Trojaner-Board - Browser von Highjacker (Certified Toolbar) befallen?

Hallo Schrauber, hoffe das ich die Daten so richtig erstellt habe.

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-09-2013 01

Ran by Tata at 2013-09-21 12:15:34

Running from C:\Users\Tata\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Installed Programs =======================
 

32 Bit HP CIO Components Installer (Version: 1.1.0)

888poker

Acrobat.com (Version: 1.6.65)

Adobe AIR (Version: 1.5.3.9130)

Adobe Flash Player 11 ActiveX (Version: 11.8.800.175)

Adobe Flash Player 11 Plugin (Version: 11.8.800.168)

Adobe Reader 9.5.2 MUI (Version: 9.5.2)

ASUS VIBE (Version: 1.0.187)

ASUSUpdate for Eee PC (Version: 1.04.01)

Atheros Client Installation Program (Version: 7.0)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.10)

CapsHook (Version: 1.0.0.5)

D3DX10 (Version: 15.4.2368.0902)

E-Cam (Version: 2.0.2.5)

Eee Docking 3.7.0 (Version: 3.7.0)

EeeSplendid (Version: 5.1.2.0011)

Facebook Video Calling 1.2.0.287 (Version: 1.2.287)

FontResizer (Version: 1.01.0011)

Hotkey Service (Version: 1.27)

Intel(R) Graphics Media Accelerator Driver (Version: 8.14.10.2230)

Intel® Matrix Storage Manager

Junk Mail filter update (Version: 15.4.3502.0922)

Kaspersky PURE 2.0 (Version: 12.0.2.733)

LiveUpdate (Version: 1.21)

LocaleMe (Version: 1.3)

Messenger Companion (Version: 15.4.3502.0922)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6012.5000)

Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)

Mozilla Firefox 23.0.1 (x86 de) (Version: 23.0.1)

Mozilla Maintenance Service (Version: 23.0.1)

Mozilla Thunderbird 12.0.1 (x86 de) (Version: 12.0.1)

MSVCRT (Version: 15.4.2862.0708)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)

MSXML 4.0 SP3 Parser (KB2721691) (Version: 4.30.2114.0)

MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)

MSXML 4.0 SP3 Parser (KB973685) (Version: 4.30.2107.0)

Ralink RT2860 Wireless LAN Card (Version: 1.2.0.1)

Realtek High Definition Audio Driver (Version: 6.0.1.6098)

Samsung New PC Studio (Version: 1.00.0000)

SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)

Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)

Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (Version: 6.5)

Skype™ 6.3 (Version: 6.3.105)

Spybot - Search & Destroy (Version: 2.1.21)

Super Hybrid Engine (Version: 2.16)

Synaptics Pointing Device Driver (Version: 14.0.16.0)

TuneUp Utilities Language Pack (de-DE) (Version: 13.0.2020.4)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)

VLC media player 2.0.1 (Version: 2.0.1)

Windows Driver Package - Broadcom Bluetooth  (07/29/2009 6.1.7100.0) (Version: 07/29/2009 6.1.7100.0)

Windows Live Communications Platform (Version: 15.4.3502.0922)

Windows Live Essentials (Version: 15.4.3502.0922)

Windows Live Essentials (Version: 15.4.3508.1109)

Windows Live Family Safety (Version: 15.4.3502.0922)

Windows Live Fotogalerie (Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)

Windows Live Installer (Version: 15.4.3502.0922)

Windows Live Mail (Version: 15.4.3502.0922)

Windows Live Messenger (Version: 15.4.3502.0922)

Windows Live Messenger Companion Core (Version: 15.4.3502.0922)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (Version: 15.4.3502.0922)

Windows Live Photo Common (Version: 15.4.3502.0922)

Windows Live Photo Gallery (Version: 15.4.3502.0922)

Windows Live PIMT Platform (Version: 15.4.3508.1109)

Windows Live SOXE (Version: 15.4.3502.0922)

Windows Live SOXE Definitions (Version: 15.4.3502.0922)

Windows Live Sync (Version: 14.0.8117.416)

Windows Live UX Platform (Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)

Windows Live Writer (Version: 15.4.3502.0922)

Windows Live Writer Resources (Version: 15.4.3502.0922)

WinRAR 4.00 (32-Bit) (Version: 4.00.0)
 

==================== Restore Points  =========================
 

31-08-2013 20:38:57 Gerätetreiber-Paketinstallation: TAP-Win32 Provider V9 Netzwerkadapter

01-09-2013 08:59:31 Windows Update

05-09-2013 15:11:12 Windows Update

06-09-2013 15:10:18 Windows Modules Installer

07-09-2013 07:12:17 Windows Update

08-09-2013 15:45:24 Windows Update

13-09-2013 16:01:20 Windows Update

17-09-2013 09:40:06 Windows Update

19-09-2013 15:39:51 Windows Update

19-09-2013 16:41:41 Removed Google Earth Plug-in.
 

==================== Hosts content: ==========================
 

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {06B33D1C-C2DB-4E08-9CA4-6196A4A1E89B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task

Task: {0B44B81D-48AD-48A8-8B90-1C26EDC4F2CD} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search &amp; Destroy 2\SDImmunize.exe

Task: {0D9B5D92-3A22-486D-A887-3AA21597CF27} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started

Task: {15DA0317-D080-417C-A31A-5B3751CA96A6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {1C0B32B4-A8DA-46E6-AEDC-776448CBDA0E} - System32\Tasks\{CA957EF3-B25E-43F1-844A-3A62065E1FE7} => C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe

Task: {4759047C-36F1-4A2E-8A5C-2C1AA6E266A7} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe

Task: {5B6FDBB7-87C2-42B3-AA72-4283CD166EBD} - System32\Tasks\Express Files Updater => C:\Program Files\ExpressFiles\EFupdater.exe

Task: {6C98BBFC-2203-42E4-A965-A638D974931F} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-19] (Adobe Systems Incorporated)

Task: {7AAA9E96-84D0-4D34-99C5-636256452B6A} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)

Task: {7EF0C906-FBF1-48E7-AC57-C31D95401FCE} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)

Task: {835EE452-5A71-46B6-86E2-AE2919E63B15} - System32\Tasks\{E585A942-D4AF-4A8E-BB52-0774DCBC9519} => C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe

Task: {A346570E-E1AB-4719-9C18-D6D7D49F4FD3} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)

Task: {ADBFE650-FDAF-4B35-82E9-A6C329C00FED} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search &amp; Destroy 2\SDUpdate.exe

Task: {B1EEFED4-4280-44C1-A0A3-3D92A66AC93C} - System32\Tasks\{E8EE9B7E-FA98-46F7-A7B4-0438678160B9} => C:\Program Files\ZTE Join Air\UIMain.exe

Task: {BF0DF3C9-6743-4E8E-B66D-1AC6187BCE0A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\System32\sdengin2.dll [2010-11-20] (Microsoft Corporation)

Task: {C30DC258-DAC0-4A5A-B5DC-BE497FC8C21E} - System32\Tasks\{3B41925D-81DC-494B-83F9-DD40B16CFA4D} => C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe

Task: {C94055BC-1EFD-4732-A279-04016923DC84} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3410928345-68631471-2763714656-1000Core => C:\Users\Tata\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-19] (Facebook Inc.)

Task: {D5098300-809A-4652-9260-CC834B24F2D0} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3410928345-68631471-2763714656-1000UA => C:\Users\Tata\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-19] (Facebook Inc.)

Task: {DA6BF497-47D9-49BA-8936-139B3BFFFC2F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)

Task: {F9255CD7-7E5D-40E1-A87F-05C6807F9C97} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search &amp; Destroy 2\SDScan.exe

Task: {FDAC72A8-A4D2-4FB6-A23B-F9AA5C4AFBD2} - System32\Tasks\{A4777EB8-79A5-4F10-92D2-2C28756025A1} => C:\Program Files\TerraTec\TerraTec Home Cinema\CinergyDvr.exe

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3410928345-68631471-2763714656-1000Core.job => C:\Users\Tata\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3410928345-68631471-2763714656-1000UA.job => C:\Users\Tata\AppData\Local\Facebook\Update\FacebookUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-03-27 12:34 - 2011-03-02 12:40 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll

2013-09-19 20:17 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2013-09-19 20:17 - 2013-05-16 10:55 - 03643800 _____ (Project JEDI) C:\Program Files\Spybot - Search & Destroy 2\Jcl150.bpl

2013-09-19 20:17 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl

2010-10-25 04:56 - 2010-10-25 04:56 - 00303616 _____ (Intel Corporation) C:\windows\system32\igfxrDEU.lrc

2012-08-30 22:24 - 2012-08-30 22:24 - 02126264 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\QtCore4.dll

2012-08-30 22:24 - 2012-08-30 22:24 - 07422392 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\QtGui4.dll

2012-08-30 22:23 - 2012-08-30 22:23 - 00459192 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\dblite.dll

2012-08-30 22:24 - 2012-08-30 22:24 - 02453944 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\QtDeclarative4.dll

2012-08-30 22:24 - 2012-08-30 22:24 - 01270200 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\QtScript4.dll

2012-08-30 22:24 - 2012-08-30 22:24 - 00192952 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\QtSql4.dll

2012-08-30 22:24 - 2012-08-30 22:24 - 00795064 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\QtNetwork4.dll

2011-09-05 19:36 - 2011-09-05 19:36 - 00025088 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\imageformats\qgif4.dll

2011-09-05 19:36 - 2011-09-05 19:36 - 00180224 _____ () C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\imageformats\qjpeg4.dll

2013-08-21 19:42 - 2013-08-21 19:42 - 03551640 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) ==========
 

AlternateDataStreams: C:\ProgramData\TEMP:AB689DEA
 

==================== Faulty Device Manager Devices =============
 

Name: Atheros AR8132 PCI-E Fast Ethernet Controller (NDIS 6.20)

Description: Atheros AR8132 PCI-E Fast Ethernet Controller (NDIS 6.20)

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Atheros

Service: L1C

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (09/19/2013 09:37:59 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 23.0.1.4974, Zeitstempel: 0x520bc1d5

Name des fehlerhaften Moduls: mozalloc.dll, Version: 23.0.1.4974, Zeitstempel: 0x520ba12c

Ausnahmecode: 0x80000003

Fehleroffset: 0x00001988

ID des fehlerhaften Prozesses: 0x1280

Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0

Pfad der fehlerhaften Anwendung: plugin-container.exe1

Pfad des fehlerhaften Moduls: plugin-container.exe2

Berichtskennung: plugin-container.exe3
 

Error: (09/19/2013 05:47:40 PM) (Source: Windows Backup) (User: )

Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "E:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
 

Error: (09/08/2013 07:52:21 PM) (Source: Windows Backup) (User: )

Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "E:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
 

Error: (09/07/2013 07:13:14 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: SafetyNutManager.exe, Version: 5.0.0.8883, Zeitstempel: 0x52138bbe

Name des fehlerhaften Moduls: SafetyNutManager.exe, Version: 5.0.0.8883, Zeitstempel: 0x52138bbe

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0004ab76

ID des fehlerhaften Prozesses: 0x614

Startzeit der fehlerhaften Anwendung: 0xSafetyNutManager.exe0

Pfad der fehlerhaften Anwendung: SafetyNutManager.exe1

Pfad des fehlerhaften Moduls: SafetyNutManager.exe2

Berichtskennung: SafetyNutManager.exe3
 

Error: (09/06/2013 06:22:16 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.

Ungültige XML-Syntax.
 

Error: (09/06/2013 06:22:09 PM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.

Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 

Error: (09/06/2013 05:10:03 PM) (Source: System Restore) (User: )

Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x81000101).
 

Error: (09/06/2013 05:09:45 PM) (Source: Application Error) (User: )

Description: Name der fehlerhaften Anwendung: msxml6rd.exe, Version: 1.0.0.1, Zeitstempel: 0x788e8b8a

Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000

Ausnahmecode: 0xc0000005

Fehleroffset: 0x006f28a5

ID des fehlerhaften Prozesses: 0x164

Startzeit der fehlerhaften Anwendung: 0xmsxml6rd.exe0

Pfad der fehlerhaften Anwendung: msxml6rd.exe1

Pfad des fehlerhaften Moduls: msxml6rd.exe2

Berichtskennung: msxml6rd.exe3
 

Error: (09/05/2013 05:18:07 PM) (Source: Windows Backup) (User: )

Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "E:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
 

Error: (09/01/2013 11:47:07 AM) (Source: SideBySide) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.

Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
 

System errors:

=============

Error: (09/21/2013 11:57:55 AM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.
 

Error: (09/19/2013 09:59:03 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (09/19/2013 09:53:33 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (09/19/2013 09:52:35 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (09/19/2013 09:52:35 PM) (Source: Service Control Manager) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.
 

Error: (09/19/2013 06:31:29 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (09/19/2013 06:29:16 PM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)

Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x8007045b
 

Error: (09/19/2013 06:27:58 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

cdrom
 

Error: (09/19/2013 06:26:26 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: 

%%5
 

Error: (09/19/2013 06:26:03 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)

Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070005 fehlgeschlagen: Definition Update for Windows Defender - KB915597 (Definition 1.159.53.0)
 
 

Microsoft Office Sessions:

=========================

Error: (09/19/2013 09:37:59 PM) (Source: Application Error)(User: )

Description: plugin-container.exe23.0.1.4974520bc1d5mozalloc.dll23.0.1.4974520ba12c8000000300001988128001ceb56cb9b59466C:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dllfd23f815-2162-11e3-83a0-96788f0693be
 

Error: (09/19/2013 05:47:40 PM) (Source: Windows Backup)(User: )

Description: E:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)
 

Error: (09/08/2013 07:52:21 PM) (Source: Windows Backup)(User: )

Description: E:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)
 

Error: (09/07/2013 07:13:14 PM) (Source: Application Error)(User: )

Description: SafetyNutManager.exe5.0.0.888352138bbeSafetyNutManager.exe5.0.0.888352138bbec00000050004ab7661401ceabed22794ef9C:\Program Files\Movies Toolbar\SafetyNut\SafetyNutManager.exeC:\Program Files\Movies Toolbar\SafetyNut\SafetyNutManager.exec717ab9f-17e0-11e3-9696-c0bb935db0a2
 

Error: (09/06/2013 06:22:16 PM) (Source: SideBySide)(User: )

Description: c:\program files\cyberghost vpn\OpenVPN\openssl.exec:\program files\cyberghost vpn\OpenVPN\openssl.exe0
 

Error: (09/06/2013 06:22:09 PM) (Source: SideBySide)(User: )

Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
 

Error: (09/06/2013 05:10:03 PM) (Source: System Restore)(User: )

Description: C:\windows\system32\svchost.exe -k netsvcsWindows Update0x81000101
 

Error: (09/06/2013 05:09:45 PM) (Source: Application Error)(User: )

Description: msxml6rd.exe1.0.0.1788e8b8aunknown0.0.0.000000000c0000005006f28a516401ceaa4966221059C:\windows\system32\msxml6rd.exeunknown5c692b21-1706-11e3-9d02-d49c7c51029f
 

Error: (09/05/2013 05:18:07 PM) (Source: Windows Backup)(User: )

Description: E:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)
 

Error: (09/01/2013 11:47:07 AM) (Source: SideBySide)(User: )

Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 78%

Total physical RAM: 1014.18 MB

Available physical RAM: 218.55 MB

Total Pagefile: 2038.18 MB

Available Pagefile: 470.84 MB

Total Virtual: 2047.88 MB

Available Virtual: 1912.21 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:100 GB) (Free:74.32 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: () (Fixed) (Total:117.87 GB) (Free:61.25 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 29133921)

Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=15 GB) - (Type=1B)

Partition 3: (Not Active) - (Size=118 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=20 MB) - (Type=EF)
 

==================== End Of Log ============================

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-09-2013 01

Ran by Tata (administrator) on TATA-PC on 21-09-2013 12:07:55

Running from C:\Users\Tata\Downloads

Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

() C:\Windows\System32\AsusService.exe

(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe

(Infowatch) C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe

(Teruten) C:\windows\system32\FsUsbExService.Exe

() C:\windows\system32\msxml6rd.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe

(Intel Corporation) C:\windows\system32\igfxsrvc.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe

(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2010-04-13] (Synaptics Incorporated)

HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [83240 2010-04-13] (Synaptics Incorporated)

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9177632 2010-06-22] (Realtek Semiconductor)

HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [ASUSPRP] - C:\Program Files\ASUS\APRP\APRP.EXE [2018032 2010-06-24] (ASUSTek Computer Inc.)

HKLM\...\Run: [AVP] - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe [202328 2012-08-30] (Kaspersky Lab ZAO)

HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)

Winlogon\Notify\klogon: C:\windows\system32\klogon.dll (Kaspersky Lab ZAO)

Winlogon\Notify\SDWinLogon: C:\windows\system32\klogon.dll (Kaspersky Lab ZAO)

MountPoints2: E - E:\setup_vmc_lite.exe /checkApplicationPresence

MountPoints2: F - F:\setup_vmc_lite.exe /checkApplicationPresence

MountPoints2: {10340775-73ca-11e0-b00e-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {10340782-73ca-11e0-b00e-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {7aa8fbee-5863-11e0-86db-bcaec526ac93} - F:\setup_vmc_lite.exe /checkApplicationPresence

MountPoints2: {86319cf9-742f-11e0-84ed-956e530e129b} - E:\AutoRun.exe

MountPoints2: {86319d0c-742f-11e0-84ed-956e530e129b} - E:\AutoRun.exe

MountPoints2: {b50d073d-f696-11e0-bda1-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {b50d074d-f696-11e0-bda1-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {b50d0856-f696-11e0-bda1-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {b50d0863-f696-11e0-bda1-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {c3c452d7-6c47-11e0-bd99-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {c3c452f1-6c47-11e0-bd99-bcaec526ac93} - E:\AutoRun.exe

MountPoints2: {db69bf47-7618-11e0-a835-bcaec526ac93} - E:\AutoRun.exe

HKU\Default\...\RunOnce: [Reboot] - AsusSender.exe C:\Windows\AP\Reboot.exe 60

HKU\Default User\...\RunOnce: [Reboot] - AsusSender.exe C:\Windows\AP\Reboot.exe 60

BootExecute: autocheck autochk * sdnclean.exe
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=100&systemid=473&v=n8883-91&apn_uid=1005122023254753&apn_dtid=BND473&o=APN10640&apn_ptnrs=AG1&q={searchTerms}

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox

SearchScopes: HKCU - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=100&systemid=473&v=n8883-91&apn_uid=1005122023254753&apn_dtid=BND473&o=APN10640&apn_ptnrs=AG1&q={searchTerms}

SearchScopes: HKCU - {BD88250C-E0DE-48B8-BA64-A49A23A00C04} URL = hxxp://search.certified-toolbar.com?si=66807&st=bs&tid=6724&ver=4.6&ts=1377971266103&tguid=66807-6724-1377971266103-35F6E9763AB95768F7C0E814FD3BAF88&q={searchTerms}

SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\ievkbd.dll (Kaspersky Lab ZAO)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\klwtbbho.dll (Kaspersky Lab ZAO)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Tata\AppData\Roaming\Mozilla\Firefox\Profiles\jkin9eaw.default-1352533229809

FF Homepage: about:blank

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()

FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Tata\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\qvo6.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: No Name - C:\Users\Tata\AppData\Roaming\Mozilla\Firefox\Profiles\jkin9eaw.default-1352533229809\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF Extension: Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2

FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2

FF HKLM\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\linkfilter@kaspersky.ru

FF Extension: Modul zur Link-Untersuchung - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\linkfilter@kaspersky.ru

FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\virtualKeyboard@kaspersky.ru

FF Extension: Virtuelle Tastatur - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\virtualKeyboard@kaspersky.ru

FF HKLM\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\KavAntiBanner@Kaspersky.ru

FF Extension: Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\FFExt\KavAntiBanner@Kaspersky.ru
 

========================== Services (Whitelisted) =================
 

R2 AsusService; C:\Windows\System32\AsusService.exe [219136 2009-08-19] ()

R2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky PURE 2.0\avp.exe [202328 2012-08-30] (Kaspersky Lab ZAO)

R2 CSObjectsSrv; C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [743992 2009-12-21] (Infowatch)

R2 msdtc32; C:\windows\system32\msxml6rd.exe [68608 2013-06-24] ()

R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
 

==================== Drivers (Whitelisted) ====================
 

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [490624 2012-02-15] (ITETech                  )

R1 AsUpIO; C:\Windows\System32\drivers\AsUpIO.sys [11520 2010-06-21] ()

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)

R0 CSCrySec; C:\Windows\System32\DRIVERS\CSCrySec.sys [88632 2009-12-14] (Infowatch)

R1 CSVirtualDiskDrv; C:\Windows\System32\DRIVERS\CSVirtualDiskDrv.sys [39352 2009-12-14] (Infowatch)

R3 FsUsbExDisk; C:\windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [13880 2010-04-13] ( )

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [135984 2011-10-20] (Kaspersky Lab ZAO)

R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [13104 2011-10-20] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [585560 2013-05-19] (Kaspersky Lab)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [23856 2011-03-10] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [19984 2009-11-02] (Kaspersky Lab)

S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2011-10-14] (Silicon Laboratories)

S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61312 2011-10-14] (Silicon Laboratories)

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2010-04-27] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14848 2010-04-27] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [123648 2010-04-27] (MCCI Corporation)

S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)

S3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [114688 2009-08-18] (ZTE Corporation)

S3 ZTEusbvoice; C:\Windows\System32\DRIVERS\ZTEusbvoice.sys [105088 2009-08-18] (ZTE Incorporated)

S3 btwaudio; system32\drivers\btwaudio.sys [x]

S3 btwavdt; \SystemRoot\system32\DRIVERS\btwavdt.sys [x]

S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [x]

S3 btwrchid; \SystemRoot\system32\DRIVERS\btwrchid.sys [x]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]

S3 tsusbhub; system32\drivers\tsusbhub.sys [x]

S3 VGPU; System32\drivers\rdvgkmd.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2030-01-01 13:58 - 2010-11-20 14:40 - 00383786 __RSH C:\bootmgr

2013-09-21 12:07 - 2013-09-21 12:07 - 00000000 ____D C:\FRST

2013-09-21 12:06 - 2013-09-21 12:06 - 01083549 _____ (Farbar) C:\Users\Tata\Downloads\FRST.exe

2013-09-19 21:55 - 2013-09-21 12:09 - 00037545 _____ C:\windows\WindowsUpdate.log

2013-09-19 21:51 - 2013-09-19 21:58 - 00000112 _____ C:\windows\setupact.log

2013-09-19 21:51 - 2013-09-19 21:51 - 00000630 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-09-19 21:51 - 2013-09-19 21:51 - 00000000 _____ C:\windows\setuperr.log

2013-09-19 21:46 - 2013-09-19 22:08 - 00000000 ____D C:\AdwCleaner

2013-09-19 21:45 - 2013-09-19 21:45 - 01039554 _____ C:\Users\Tata\Downloads\adwcleaner.exe

2013-09-19 20:41 - 2013-09-19 20:41 - 00007377 _____ C:\Users\Tata\Desktop\prüfung.txt

2013-09-19 20:19 - 2013-09-19 20:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-09-19 20:17 - 2013-09-19 20:19 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2

2013-09-19 20:17 - 2013-09-19 20:17 - 00002079 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2013-09-19 20:17 - 2009-01-25 13:14 - 00015224 _____ (Safer Networking Limited) C:\windows\system32\sdnclean.exe

2013-09-19 20:10 - 2013-09-19 20:11 - 37672592 _____ (Safer-Networking Ltd.                                       ) C:\Users\Tata\Downloads\spybotsd-2.1.21-SR2.exe

2013-09-19 19:53 - 2013-09-19 19:53 - 00006599 _____ C:\Users\Tata\Desktop\hijackthis.log

2013-09-19 19:43 - 2013-09-19 19:43 - 00000000 ____D C:\Users\Tata\Desktop\backups

2013-09-19 19:40 - 2011-03-29 09:04 - 00388608 _____ (Trend Micro Inc.) C:\Users\Tata\Desktop\HijackThis.exe

2013-09-19 17:52 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-09-19 17:52 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-09-19 17:52 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-09-19 17:52 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-09-19 17:52 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-09-19 17:52 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-09-19 17:51 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-09-19 17:51 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-09-19 17:51 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-09-17 11:41 - 2013-09-17 11:41 - 00000000 ____D C:\ed5cae780ae3aa9edd52460f2690

2013-09-13 18:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll

2013-09-13 18:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll

2013-09-13 18:27 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2013-09-13 18:27 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys

2013-09-13 18:27 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll

2013-09-13 18:27 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll

2013-09-13 18:27 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe

2013-09-13 18:27 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-13 18:27 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-07 19:00 - 2013-09-07 19:00 - 00000000 ____D C:\windows\system32\IO

2013-08-31 22:50 - 2013-08-31 22:51 - 00000646 _____ C:\Users\Tata\Documents\CyberGhostPUK.html

2013-08-31 22:37 - 2011-12-15 20:29 - 00026624 _____ (The OpenVPN Project) C:\windows\system32\Drivers\tap0901.sys

2013-08-31 19:49 - 2013-08-13 08:38 - 00032328 _____ C:\windows\Launcher.exe

2013-08-31 19:20 - 2013-09-01 10:53 - 00000000 ____D C:\Program Files\Lyrics-Viewer

2013-08-31 12:58 - 2013-08-31 12:58 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
 

==================== One Month Modified Files and Folders =======
 

2030-01-01 13:58 - 2009-07-14 06:57 - 00029696 ___SH C:\windows\system32\config\BCD-Template.LOG

2030-01-01 13:58 - 2009-07-14 06:52 - 00032768 _____ C:\windows\system32\config\BCD-Template

2013-09-21 12:10 - 2009-07-14 06:34 - 00018160 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-09-21 12:10 - 2009-07-14 06:34 - 00018160 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-09-21 12:09 - 2013-09-19 21:55 - 00037545 _____ C:\windows\WindowsUpdate.log

2013-09-21 12:07 - 2013-09-21 12:07 - 00000000 ____D C:\FRST

2013-09-21 12:06 - 2013-09-21 12:06 - 01083549 _____ (Farbar) C:\Users\Tata\Downloads\FRST.exe

2013-09-21 12:04 - 2012-11-19 21:37 - 00000902 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3410928345-68631471-2763714656-1000Core.job

2013-09-21 12:02 - 2013-05-19 12:36 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2013-09-21 11:58 - 2013-04-20 14:48 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-09-21 11:58 - 2012-11-19 21:37 - 00000924 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3410928345-68631471-2763714656-1000UA.job

2013-09-21 11:58 - 2009-07-14 04:37 - 00000000 ____D C:\windows\tracing

2013-09-19 22:08 - 2013-09-19 21:46 - 00000000 ____D C:\AdwCleaner

2013-09-19 21:58 - 2013-09-19 21:51 - 00000112 _____ C:\windows\setupact.log

2013-09-19 21:58 - 2011-05-01 23:10 - 00016384 _____ C:\windows\system32\Ikeext.etl

2013-09-19 21:58 - 2009-07-14 06:53 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-09-19 21:51 - 2013-09-19 21:51 - 00000630 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-09-19 21:51 - 2013-09-19 21:51 - 00000000 _____ C:\windows\setuperr.log

2013-09-19 21:51 - 2012-04-15 09:42 - 01047836 _____ C:\windows\PFRO.log

2013-09-19 21:45 - 2013-09-19 21:45 - 01039554 _____ C:\Users\Tata\Downloads\adwcleaner.exe

2013-09-19 20:41 - 2013-09-19 20:41 - 00007377 _____ C:\Users\Tata\Desktop\prüfung.txt

2013-09-19 20:34 - 2013-09-19 20:19 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy

2013-09-19 20:32 - 2012-04-02 08:58 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe

2013-09-19 20:32 - 2011-12-03 15:07 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl

2013-09-19 20:19 - 2013-09-19 20:17 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2

2013-09-19 20:17 - 2013-09-19 20:17 - 00002079 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk

2013-09-19 20:11 - 2013-09-19 20:10 - 37672592 _____ (Safer-Networking Ltd.                                       ) C:\Users\Tata\Downloads\spybotsd-2.1.21-SR2.exe

2013-09-19 19:53 - 2013-09-19 19:53 - 00006599 _____ C:\Users\Tata\Desktop\hijackthis.log

2013-09-19 19:43 - 2013-09-19 19:43 - 00000000 ____D C:\Users\Tata\Desktop\backups

2013-09-19 19:41 - 2011-02-05 19:10 - 00000000 ____D C:\Users\Tata\AppData\Local\VirtualStore

2013-09-19 18:46 - 2013-01-03 14:09 - 00000000 ____D C:\Program Files\Google

2013-09-19 18:44 - 2013-06-24 19:25 - 00000000 ____D C:\Program Files\VS Revo Group

2013-09-19 18:31 - 2009-07-14 06:33 - 00268272 _____ C:\windows\system32\FNTCACHE.DAT

2013-09-19 18:28 - 2009-07-14 04:37 - 00000000 ____D C:\windows\system32\de-DE

2013-09-17 11:41 - 2013-09-17 11:41 - 00000000 ____D C:\ed5cae780ae3aa9edd52460f2690

2013-09-17 11:41 - 2013-08-14 19:09 - 00000000 ____D C:\windows\system32\MRT

2013-09-17 11:41 - 2011-02-05 19:04 - 76725432 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2013-09-07 19:00 - 2013-09-07 19:00 - 00000000 ____D C:\windows\system32\IO

2013-09-01 10:53 - 2013-08-31 19:20 - 00000000 ____D C:\Program Files\Lyrics-Viewer

2013-08-31 22:51 - 2013-08-31 22:50 - 00000646 _____ C:\Users\Tata\Documents\CyberGhostPUK.html

2013-08-31 19:49 - 2013-08-21 19:42 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-08-31 19:21 - 2011-02-05 19:10 - 00000000 ____D C:\Users\Tata

2013-08-31 13:48 - 2009-07-14 04:37 - 00000000 ____D C:\windows\rescache

2013-08-31 13:45 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public

2013-08-31 12:58 - 2013-08-31 12:58 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
 

Files to move or delete:

====================

C:\Users\Tata\navistart.bat

C:\Users\Tata\Windows 7 Anytime Upgrade Generator.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-09-01 11:46
 

==================== End Of Log ============================

--- --- ---