner - CHIP-Installer.exe
2014-06-25 18:21 - 2014-06-25 18:21 - 00961360 _____ (Chip Digital GmbH) C:\Users\Loni *****\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-25 17:15 - 2014-06-25 17:15 - 00000000 ____D () C:\Users\Loni *****\AppData\Local\fst_de_60
2014-06-25 17:15 - 2014-06-25 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 17:15 - 2014-06-25 17:15 - 00000000 ____D () C:\Program Files (x86)\fst_de_60
2014-06-23 08:14 - 2014-06-25 19:15 - 00000000 ____D () C:\Users\Loni *****\AppData\Local\fst_de_56
2014-06-23 08:14 - 2014-06-23 15:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFT_TODAY
2014-06-23 08:14 - 2014-06-23 15:53 - 00000000 ____D () C:\Program Files (x86)\fst_de_56
2014-06-23 00:35 - 2014-06-25 17:14 - 00001103 _____ () C:\Users\Loni *****\Desktop\Continue VuuPC Installation.lnk
2014-06-22 23:29 - 2014-06-22 23:29 - 00262144 _____ () C:\Windows\system32\config\elam
2014-06-22 23:25 - 2014-06-22 23:25 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\QuickScan
2014-06-22 23:09 - 2014-06-22 23:11 - 00431135 _____ () C:\Windows\system32\Drivers\vsconfig.xml
2014-06-22 23:09 - 2014-06-22 23:09 - 00000762 _____ () C:\Users\Public\Desktop\ZoneAlarm Security.lnk
2014-06-22 23:09 - 2014-06-22 23:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
2014-06-22 23:09 - 2014-04-30 11:01 - 00490592 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-06-22 23:09 - 2014-04-30 11:01 - 00092768 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-06-22 23:09 - 2014-04-30 11:00 - 07717984 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-06-22 23:04 - 2014-06-22 23:09 - 00000000 ____D () C:\Program Files (x86)\CheckPoint
2014-06-22 23:04 - 2014-06-22 23:04 - 03394856 _____ (Check Point Software Technologies Ltd.) C:\Users\Loni *****\Downloads\zaSetupWeb_132_015_000.exe
2014-06-22 23:04 - 2014-06-22 23:04 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Check Point Software Technologies LTD
2014-06-22 23:04 - 2014-06-22 23:04 - 00000000 ____D () C:\ProgramData\CheckPoint
2014-06-22 23:04 - 2014-06-22 23:04 - 00000000 ____D () C:\Program Files (x86)\Check Point Software Technologies LTD
2014-06-22 22:53 - 2014-06-16 17:48 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{587cb346-a3d8-4884-b39b-f0ed918b6f96}Gw64.sys
2014-06-22 22:52 - 2014-06-22 22:52 - 00000045 _____ () C:\Users\Loni *****\AppData\Roaming\WB.CFG
2014-06-22 22:04 - 2014-06-22 22:24 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-06-22 22:04 - 2014-06-22 22:23 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-06-22 22:04 - 2014-06-22 22:23 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-06-22 22:04 - 2014-06-22 22:05 - 00000322 _____ () C:\Users\Loni *****\AppData\Roaming\aps.uninstall.scan.results
2014-06-22 22:04 - 2014-06-22 22:04 - 00002842 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-06-22 22:04 - 2014-06-22 22:04 - 00002840 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-06-22 22:04 - 2014-06-22 22:04 - 00002840 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-06-22 22:03 - 2014-06-18 11:44 - 00608179 _____ (Click Me In Limited) C:\Users\Loni *****\AppData\Local\AnyProtectScannerSetup.exe
2014-06-22 21:52 - 2014-06-22 23:52 - 00000312 _____ () C:\Windows\Tasks\Speedial.job
2014-06-22 21:52 - 2014-06-22 21:52 - 00003260 _____ () C:\Windows\System32\Tasks\Speedial
2014-06-22 21:52 - 2014-06-22 21:52 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Speedial
2014-06-22 21:52 - 2014-06-22 21:52 - 00000000 ____D () C:\Users\Loni *****\AppData\Local\Speedial
2014-06-22 21:51 - 2014-06-22 21:51 - 00704720 _____ () C:\Users\Loni *****\Downloads\FlvPlayerSetup.exe
2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\VOPackage
2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-06-22 21:49 - 2014-06-25 19:09 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-22 21:49 - 2014-06-23 00:00 - 00000000 ____D () C:\Program Files (x86)\TowerTilt
2014-06-22 21:49 - 2014-06-22 21:49 - 00003088 _____ () C:\Windows\System32\Tasks\BlockAndSurf Update
2014-06-22 21:49 - 2014-06-22 21:49 - 00003008 _____ () C:\Windows\System32\Tasks\BlockAndSurf_wd
2014-06-22 21:49 - 2014-06-22 21:49 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-06-22 21:48 - 2014-06-25 19:09 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\337Games
2014-06-22 21:48 - 2014-06-23 00:31 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-06-22 21:48 - 2014-06-23 00:03 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-22 21:48 - 2014-06-22 23:31 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-22 21:48 - 2014-06-22 21:48 - 00003104 _____ () C:\Windows\System32\Tasks\GoforFilesUpdate
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\SupTab
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\GoforFiles
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\GoforFiles
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\Program Files (x86)\GoforFiles
2014-06-22 21:47 - 2014-06-22 21:47 - 07805976 _____ (hxxp://www.goforfiles.com/) C:\Users\Loni *****\Downloads\hier-kommt-die-maus_downloader.exe
2014-06-22 18:10 - 2014-06-22 18:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-22 18:10 - 2014-06-22 18:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-22 18:09 - 2014-06-22 18:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-22 18:09 - 2014-06-22 18:10 - 00000000 ____D () C:\Program Files\iTunes
2014-06-22 18:09 - 2014-06-22 18:09 - 00000000 ____D () C:\Program Files\iPod
2014-06-22 18:09 - 2014-06-22 18:09 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-06-22 18:02 - 2014-06-22 18:03 - 112616784 _____ (Apple Inc.) C:\Users\Loni *****\Downloads\iTunes64Setup(1).exe
2014-06-22 10:22 - 2014-06-22 10:22 - 00001034 _____ () C:\Users\Loni *****\Desktop\Apple Mobile Device USB Driver - Verknüpfung (2).lnk
2014-06-22 10:21 - 2014-06-22 10:21 - 00001034 _____ () C:\Users\Loni *****\Desktop\Apple Mobile Device USB Driver - Verknüpfung.lnk
2014-06-21 22:32 - 2014-06-21 22:36 - 00067072 _____ () C:\Users\Loni *****\Documents\Seite für Uli Schäfer zum Abschied Kl.1.pub
2014-06-12 22:00 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 22:00 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 21:08 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 21:08 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 21:08 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-12 21:08 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 21:08 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-12 21:08 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 21:08 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-12 21:08 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 21:08 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 21:08 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 21:08 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 21:08 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-12 21:08 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-12 21:08 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 21:08 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-12 21:08 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 21:08 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 21:08 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 21:08 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 21:08 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 21:08 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 21:08 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-12 21:08 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 21:08 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-12 21:08 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-12 21:08 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 21:08 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 21:08 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 21:08 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-12 21:08 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 21:08 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 21:08 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-12 21:08 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-12 21:08 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-12 21:08 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 21:08 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-12 21:08 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-12 21:08 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-12 21:08 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 21:08 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-12 21:08 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-12 21:08 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 21:08 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 21:08 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-12 21:08 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 21:08 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 21:08 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 21:08 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 21:08 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 21:08 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 21:08 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-12 21:08 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-12 21:08 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 21:08 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 21:08 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 21:08 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 21:08 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 21:08 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 21:08 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 21:08 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 21:08 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 21:08 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-12 21:06 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-12 21:06 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-30 02:35 - 2014-05-30 02:35 - 00450968 _____ (Check Point Software Technologies Ltd.) C:\Windows\system32\Drivers\vsdatant.sys

==================== One Month Modified Files and Folders =======

2014-06-25 19:27 - 2014-06-25 19:27 - 00000000 ____D () C:\Users\Loni *****\Desktop\trojaner board
2014-06-25 19:27 - 2014-06-25 19:26 - 00023409 _____ () C:\Users\Loni *****\Downloads\FRST.txt
2014-06-25 19:26 - 2014-06-25 19:25 - 00000000 ____D () C:\FRST
2014-06-25 19:25 - 2014-06-25 19:25 - 02082816 _____ (Farbar) C:\Users\Loni *****\Downloads\FRST64.exe
2014-06-25 19:24 - 2014-06-25 19:24 - 00000486 _____ () C:\Users\Loni *****\Downloads\defogger_disable.log
2014-06-25 19:24 - 2014-06-25 19:24 - 00000000 _____ () C:\Users\Loni *****\defogger_reenable
2014-06-25 19:24 - 2010-11-11 23:39 - 00000000 ____D () C:\Users\Loni *****
2014-06-25 19:22 - 2014-06-25 19:22 - 00050477 _____ () C:\Users\Loni *****\Downloads\Defogger.exe
2014-06-25 19:19 - 2009-07-14 06:45 - 00013936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-25 19:19 - 2009-07-14 06:45 - 00013936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-25 19:15 - 2014-06-23 08:14 - 00000000 ____D () C:\Users\Loni *****\AppData\Local\fst_de_56
2014-06-25 19:14 - 2012-01-23 22:25 - 01524301 _____ () C:\Windows\WindowsUpdate.log
2014-06-25 19:13 - 2014-05-06 23:13 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\DropboxMaster
2014-06-25 19:13 - 2012-05-14 19:52 - 00000000 ___RD () C:\Users\Loni *****\Dropbox
2014-06-25 19:13 - 2012-05-14 19:49 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Dropbox
2014-06-25 19:12 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-25 19:11 - 2014-02-27 23:52 - 00111992 _____ () C:\Windows\PFRO.log
2014-06-25 19:11 - 2013-11-19 22:19 - 00011427 _____ () C:\Windows\setupact.log
2014-06-25 19:11 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-25 19:11 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-25 19:09 - 2014-06-22 21:49 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-25 19:09 - 2014-06-22 21:48 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\337Games
2014-06-25 18:22 - 2014-06-25 18:22 - 00961360 _____ (Chip Digital GmbH) C:\Users\Loni *****\Downloads\AdwCleaner - CHIP-Installer.exe
2014-06-25 18:21 - 2014-06-25 18:21 - 00961360 _____ (Chip Digital GmbH) C:\Users\Loni *****\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-25 17:15 - 2014-06-25 17:15 - 00000000 ____D () C:\Users\Loni *****\AppData\Local\fst_de_60
2014-06-25 17:15 - 2014-06-25 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 17:15 - 2014-06-25 17:15 - 00000000 ____D () C:\Program Files (x86)\fst_de_60
2014-06-25 17:14 - 2014-06-23 00:35 - 00001103 _____ () C:\Users\Loni *****\Desktop\Continue VuuPC Installation.lnk
2014-06-25 06:19 - 2013-01-04 23:54 - 00000000 ____D () C:\Users\Loni *****\Desktop\Schulalltag, Organisation
2014-06-23 15:53 - 2014-06-23 08:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFT_TODAY
2014-06-23 15:53 - 2014-06-23 08:14 - 00000000 ____D () C:\Program Files (x86)\fst_de_56
2014-06-23 00:31 - 2014-06-22 21:48 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-06-23 00:03 - 2014-06-22 21:48 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-23 00:00 - 2014-06-22 21:49 - 00000000 ____D () C:\Program Files (x86)\TowerTilt
2014-06-22 23:56 - 2013-08-08 23:16 - 00000000 ____D () C:\ProgramData\Avira
2014-06-22 23:52 - 2014-06-22 21:52 - 00000312 _____ () C:\Windows\Tasks\Speedial.job
2014-06-22 23:31 - 2014-06-22 21:48 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-22 23:29 - 2014-06-22 23:29 - 00262144 _____ () C:\Windows\system32\config\elam
2014-06-22 23:25 - 2014-06-22 23:25 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\QuickScan
2014-06-22 23:21 - 2012-07-24 11:40 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-22 23:11 - 2014-06-22 23:09 - 00431135 _____ () C:\Windows\system32\Drivers\vsconfig.xml
2014-06-22 23:09 - 2014-06-22 23:09 - 00000762 _____ () C:\Users\Public\Desktop\ZoneAlarm Security.lnk
2014-06-22 23:09 - 2014-06-22 23:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
2014-06-22 23:09 - 2014-06-22 23:04 - 00000000 ____D () C:\Program Files (x86)\CheckPoint
2014-06-22 23:04 - 2014-06-22 23:04 - 03394856 _____ (Check Point Software Technologies Ltd.) C:\Users\Loni *****\Downloads\zaSetupWeb_132_015_000.exe
2014-06-22 23:04 - 2014-06-22 23:04 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Check Point Software Technologies LTD
2014-06-22 23:04 - 2014-06-22 23:04 - 00000000 ____D () C:\ProgramData\CheckPoint
2014-06-22 23:04 - 2014-06-22 23:04 - 00000000 ____D () C:\Program Files (x86)\Check Point Software Technologies LTD
2014-06-22 22:52 - 2014-06-22 22:52 - 00000045 _____ () C:\Users\Loni *****\AppData\Roaming\WB.CFG
2014-06-22 22:24 - 2014-06-22 22:04 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-06-22 22:23 - 2014-06-22 22:04 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-06-22 22:23 - 2014-06-22 22:04 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-06-22 22:05 - 2014-06-22 22:04 - 00000322 _____ () C:\Users\Loni *****\AppData\Roaming\aps.uninstall.scan.results
2014-06-22 22:04 - 2014-06-22 22:04 - 00002842 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-06-22 22:04 - 2014-06-22 22:04 - 00002840 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-06-22 22:04 - 2014-06-22 22:04 - 00002840 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-06-22 21:52 - 2014-06-22 21:52 - 00003260 _____ () C:\Windows\System32\Tasks\Speedial
2014-06-22 21:52 - 2014-06-22 21:52 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Speedial
2014-06-22 21:52 - 2014-06-22 21:52 - 00000000 ____D () C:\Users\Loni *****\AppData\Local\Speedial
2014-06-22 21:51 - 2014-06-22 21:51 - 00704720 _____ () C:\Users\Loni *****\Downloads\FlvPlayerSetup.exe
2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\VOPackage
2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-06-22 21:49 - 2014-06-22 21:49 - 00003088 _____ () C:\Windows\System32\Tasks\BlockAndSurf Update
2014-06-22 21:49 - 2014-06-22 21:49 - 00003008 _____ () C:\Windows\System32\Tasks\BlockAndSurf_wd
2014-06-22 21:49 - 2014-06-22 21:49 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-06-22 21:49 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-22 21:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-06-22 21:48 - 2014-06-22 21:48 - 00003104 _____ () C:\Windows\System32\Tasks\GoforFilesUpdate
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\SupTab
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\GoforFiles
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\GoforFiles
2014-06-22 21:48 - 2014-06-22 21:48 - 00000000 ____D () C:\Program Files (x86)\GoforFiles
2014-06-22 21:48 - 2011-05-09 19:11 - 00001350 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-22 21:48 - 2010-11-11 23:55 - 00001633 _____ () C:\Users\Loni *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-22 21:47 - 2014-06-22 21:47 - 07805976 _____ (hxxp://www.goforfiles.com/) C:\Users\Loni *****\Downloads\hier-kommt-die-maus_downloader.exe
2014-06-22 18:10 - 2014-06-22 18:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-22 18:10 - 2014-06-22 18:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-22 18:10 - 2014-06-22 18:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-22 18:10 - 2014-06-22 18:09 - 00000000 ____D () C:\Program Files\iTunes
2014-06-22 18:09 - 2014-06-22 18:09 - 00000000 ____D () C:\Program Files\iPod
2014-06-22 18:09 - 2014-06-22 18:09 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-06-22 18:05 - 2012-12-23 16:59 - 00000000 ____D () C:\ProgramData\Apple
2014-06-22 18:03 - 2014-06-22 18:02 - 112616784 _____ (Apple Inc.) C:\Users\Loni *****\Downloads\iTunes64Setup(1).exe
2014-06-22 17:55 - 2013-07-09 23:00 - 00000000 ____D () C:\Users\Loni *****\Desktop\1. Klasse
2014-06-22 10:22 - 2014-06-22 10:22 - 00001034 _____ () C:\Users\Loni *****\Desktop\Apple Mobile Device USB Driver - Verknüpfung (2).lnk
2014-06-22 10:21 - 2014-06-22 10:21 - 00001034 _____ () C:\Users\Loni *****\Desktop\Apple Mobile Device USB Driver - Verknüpfung.lnk
2014-06-21 22:36 - 2014-06-21 22:32 - 00067072 _____ () C:\Users\Loni *****\Documents\Seite für Uli Schäfer zum Abschied Kl.1.pub
2014-06-21 18:18 - 2012-10-19 07:14 - 00000000 ____D () C:\Users\Loni *****\Desktop\Englisch
2014-06-21 11:36 - 2014-03-03 17:24 - 00000000 ____D () C:\Users\Loni *****\Desktop\Mathematik
2014-06-20 23:25 - 2010-06-01 19:30 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-06-20 23:25 - 2010-06-01 19:30 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-06-20 23:25 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-18 11:44 - 2014-06-22 22:03 - 00608179 _____ (Click Me In Limited) C:\Users\Loni *****\AppData\Local\AnyProtectScannerSetup.exe
2014-06-16 19:14 - 2010-11-12 00:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-16 17:48 - 2014-06-22 22:53 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{587cb346-a3d8-4884-b39b-f0ed918b6f96}Gw64.sys
2014-06-15 18:56 - 2011-01-31 23:52 - 00000000 ____D () C:\Users\Loni *****\Desktop\Musik
2014-06-15 18:32 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-12 23:56 - 2013-08-18 23:10 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 23:55 - 2010-11-13 01:04 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 23:53 - 2014-05-01 19:21 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-10 21:09 - 2011-01-31 23:52 - 00000000 ____D () C:\Users\Loni *****\Desktop\Religion
2014-06-10 19:08 - 2012-09-03 20:53 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-09 13:04 - 2012-01-06 00:25 - 00000000 ____D () C:\Users\Loni *****\Documents\Schulleben
2014-06-08 11:13 - 2014-06-12 21:06 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-12 21:06 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-02 18:43 - 2014-04-22 19:59 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-05-30 12:21 - 2014-06-12 21:08 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 12:02 - 2014-06-12 21:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 12:02 - 2014-06-12 21:08 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 11:45 - 2014-06-12 21:08 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 11:39 - 2014-06-12 21:08 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 11:39 - 2014-06-12 21:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 11:38 - 2014-06-12 21:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 11:28 - 2014-06-12 21:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 11:27 - 2014-06-12 21:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 11:24 - 2014-06-12 21:08 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 11:21 - 2014-06-12 21:08 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 11:21 - 2014-06-12 21:08 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 11:20 - 2014-06-12 21:08 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 11:18 - 2014-06-12 21:08 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-30 11:11 - 2014-06-12 21:08 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 11:08 - 2014-06-12 21:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 11:06 - 2014-06-12 21:08 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 11:02 - 2014-06-12 21:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-30 10:55 - 2014-06-12 21:08 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:49 - 2014-06-12 21:08 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:46 - 2014-06-12 21:08 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:44 - 2014-06-12 21:08 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-30 10:44 - 2014-06-12 21:08 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 10:43 - 2014-06-12 21:08 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-30 10:42 - 2014-06-12 21:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 21:08 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-30 10:35 - 2014-06-12 21:08 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 10:34 - 2014-06-12 21:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 21:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-30 10:30 - 2014-06-12 21:08 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-30 10:29 - 2014-06-12 21:08 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 10:28 - 2014-06-12 21:08 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-30 10:27 - 2014-06-12 21:08 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-30 10:24 - 2014-06-12 21:08 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 10:23 - 2014-06-12 21:08 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 10:16 - 2014-06-12 21:08 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 21:08 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 21:08 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-30 10:04 - 2014-06-12 21:08 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 21:08 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-30 09:56 - 2014-06-12 21:08 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-30 09:56 - 2014-06-12 21:08 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:54 - 2014-06-12 21:08 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 21:08 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 21:08 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-30 09:43 - 2014-06-12 21:08 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:40 - 2014-06-12 21:08 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-30 09:30 - 2014-06-12 21:08 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:21 - 2014-06-12 21:08 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-30 09:15 - 2014-06-12 21:08 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-30 09:13 - 2014-06-12 21:08 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 09:13 - 2014-06-12 21:08 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-30 02:35 - 2014-05-30 02:35 - 00450968 _____ (Check Point Software Technologies Ltd.) C:\Windows\system32\Drivers\vsdatant.sys
2014-05-29 21:28 - 2013-09-07 21:16 - 00000000 ____D () C:\Users\Loni *****\Desktop\Fotos Schule
2014-05-28 05:34 - 2012-05-14 19:50 - 00000000 ____D () C:\Users\Loni *****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-26 21:23 - 2013-08-31 21:55 - 00000000 ____D () C:\Users\Loni *****\Desktop\Unsortiert
2014-05-26 21:22 - 2014-04-22 19:58 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2014

Some content of TEMP:
====================
C:\Users\Loni *****\AppData\Local\Temp\avgnt.exe
C:\Users\Loni *****\AppData\Local\Temp\DownloadManager.exe
C:\Users\Loni *****\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpx0cnc3.dll
C:\Users\Loni *****\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Loni *****\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Loni *****\AppData\Local\Temp\htmlayout.dll
C:\Users\Loni *****\AppData\Local\Temp\nsg43A9.exe
C:\Users\Loni *****\AppData\Local\Temp\nsg6D6B.exe
C:\Users\Loni *****\AppData\Local\Temp\nsq3FF0.exe
C:\Users\Loni *****\AppData\Local\Temp\nsw69D2.exe
C:\Users\Loni *****\AppData\Local\Temp\PreExe_ID_13667.exe
C:\Users\Loni *****\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Loni *****\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Loni *****\AppData\Local\Temp\SPSetup.exe
C:\Users\Loni *****\AppData\Local\Temp\toolbar94078190.exe
C:\Users\Loni *****\AppData\Local\Temp\toolbar94081438.exe
C:\Users\Loni *****\AppData\Local\Temp\toolbar94081806.exe
C:\Users\Loni *****\AppData\Local\Temp\toolbar94081810.exe
C:\Users\Loni *****\AppData\Local\Temp\toolbar94208998.exe
C:\Users\Loni *****\AppData\Local\Temp\uninstall-updater450733.exe
C:\Users\Loni *****\AppData\Local\Temp\uninstall459740.exe
C:\Users\Loni *****\AppData\Local\Temp\vp.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-19 16:49

==================== End Of Log ============================


Gmer.txt

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-25 19:33:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\LONIRI~1\AppData\Local\Temp\kxldapod.sys


---- Disk sectors - GMER 2.1 ----

Disk \Device\Harddisk0\DR0 unknown MBR code

---- Threads - GMER 2.1 ----

Thread C:\Windows\System32\svchost.exe [2568:3372] 000007fef647a0ac
Thread C:\Windows\System32\svchost.exe [2568:3504] 000007fef6c79688
---- Processes - GMER 2.1 ----

Process C:\Users\Loni *****\AppData\Roaming\VOPackage\VOsrv.exe (*** suspicious ***) @ C:\Users\Loni *****\AppData\Roaming\VOPackage\VOsrv.exe [2544](2014-05-20 09:18:14) 00000000013b0000
Process C:\Users\Loni *****\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe (*** suspicious ***) @ C:\Users\Loni *****\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3656](2014-02-17 16:18:57) 0000000000e10000
Library C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\Dropbox.exe [3740](2014-01-03 01:09:26) 0000000004160000
Library c:\users\loniri~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpx0cnc3.dll (*** suspicious ***) @ C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\Dropbox.exe [3740](2014-06-25 17:12:40) 0000000002450000
Library C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\Dropbox.exe [3740](2013-08-23 19:01:44) 00000000678b0000
Library C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Loni *****\AppData\Roaming\Dropbox\bin\Dropbox.exe [3740] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000066c80000

---- EOF - GMER 2.1 ----