Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-11-2013 (ATTENTION: ====> FRST version is 421 days old and could be outdated)
Ran by KS (administrator) on KS-PC on 19-01-2015 18:41:35
Running from C:\Users\KS\Downloads
Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\HelpPane.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe [642664 2013-05-08] (Adobe Systems Inc.)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe [44128 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\avastui.exe [5227112 2015-01-18] (AVAST Software)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [ControlCenter4] - C:\Program Files\ControlCenter4\BrCcBoot.exe [139776 2014-06-16] (Brother Industries, Ltd.)
HKLM\...\Run: [BrStsMon00] - C:\Program Files\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12017368 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [IndexSearch] - C:\Program Files\Nuance\PaperPort\IndexSearch.exe [46952 2011-08-02] (Nuance Communications, Inc.)
HKLM\...\Run: [PaperPort PTD] - C:\Program Files\Nuance\PaperPort\pptd40nt.exe [30568 2011-08-02] (Nuance Communications, Inc.)
HKLM\...\Run: [PDFHook] - C:\Program Files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM\...\Run: [PDF5 Registry Controller] - C:\Program Files\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
Winlogon\Notify\LBTWlgn: C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
HKCU\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-07-29] (Google Inc.)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKCU\...\Run: [Device Detector] - DevDetect.exe -autorun
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [Google Update] - C:\Users\KS\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-05-13] (Google Inc.)
HKCU\...\Run: [Google+ Auto Backup] - C:\Users\KS\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3746120 2014-08-12] (Google Inc.)
HKCU\...\Run: [CCleaner Monitoring] - C:\Program Files\CCleaner\CCleaner.exe [5282584 2014-11-21] (Piriform Ltd)
HKCU\...\RunOnce: [Application Restart #3] - C:\Program Files\Google\Chrome\Application\chrome.exe --flag-switches-begin --flag-switches-end --restore-last-session https://program.avast.com/api/?action=2&p_age=552&p_bld=chr2;tris4&p_cid=1&p_cpv=100664585&p_elm=43&p_idw=0&p_iid=0&p_inf=49&p_lan=1031&p_lci=1031&p_let=24&p_lex=173&p_lic=0&p_lid= de-de&p_lng=de&p_lqa=0&p_lst=0&p_lsu=24&p_man=0&p_osv=6.1&p_pro=0&p_rcv=1&p_reh=1200&p_rew=1920&p_tra=15232&p_tri=2&p_trt=5&p_uid=1e2f&p_vbd=1289&p_vep=6 &p_ves=0&p_wnf=16 [856904 2015-01-09] (Google Inc.)
MountPoints2: {7489ee53-e73a-11df-ae7c-4c0f6e128eda} - wscript go.vbs
HKU\UpdatusUser\...\Run: [KiesPreload] - "C:\Program Files\Samsung\Kies\Kies.exe" /preload
HKU\UpdatusUser\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\UpdatusUser\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2010-07-29] (Google Inc.)
HKU\UpdatusUser\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
AppInit_DLLs: C:\Windows\System32\acaptuser32.dll [ 2013-05-08] (Adobe Systems Incorporated)
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe
Startup: C:\Users\KS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\KS\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\KS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\KS\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
Startup: C:\Users\KS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x49260A3B6908CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.mystartsearch.com/?type=hppp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hppp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
URLSearchHook: HKLM - AOL Deutschland Toolbar Search Class - {66a449dc-6b1d-4187-a4f1-b335d3da5365} - C:\Program Files\AOL Deutschland Toolbar\aoldetb.dll (AOL Inc.)
URLSearchHook: HKLM - (No Name) - {c9508125-4747-4733-b048-e4b82dc9716d} - No File
URLSearchHook: HKCU - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1421585375&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://de.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = https://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=dspp&ts=1421585425&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {AA6DAABE-6AC1-43D0-8DC4-2D5A2D9513BD} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
SearchScopes: HKCU - {EB1F792D-A62A-4EDB-B502-8B1CC4B9D067} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=ST3320820AS_5QF4CYPQXXXX5QF4CYPQ&ts=1421585432&type=default&q={search Terms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - No File
BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\XTab\SupTab.dll (Thinknice Co. Limited)
BHO: No Name - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - No File
BHO: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll (EldoS Corporation)
BHO: No Name - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: No Name - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: No Name - {9030D464-4C02-4ABF-8ECC-5164760863C6} - No File
BHO: No Name - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - No File
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No File
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: No Name - {AF949550-9094-4807-95EC-D1C317803333} - No File
BHO: No Name - {c9508125-4747-4733-b048-e4b82dc9716d} - No File
BHO: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - No Name - {567d4d94-8077-4682-b887-945f3d644116} - No File
Toolbar: HKLM - No Name - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C9508125-4747-4733-B048-E4B82DC9716D} - No File
Toolbar: HKCU - No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
Toolbar: HKCU - No Name - {567D4D94-8077-4682-B887-945F3D644116} - No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655
FF user.js: detected! => C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\user.js
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: mystartsearch
FF Homepage: https://www.google.de/?gws_rd=ssl
FF Keyword.URL: https://www.google.com/search/?trackid=sp-006
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_257.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Acrobat - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @movenetworks.com/Quantum Media Player - C:\Users\KS\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\KS\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\KS\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\KS\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll No File
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\google-avast.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\Mysearchdial.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\mystartsearch-1.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\mystartsearch.xml
FF SearchPlugin: C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\ddg.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: leethax - C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\Extensions\leethax@leethax.net.xpi
FF Extension: speeddial - C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: tabmix - C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
FF Extension: prefs - C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\Extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\extensions\fftoolbar2014@etech.com
FF HKLM\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\KS\AppData\Roaming\Mozilla\Firefox\Profiles\1w06fufu.default-1382298312655\extensions\faststartff@gmail.com
FF HKLM\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: Download videos and MP3s from YouTube - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\

Chrome:
=======
CHR RestoreOnStartup: "urls_to_restore_on_startup": null
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\KS\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0
CHR Extension: (Avast Online Security) - C:\Users\KS\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\10.0.2502.149_0
CHR Extension: (Google Wallet) - C:\Users\KS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0
CHR HKLM\...\Chrome\Extension: [cfigonhgidedenkkhlilmefgodjpefna] - C:\Users\KS\AppData\Local\CRE\cfigonhgidedenkkhlilmefgodjpefna.crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx
CHR HKLM\...\Chrome\Extension: [iagcajndpnfncplednpbnkahadegklfa] - C:\Users\KS\AppData\Local\speedial.crx
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-03-28] (Advanced Micro Devices, Inc.)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-14] (AVAST Software)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3192344 2014-12-14] (Avast Software)
S3 becldr3Service; C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [176128 2011-04-19] ()
S3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.)
S2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
S2 MCSWASVR; C:\Program Files\Telekom\Mediencenter\WebDAV.AdminService.exe [16016 2010-07-09] (Deutsche Telekom AG)
S2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [786256 2014-07-15] (Nero AG)
S2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
S2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)
S2 Verifies and fixes application compatibility issues; C:\Users\Default\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [91304 2015-01-12] ()
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [464384 2015-01-18] (SysTool PasSame LIMITED)
S2 xmkysecqun32; C:\Program Files\003\xmkysecqun32.exe [541696 2014-06-24] ()
S2 HPSLPSVC; C:\Users\KS\AppData\Local\Temp\7zS6AAF\hpslpsvc32.dll [x]

==================== Drivers (Whitelisted) ====================

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
S3 AODDriver4.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-12-14] ()
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-12-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-12-14] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49944 2014-12-14] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-12-14] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2014-12-14] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2014-12-14] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [206248 2014-12-14] ()
S1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [265800 2010-05-15] (EldoS Corporation)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-02-05] ()
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42264 2014-03-19] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [10136 2014-03-19] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28312 2014-03-19] (Logitech, Inc.)
S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS32_100507.sys [22328 2010-05-10] (Your Corporation)
S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios32_100507.sys [25912 2010-05-10] (Your Corporation)
S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS32_100507.sys [16696 2010-05-10] ()
S3 Ph3xIB32; C:\Windows\System32\DRIVERS\Ph3xIB32.sys [1311232 2009-07-13] (NXP Semiconductors)
S1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-12-15] ()
S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
S2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [218192 2014-12-14] (Avast Software)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [117760 2011-02-25] (VIA Technologies, Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [164864 2011-02-25] (VIA Technologies, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2008-10-28] (X10 Wireless Technology, Inc.)
S3 amdiox86; system32\DRIVERS\amdiox86.sys [x]
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
S3 NTIOLib_1_0_4; \??\C:\Program Files\MSI\Live Update 5\NTIOLib.sys [x]
S3 NTIOLib_1_0_C; \??\C:\MSI\MSI SUITE\NTIOLib.sys [x]
S3 NTIOLib_1_1_S; \??\C:\MSI\MSI SUITE\Super-Charger\NTIOLib.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] ()
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2015-01-19 18:41 - 2015-01-19 18:43 - 00026542 _____ C:\Users\KS\Downloads\FRST.txt
2015-01-19 18:41 - 2015-01-19 18:41 - 00000000 ____D C:\FRST
2015-01-19 18:40 - 2015-01-19 18:40 - 01091583 _____ (Farbar) C:\Users\KS\Downloads\FRST.exe
2015-01-19 18:40 - 2015-01-19 18:40 - 01091583 _____ (Farbar) C:\Users\KS\Downloads\FRST(1).exe
2015-01-19 17:11 - 2015-01-19 17:11 - 00000000 ____D C:\Users\Default\AppData\Roaming\Adobe
2015-01-19 17:11 - 2015-01-19 17:11 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Adobe
2015-01-19 17:09 - 2015-01-19 17:09 - 00000197 _____ C:\Windows\system32\2015-01-19-16-09-45.014-AvastVBoxSVC.exe-4384.log
2015-01-19 17:08 - 2015-01-19 17:10 - 00000000 ____D C:\Users\Default\AppData\Roaming\Compatibility Verifier
2015-01-19 17:08 - 2015-01-19 17:10 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Compatibility Verifier
2015-01-19 16:35 - 2015-01-19 16:35 - 05249448 _____ (ParetoLogic Inc.) C:\Users\KS\Downloads\ParetoLogic PC Health Advisor_de.exe
2015-01-19 15:21 - 2015-01-19 15:22 - 00000197 _____ C:\Windows\system32\2015-01-19-14-21-48.097-AvastVBoxSVC.exe-5508.log
2015-01-19 00:26 - 2015-01-19 00:26 - 00000197 _____ C:\Windows\system32\2015-01-18-23-26-28.012-AvastVBoxSVC.exe-5608.log
2015-01-19 00:13 - 2015-01-19 17:04 - 00006592 _____ C:\Windows\DPINST.LOG
2015-01-19 00:10 - 2015-01-19 00:10 - 00000196 _____ C:\Users\KS\Documents\cc_20150119_001008.reg
2015-01-18 23:40 - 2015-01-18 23:40 - 00000562 _____ C:\Windows\PFRO.log
2015-01-18 20:39 - 2015-01-18 20:39 - 00000197 _____ C:\Windows\system32\2015-01-18-19-39-24.099-AvastVBoxSVC.exe-5264.log
2015-01-18 20:37 - 2015-01-19 17:35 - 00000448 _____ C:\Windows\setupact.log
2015-01-18 20:37 - 2015-01-18 20:37 - 00000000 _____ C:\Windows\setuperr.log
2015-01-18 16:48 - 2015-01-18 16:48 - 08889112 _____ C:\Users\KS\Downloads\Driver_USB(1).7z
2015-01-18 16:47 - 2015-01-18 16:48 - 08009577 _____ C:\Users\KS\Downloads\MtkDroidTools(1).7z
2015-01-18 14:54 - 2015-01-18 14:54 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-01-18 14:10 - 2015-01-18 14:10 - 00000197 _____ C:\Windows\system32\2015-01-18-13-10-31.040-AvastVBoxSVC.exe-5344.log
2015-01-18 13:59 - 2015-01-18 13:59 - 00000197 _____ C:\Windows\system32\2015-01-18-12-59-29.073-AvastVBoxSVC.exe-1804.log
2015-01-18 13:58 - 2015-01-18 13:58 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-01-18 13:50 - 2015-01-18 20:59 - 00000000 ____D C:\Users\KS\AppData\Roaming\mystartsearch
2015-01-18 13:50 - 2015-01-18 13:58 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-01-18 13:50 - 2015-01-18 13:50 - 00000000 ____D C:\Program Files\XTab
2015-01-18 13:49 - 2015-01-18 13:49 - 00000000 ____D C:\Program Files\Driver Identifier
2015-01-18 13:43 - 2015-01-18 13:43 - 00638888 _____ (Oracle Corporation) C:\Users\KS\Downloads\jxpiinstall(1).exe
2015-01-18 13:26 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-01-18 13:26 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-18 13:24 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-18 13:24 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-18 13:24 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-18 13:24 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-18 13:20 - 2015-01-18 13:20 - 00000197 _____ C:\Windows\system32\2015-01-18-12-20-02.058-AvastVBoxSVC.exe-6044.log
2015-01-18 12:03 - 2015-01-19 17:11 - 00258643 _____ C:\Windows\WindowsUpdate.log
2015-01-18 11:46 - 2015-01-18 11:47 - 00000632 _____ C:\Users\KS\Documents\cc_20150118_114653.reg
2015-01-18 11:38 - 2015-01-18 11:38 - 00000197 _____ C:\Windows\system32\2015-01-18-10-38-13.001-AvastVBoxSVC.exe-3996.log
2015-01-18 11:31 - 2015-01-18 11:31 - 00000197 _____ C:\Windows\system32\2015-01-18-10-31-48.049-AvastVBoxSVC.exe-2068.log
2015-01-17 23:48 - 2015-01-17 23:48 - 00000000 ____D C:\Users\Default\AppData\Local\Apple
2015-01-17 23:48 - 2015-01-17 23:48 - 00000000 ____D C:\Users\Default User\AppData\Local\Apple
2015-01-17 23:41 - 2015-01-17 23:41 - 00000197 _____ C:\Windows\system32\2015-01-17-22-41-20.082-AvastVBoxSVC.exe-5724.log

==================== One Month Modified Files and Folders =======

2015-01-19 18:43 - 2015-01-19 18:41 - 00026542 _____ C:\Users\KS\Downloads\FRST.txt
2015-01-19 18:41 - 2015-01-19 18:41 - 00000000 ____D C:\FRST
2015-01-19 18:40 - 2015-01-19 18:40 - 01091583 _____ (Farbar) C:\Users\KS\Downloads\FRST.exe
2015-01-19 18:40 - 2015-01-19 18:40 - 01091583 _____ (Farbar) C:\Users\KS\Downloads\FRST(1).exe
2015-01-19 18:07 - 2014-06-25 12:07 - 00000276 _____ C:\Windows\Tasks\FF Watcher {84E5D227-76F8-4A9F-8346-C1A634A7D805}.job
2015-01-19 17:50 - 2012-03-29 09:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-19 17:35 - 2015-01-18 20:37 - 00000448 _____ C:\Windows\setupact.log
2015-01-19 17:19 - 2014-05-13 13:51 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001UA.job
2015-01-19 17:16 - 2009-07-14 05:34 - 00023312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-19 17:16 - 2009-07-14 05:34 - 00023312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-19 17:11 - 2015-01-19 17:11 - 00000000 ____D C:\Users\Default\AppData\Roaming\Adobe
2015-01-19 17:11 - 2015-01-19 17:11 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Adobe
2015-01-19 17:11 - 2015-01-18 12:03 - 00258643 _____ C:\Windows\WindowsUpdate.log
2015-01-19 17:10 - 2015-01-19 17:08 - 00000000 ____D C:\Users\Default\AppData\Roaming\Compatibility Verifier
2015-01-19 17:10 - 2015-01-19 17:08 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Compatibility Verifier
2015-01-19 17:10 - 2014-10-23 18:51 - 00000000 ____D C:\ProgramData\Package Cache
2015-01-19 17:09 - 2015-01-19 17:09 - 00000197 _____ C:\Windows\system32\2015-01-19-16-09-45.014-AvastVBoxSVC.exe-4384.log
2015-01-19 17:07 - 2014-08-02 19:11 - 00000433 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2015-01-19 17:06 - 2013-12-13 14:42 - 00000000 ____D C:\Users\KS\AppData\Roaming\ControlCenter4
2015-01-19 17:05 - 2010-05-14 22:59 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-19 17:05 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-01-19 17:04 - 2015-01-19 00:13 - 00006592 _____ C:\Windows\DPINST.LOG
2015-01-19 17:03 - 2014-02-03 12:58 - 00000000 ____D C:\ProgramData\ParetoLogic
2015-01-19 16:35 - 2015-01-19 16:35 - 05249448 _____ (ParetoLogic Inc.) C:\Users\KS\Downloads\ParetoLogic PC Health Advisor_de.exe
2015-01-19 15:23 - 2010-11-02 00:31 - 00002277 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-19 15:22 - 2015-01-19 15:21 - 00000197 _____ C:\Windows\system32\2015-01-19-14-21-48.097-AvastVBoxSVC.exe-5508.log
2015-01-19 00:26 - 2015-01-19 00:26 - 00000197 _____ C:\Windows\system32\2015-01-18-23-26-28.012-AvastVBoxSVC.exe-5608.log
2015-01-19 00:10 - 2015-01-19 00:10 - 00000196 _____ C:\Users\KS\Documents\cc_20150119_001008.reg
2015-01-18 23:40 - 2015-01-18 23:40 - 00000562 _____ C:\Windows\PFRO.log
2015-01-18 20:59 - 2015-01-18 13:50 - 00000000 ____D C:\Users\KS\AppData\Roaming\mystartsearch
2015-01-18 20:39 - 2015-01-18 20:39 - 00000197 _____ C:\Windows\system32\2015-01-18-19-39-24.099-AvastVBoxSVC.exe-5264.log
2015-01-18 20:37 - 2015-01-18 20:37 - 00000000 _____ C:\Windows\setuperr.log
2015-01-18 20:37 - 2012-04-29 12:29 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-01-18 20:04 - 2014-08-18 07:57 - 00000000 ____D C:\Users\KS\AppData\Local\Adobe
2015-01-18 20:04 - 2012-03-29 09:16 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-01-18 20:04 - 2011-05-20 08:04 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-01-18 19:29 - 2012-07-25 21:24 - 00000916 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001UA.job
2015-01-18 17:46 - 2010-02-14 18:40 - 01629284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-01-18 17:36 - 2010-05-18 10:28 - 00000000 ____D C:\Program Files\DIFX
2015-01-18 16:48 - 2015-01-18 16:48 - 08889112 _____ C:\Users\KS\Downloads\Driver_USB(1).7z
2015-01-18 16:48 - 2015-01-18 16:47 - 08009577 _____ C:\Users\KS\Downloads\MtkDroidTools(1).7z
2015-01-18 14:54 - 2015-01-18 14:54 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-01-18 14:33 - 2010-02-14 22:45 - 00001057 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-18 14:29 - 2013-03-13 12:09 - 00000000 ____D C:\Users\KS\AppData\Roaming\Dropbox
2015-01-18 14:23 - 2013-07-14 02:14 - 00000000 ____D C:\Windows\system32\MRT
2015-01-18 14:16 - 2010-02-17 12:07 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-18 14:10 - 2015-01-18 14:10 - 00000197 _____ C:\Windows\system32\2015-01-18-13-10-31.040-AvastVBoxSVC.exe-5344.log
2015-01-18 13:59 - 2015-01-18 13:59 - 00000197 _____ C:\Windows\system32\2015-01-18-12-59-29.073-AvastVBoxSVC.exe-1804.log
2015-01-18 13:58 - 2015-01-18 13:58 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-01-18 13:58 - 2015-01-18 13:50 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-01-18 13:50 - 2015-01-18 13:50 - 00000000 ____D C:\Program Files\XTab
2015-01-18 13:49 - 2015-01-18 13:49 - 00000000 ____D C:\Program Files\Driver Identifier
2015-01-18 13:49 - 2013-08-05 23:32 - 00001278 _____ C:\Users\KS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-18 13:49 - 2011-03-15 19:47 - 00001569 _____ C:\Users\KS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-18 13:43 - 2015-01-18 13:43 - 00638888 _____ (Oracle Corporation) C:\Users\KS\Downloads\jxpiinstall(1).exe
2015-01-18 13:20 - 2015-01-18 13:20 - 00000197 _____ C:\Windows\system32\2015-01-18-12-20-02.058-AvastVBoxSVC.exe-6044.log
2015-01-18 11:47 - 2015-01-18 11:46 - 00000632 _____ C:\Users\KS\Documents\cc_20150118_114653.reg
2015-01-18 11:43 - 2010-02-20 13:29 - 00000000 ____D C:\Users\KS\AppData\Roaming\BitTorrent
2015-01-18 11:38 - 2015-01-18 11:38 - 00000197 _____ C:\Windows\system32\2015-01-18-10-38-13.001-AvastVBoxSVC.exe-3996.log
2015-01-18 11:31 - 2015-01-18 11:31 - 00000197 _____ C:\Windows\system32\2015-01-18-10-31-48.049-AvastVBoxSVC.exe-2068.log
2015-01-18 11:27 - 2010-02-14 18:41 - 00000000 ____D C:\Users\KS
2015-01-18 11:27 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\wfp
2015-01-18 11:26 - 2010-02-14 19:29 - 00000000 ____D C:\Users\KS\AppData\Roaming\GHISLER
2015-01-18 11:26 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2015-01-17 23:48 - 2015-01-17 23:48 - 00000000 ____D C:\Users\Default\AppData\Local\Apple
2015-01-17 23:48 - 2015-01-17 23:48 - 00000000 ____D C:\Users\Default User\AppData\Local\Apple
2015-01-17 23:41 - 2015-01-17 23:41 - 00000197 _____ C:\Windows\system32\2015-01-17-22-41-20.082-AvastVBoxSVC.exe-5724.log
2015-01-17 23:38 - 2013-03-13 23:03 - 00000000 ___RD C:\Users\KS\Dropbox
2015-01-08 09:55 - 2010-03-11 23:19 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\KS\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3azirc.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe
[2014-10-20 18:27] - [2014-07-17 02:39] - 0304128 ____A (Microsoft Corporation) 52449FD429D6053B78AE564DEF303870

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-12-16 13:14

==================== End Of Log ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-11-2013
Ran by KS at 2015-01-19 18:44:18
Running from C:\Users\KS\Downloads
Boot Mode: Safe Mode (with Networking)
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Update for Microsoft Office 2007 (KB2508958)
Adobe AIR (Version: 15.0.0.249)
Adobe Flash Player 16 ActiveX (Version: 16.0.0.257)
Adobe Flash Player 16 NPAPI (Version: 16.0.0.257)
AOL Deutschland Toolbar
Avast Free Antivirus (Version: 10.0.2208)
CCleaner (Version: 5.00)
Crystal Reports Basic Runtime for Visual Studio 2008 (Version: 10.5.0.0)
DriverIdentifier 3.8
Dropbox (HKCU Version: 3.0.3)
Google Chrome (Version: 39.0.2171.99)
Google Drive (Version: 1.18.7821.2489)
Google Update Helper (Version: 1.3.25.11)
Google+ Auto Backup (HKCU Version: 1.0.26.151)
Internet-TV für Windows Media Center (Version: 4.2.2.0)
Lenovo Smart Assistant 1.03 (Version: 1.03.0.0)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Deutsch) (Version: 4.5.50938)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Fix it Center (Version: 1.0.0100)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Primary Interoperability Assemblies 2005 (Version: 8.0.50727.42)
Microsoft Silverlight (Version: 5.1.30514.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft VC9 runtime libraries (Version: 2.0.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (Version: 11.0.61030.0)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (Version: 11.0.61030)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (Version: 11.0.61030)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (Version: 12.0.21005.1)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (Version: 12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (Version: 12.0.21005)
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
Move Media Player
Mozilla Firefox 35.0 (x86 de) (Version: 35.0)
MyFreeCodec
Nero Abstract Themes (Version: 16.0.10002)
Nero Audio Pack 1 (Version: 11.0.11500.110.0)
Nero Blu-ray Player (Version: 12.1.20081)
Nero Core Components (Version: 11.4.0012)
Nero Info (Version: 16.0.1003)
Nero Kwik Themes Basic (Version: 16.0.10002)
Nero MediaHome (Version: 1.26.5300)
Nero SharedVideoCodecs (Version: 1.0.16006)
Nero Update (Version: 11.0.13600.45.0)
Prerequisite installer (Version: 16.0.0000)
Realtek Ethernet Controller Driver (Version: 7.86.508.2014)
Samsung Kies3 (Version: 3.2.14113.3)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.49.0)
SlimDrivers
TomTom HOME (Version: 2.9.8)
TomTom HOME Visual Studio Merge Modules (Version: 1.0.2)
Total Commander (Remove or Repair) (Version: 8.50)
Ultimate Codec Packages
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2920789) 32-Bit Edition
Update for Microsoft Office PowerPoint 2007 (KB2597972) 32-Bit Edition
Update for Ultimate Codec
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Versandhelfer (Version: 1.6)
Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (Version: 06/15/2009 6.2.0.9000)
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (Version: 07/30/2009 6.2.0.9405)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Driver Package - Lenovo Inc. (WinUSB) AndroidUsbDeviceClass (04/28/2012 4.0.0000.00000) (Version: 04/28/2012 4.0.0000.00000)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3508.1109)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Media Center Add-in for Silverlight (Version: 4.7.3.0)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)

==================== Restore Points =========================

02-12-2014 08:03:47 Windows Update
04-12-2014 21:54:11 Installed Samsung Kies3
08-12-2014 20:33:07 Removed Catalyst Control Center - Branding
08-12-2014 20:33:58 Removed ATI AVIVO Codecs
08-12-2014 20:34:22 Removed Catalyst Control Center Graphics Previews Common
08-12-2014 22:29:09 Revo Uninstaller's restore point - AMD Catalyst Install Manager
08-12-2014 22:29:27 Removed AMD Catalyst Install Manager
08-12-2014 22:31:52 Revo Uninstaller's restore point - AMD Catalyst Install Manager
09-12-2014 07:56:42 Windows Update
10-12-2014 14:16:33 Windows Update
10-12-2014 19:13:29 SlimDrivers Installing Drivers
10-12-2014 19:14:31 Installiert Realtek Ethernet Controller Driver
12-12-2014 12:08:42 Windows Update
14-12-2014 22:54:26 avast! antivirus system restore point
16-12-2014 08:32:04 Windows Update
19-12-2014 00:10:48 Windows Update
17-01-2015 22:46:14 Windows Update
17-01-2015 23:01:43 Windows Update
18-01-2015 12:20:49 Windows Update
18-01-2015 13:15:25 Windows Update
19-01-2015 16:09:47 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

==================== Hosts content: ==========================

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0733D720-AC3C-479D-810C-3EC5AA136C4B} - System32\Tasks\{E86EF3DC-9E99-49C3-BD4C-37B0F85A386E} => Firefox.exe
Task: {302F8CBA-D325-4FD1-8CC4-44B37ADA6F15} - System32\Tasks\{626911E7-F6D8-4111-AEB9-65DCD79894A6} => C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE
Task: {38B103F6-060C-4B27-8BE1-AF2843C6B99B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001Core => C:\Users\KS\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-13] (Google Inc.)
Task: {38D127CA-643C-4E2A-969D-2D392D2A297F} - System32\Tasks\SlimDrivers Startup => C:\Program Files\SlimDrivers\SlimDrivers.exe [2013-09-24] (SlimWare Utilities, Inc.)
Task: {59A1F2A8-B320-4562-AFF1-ABE72CDFE960} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
Task: {5AA51859-365B-4CBB-8585-977F6E1438B8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {5B7438AB-3F25-4E40-8717-E4C3FB539E94} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {5D98041A-8791-4300-B78D-D8B09FF424CC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001UA => C:\Users\KS\AppData\Local\Google\Update\GoogleUpdate.exe [2014-05-13] (Google Inc.)
Task: {6136EBAC-27B6-49C7-97F6-68490BEBC617} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-11-21] (Piriform Ltd)
Task: {67E1F1FE-6F14-4EE0-A696-B0E0559B7B25} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => C:\Windows\System32\invagent.dll [2014-12-04] (Microsoft Corporation)
Task: {8EF9C463-B03F-47DF-A04B-248C386D4E6F} - System32\Tasks\{DD8596A6-88F3-4836-9DF5-969DE42396D7} => C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE
Task: {95AAEB31-48B7-49DF-AEC4-14CB99177417} - System32\Tasks\FF Watcher {84E5D227-76F8-4A9F-8346-C1A634A7D805} => C:\Program Files\V-bates\PrefHelper.exe
Task: {AD0CA1ED-8CF8-4D4A-9461-EE99111E0AAF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {AE55ED13-41BB-41ED-9761-40C5DE26321D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-18] (Adobe Systems Incorporated)
Task: {AED3BDF2-5D53-4CEF-8CA4-8A850EAF491E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001UA => C:\Users\KS\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-25] (Facebook Inc.)
Task: {B55997C6-8AF6-43C3-B76E-86F8D947C13A} - System32\Tasks\Nero\Nero Info => C:\Program Files\Common Files\Nero\Nero Info\NeroInfo.exe [2014-07-21] (Nero AG)
Task: {C02A9BE7-5B16-4729-8211-8B412B91F356} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\System32\appraiser.dll [2014-12-04] (Microsoft Corporation)
Task: {C1C6BCEE-4CC3-4142-A228-A2AD904831FA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001Core => C:\Users\KS\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-25] (Facebook Inc.)
Task: {CD5F7CE4-27B4-47C2-9179-3E7EFF2933BF} - System32\Tasks\{E6B362F6-E6AD-482C-B774-6AA47C4923E2} => C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE
Task: {CEC7DC91-EB9D-4886-A108-1090335DE9A6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-12-14] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001Core.job => C:\Users\KS\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001UA.job => C:\Users\KS\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FF Watcher {84E5D227-76F8-4A9F-8346-C1A634A7D805}.job => C:\Program Files\V-bates\PrefHelper.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001Core.job => C:\Users\KS\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2689239643-3006566012-3091252529-1001UA.job => C:\Users\KS\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files\AVG Secure Search\PostInstall\ROC.exe
Task: C:\Windows\Tasks\SlimDrivers Startup.job => C:\Program Files\SlimDrivers\SlimDrivers.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Windows:0FB38B7E7A2E43B7
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:AD022376
AlternateDataStreams: C:\Users\KS\AppData\Roaming\default.rss:OECustomProperty

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SecureAssist => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== Faulty Device Manager Devices =============

Name: aswVmm
Description: aswVmm
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswVmm
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: aswRvrt
Description: aswRvrt
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswRvrt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/19/2015 05:33:11 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_SysMain, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: sysmain.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7ba10
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0004b1e4
ID des fehlerhaften Prozesses: 0x410
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_SysMain0
Pfad der fehlerhaften Anwendung: svchost.exe_SysMain1
Pfad des fehlerhaften Moduls: svchost.exe_SysMain2
Berichtskennung: svchost.exe_SysMain3

Error: (01/19/2015 05:07:08 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ONENOTEM.EXE, Version: 12.0.6500.5000, Zeitstempel: 0x49a6b036
Name des fehlerhaften Moduls: rapi.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x465eef68
Ausnahmecode: 0xc0000005
Fehleroffset: 0x73e342ff
ID des fehlerhaften Prozesses: 0xbe4
Startzeit der fehlerhaften Anwendung: 0xONENOTEM.EXE0
Pfad der fehlerhaften Anwendung: ONENOTEM.EXE1
Pfad des fehlerhaften Moduls: ONENOTEM.EXE2
Berichtskennung: ONENOTEM.EXE3

Error: (01/19/2015 05:06:51 PM) (Source: Brother BrLog) (User: )
Description: TWN BrtTWN: [2015/01/19 17:06:51.816]: [00002356]: Initialize TwdsMain Class failed!

Error: (01/19/2015 05:06:51 PM) (Source: Brother BrLog) (User: )
Description: TWN BrtTWN: [2015/01/19 17:06:51.816]: [00002356]: ##### Fatal ERROR!! Create STI-device failed! #####

Error: (01/19/2015 03:20:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ONENOTEM.EXE, Version: 12.0.6500.5000, Zeitstempel: 0x49a6b036
Name des fehlerhaften Moduls: rapi.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x465eef68
Ausnahmecode: 0xc0000005
Fehleroffset: 0x6a8642ff
ID des fehlerhaften Prozesses: 0xea8
Startzeit der fehlerhaften Anwendung: 0xONENOTEM.EXE0
Pfad der fehlerhaften Anwendung: ONENOTEM.EXE1
Pfad des fehlerhaften Moduls: ONENOTEM.EXE2
Berichtskennung: ONENOTEM.EXE3

Error: (01/19/2015 00:24:48 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ONENOTEM.EXE, Version: 12.0.6500.5000, Zeitstempel: 0x49a6b036
Name des fehlerhaften Moduls: rapi.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x465eef68
Ausnahmecode: 0xc0000005
Fehleroffset: 0x69f742ff
ID des fehlerhaften Prozesses: 0xf04
Startzeit der fehlerhaften Anwendung: 0xONENOTEM.EXE0
Pfad der fehlerhaften Anwendung: ONENOTEM.EXE1
Pfad des fehlerhaften Moduls: ONENOTEM.EXE2
Berichtskennung: ONENOTEM.EXE3

Error: (01/18/2015 11:44:21 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ONENOTEM.EXE, Version: 12.0.6500.5000, Zeitstempel: 0x49a6b036
Name des fehlerhaften Moduls: rapi.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x465eef68
Ausnahmecode: 0xc0000005
Fehleroffset: 0x6a3942ff
ID des fehlerhaften Prozesses: 0xf48
Startzeit der fehlerhaften Anwendung: 0xONENOTEM.EXE0
Pfad der fehlerhaften Anwendung: ONENOTEM.EXE1
Pfad des fehlerhaften Moduls: ONENOTEM.EXE2
Berichtskennung: ONENOTEM.EXE3

Error: (01/18/2015 08:47:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ONENOTEM.EXE, Version: 12.0.6500.5000, Zeitstempel: 0x49a6b036
Name des fehlerhaften Moduls: rapi.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x465eef68
Ausnahmecode: 0xc0000005
Fehleroffset: 0x718442ff
ID des fehlerhaften Prozesses: 0xef8
Startzeit der fehlerhaften Anwendung: 0xONENOTEM.EXE0
Pfad der fehlerhaften Anwendung: ONENOTEM.EXE1
Pfad des fehlerhaften Moduls: ONENOTEM.EXE2
Berichtskennung: ONENOTEM.EXE3

Error: (01/18/2015 08:39:32 PM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)

Error: (01/18/2015 08:39:32 PM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (01/19/2015 06:41:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:41:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:41:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:41:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:41:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:41:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:38:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:38:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:38:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (01/19/2015 06:38:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068


Microsoft Office Sessions:
=========================
Error: (07/26/2014 08:15:52 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 55 seconds with 0 seconds of active time. This session ended with a crash.

Error: (07/01/2013 08:09:10 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 41292 seconds with 1560 seconds of active time. This session ended with a crash.

Error: (05/11/2013 00:28:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 66 seconds with 60 seconds of active time. This session ended with a crash.

Error: (05/11/2013 00:27:10 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3490 seconds with 120 seconds of active time. This session ended with a crash.

Error: (02/28/2013 08:28:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 57 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/15/2013 04:06:20 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 20088 seconds with 720 seconds of active time. This session ended with a crash.

Error: (12/11/2012 11:37:51 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 32 seconds with 0 seconds of active time. This session ended with a crash.

Error: (11/13/2012 09:51:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 624 seconds with 60 seconds of active time. This session ended with a crash.

Error: (10/30/2012 08:26:59 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4160 seconds with 300 seconds of active time. This session ended with a crash.

Error: (10/22/2012 00:10:42 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6661.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 26 seconds with 0 seconds of active time. This session ended with a crash.


CodeIntegrity Errors:
===================================
Date: 2014-02-03 13:27:44.884
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\PROGRA~2\McAfee\SITEAD~1\sahook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2014-02-03 13:27:27.507
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\PROGRA~2\McAfee\SITEAD~1\sahook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3327.43 MB
Available physical RAM: 2701.04 MB
Total Pagefile: 6653.15 MB
Available Pagefile: 6068.52 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:187.37 GB) (Free:94.78 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:24.82 GB) (Free:4.54 GB) FAT32
Drive e: (DATA) (Fixed) (Total:298.08 GB) (Free:127.97 GB) NTFS
Drive f: () (Fixed) (Total:85.89 GB) (Free:85.38 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 06680895)
Partition 1: (Not Active) - (Size=298 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8BA11F9C)
Partition 1: (Active) - (Size=187 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=86 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25 GB) - (Type=OF Extended)

==================== End Of Log ============================

wer kann mir weiterhelfen

hi,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers